CVEs published August 31 to September 6, 2026
2,285 CVEs were published Aug 31 to Sep 6, 2026, 312 of them critical. CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 2,285
- Critical
- 312
- Added to CISA KEV
- 10
- Busiest day
- Fri, Sep 4 (561)
- Quietest day
- Sun, Sep 6 (92)
- August 31, 2026357 CVEs · 92 critical
- September 1, 2026477 CVEs · 71 critical
- September 2, 2026322 CVEs · 22 critical
- September 3, 2026345 CVEs · 45 critical
- September 4, 2026561 CVEs · 52 critical
- September 5, 2026131 CVEs · 18 critical
- September 6, 202692 CVEs · 12 critical
Added to CISA KEV 10
- CVE-2026-81578PaperCut MF/NG: Authentication BypassPaperCut MF/NG
- CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorPaperCut MF/NG
- CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksKludex starlette · starlette
- CVE-2026-49869Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`kestra-io kestra
- CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackBerriAI litellm · litellm
- CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactoryjfrog artifactory
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.SonicWall SMA1000
- CVE-2026-83549Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiSonicWall SMA1000
- CVE-2026-9586Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMBSangoma Switchvox SMB Edition
- CVE-2026-85046Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome