Month report
August 2026
Rolled up 2026-09-12 08:45 from 370,661 CVE records
10,633 CVEs published, +193% on the same month last year. 1,506 rated critical, 31 listed by CISA as exploited. linux led with 1,500; the most common weakness class was CWE-284 (1,077). siyuan note climbed 80 places, the largest move. 6 vendors ranked for the first time.
Published
10,633
Critical / high
1,506 / 4,695
Medium / low
3,365 / 346
Added to CISA KEV
31
Public exploit
249
Scanner template
32
Publication to KEV
How long before CISA listed them
Median days to listing
3
Listed within 7 days
70.6%
Listed within 30 days
100%
Detection gap
Listed as exploited, no public template
Listed this month
31
With a template
10
No template
21
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 1,500 | 195 | 7 | linux (1500) | ↑1 | ||
| 2 | oracle | 889 | 144 | helidon (99) · oracle hyperion financial management (78) · oracle hyperion infrastructure technology (67) | ↓1 | |||
| 3 | microsoft | 477 | 35 | 1 | 11 | windows server 2025 (213) · windows server 2025 server core installation (213) · windows 11 version 26h1 (194) | — | |
| 4 | ibm | 381 | 50 | 3 | aix (145) · powervm vios (145) · i (106) | ↑5 | ||
| 5 | redhat | 214 | 21 | 3 | 1 | red hat enterprise linux 9 (91) · red hat enterprise linux 8 (87) · red hat enterprise linux 7 (76) | ↑2 | |
| 6 | apache | 145 | 26 | 12 | apache cloudstack (20) · apache airflow (12) · apache cxf (12) | ↓1 | ||
| 7 | splunk | 110 | 4 | splunk enterprise (60) · splunk soar (15) · splunk ai toolkit (9) | · | |||
| 8 | adobe | 98 | 15 | 1 | 1 | content credentials rust sdk (21) · coldfusion 2023 (16) · coldfusion 2025 (16) | — | |
| 9 | siyuan note | 76 | 16 | 2 | 1 | siyuan (76) | ↑80 | |
| 10 | 74 | 11 | 2 | chrome (69) · android (2) · a2ui web core (1) | ↓6 | |||
| 11 | getgrav | 64 | 3 | grav (53) · grav plugin api (7) · grav plugin login (3) | ↑11 | |||
| 12 | mozilla | 59 | 17 | 5 | firefox (59) · thunderbird (55) | ↓2 | ||
| 13 | dell | 58 | 3 | dell command update dcu (11) · openmanage enterprise (10) · objectscale (7) | ↑4 | |||
| 14 | zephyrproject | 54 | 1 | zephyr (54) | ↑16 | |||
| 15 | elastic | 49 | kibana (31) · elasticsearch (14) · eck operator (2) | ↑13 | ||||
| 16 | gitea | 49 | 8 | 1 | 1 | 1 | gitea open source git server (47) · gitea (2) | ↑4 |
| 17 | sourcecodester | 48 | simple online food ordering system (13) · class and exam timetabling system (8) · photo share website (5) | ↓4 | ||||
| 18 | cisco | 46 | 13 | 1 | 2 | cisco ios xe software (12) · cisco secure endpoint (7) · cisco catalyst sd wan manager (6) | ↑43 | |
| 19 | apple | 40 | 1 | 1 | 6 | ios and ipados (32) · macos (30) · safari (21) | ↓13 | |
| 20 | draytek | 40 | 3 | vigorswitch fx2120 (29) · vigorswitch g1280 (29) · vigorswitch g1282 (29) | · | |||
| 21 | dokploy | 37 | 23 | dokploy (37) | · | |||
| 22 | flowiseai | 37 | 17 | 2 | 1 | flowise (37) · flowise components (1) | · | |
| 23 | freerdp | 37 | 4 | freerdp (37) | · | |||
| 24 | sap se | 35 | 3 | 1 | sap business ai platform approuter (11) · sap manufacturing integration and intelligence (5) · odata (1) | ↑41 | ||
| 25 | legion of the bouncy castle | 34 | 4 | 1 | bc java (32) · bc lts java (28) · bc fja (25) | · | ||
| 26 | mediatek | 34 | mediatek chipset (34) | · | ||||
| 27 | n8n io | 34 | n8n (34) | ↑28 | ||||
| 28 | nvidia | 34 | 2 | 2 | dynamo (15) · triton inference server (6) · dgx spark (5) | ↓10 | ||
| 29 | tp link systems | 34 | 1 | 4 | omada access points (7) · omada gateways (7) · omada switches (7) | · | ||
| 30 | mongodb | 33 | 1 | mongodb server (24) · bi connector odbc driver (5) · schema builder cli (2) | ↑2 | |||
| 31 | rsyncproject | 33 | 1 | 1 | rsync (33) | new | ||
| 32 | itsourcecode | 32 | hospital management system (19) · sales and inventory system (5) · payroll system (2) | ↑22 | ||||
| 33 | jahlives | 31 | 15 | openssl encrypt (31) | new | |||
| 34 | jfrog | 30 | 1 | 3 | 2 | 1 | artifactory (30) | ↑48 |
| 35 | budibase | 28 | 5 | 1 | budibase (21) · server (7) | · | ||
| 36 | wireshark foundation | 28 | wireshark (28) | ↑60 | ||||
| 37 | samsung mobile | 27 | samsung mobile devices (16) · smart switch (4) · samsung health (3) | ↑14 | ||||
| 38 | arcadedata | 25 | 6 | 2 | arcadedb (25) | new | ||
| 39 | code projects | 25 | online shopping system (7) · task management system (6) · barangay resident profiling management system (3) | ↓14 | ||||
| 40 | typo3 | 25 | 2 | extension apache solr for typo3 enterprise search (5) · extension femanager (4) · extension event management and registration (2) | · | |||
| 41 | gitpython developers | 24 | 2 | gitpython (24) | new | |||
| 42 | jenkins project | 24 | 1 | jenkins (6) · jenkins multijob plugin (2) · jenkins scm manager plugin (2) | · | |||
| 43 | nltk | 24 | 3 | nltk (21) · nltk nltk (3) | new | |||
| 44 | freebsd | 23 | freebsd (23) | · | ||||
| 45 | frappe | 22 | 2 | frappe (13) · erpnext (9) | · | |||
| 46 | mervinpraison | 22 | 2 | praisonai (21) · praisonaiagents (5) · praisonai platform (1) | ↓34 | |||
| 47 | tobit laboratories | 22 | 5 | teamdavid (22) | new | |||
| 48 | combodo | 21 | 1 | itop (21) | · | |||
| 49 | gl inet | 21 | 10 | gl mt3000 (13) · mt6000 (6) · x3000 (6) | · | |||
| 50 | misp | 20 | cti transmute (16) · misp stix (4) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-08 that are on the CISA KEV catalog today. The 31 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-2841,077194 critical—
- 2CWE-7964616 critical—
- 3CWE-86252144 critical—
- 4CWE-89393107 critical↑1
- 5CWE-2237840 critical↑2
- 6CWE-91829820 critical↑6
- 7CWE-63927824 critical↑6
- 8CWE-7827087 critical↑10
- 9CWE-20024312 critical↓3
- 10CWE-86323825 critical↑1
- 1CWE-9422589 critical↑8
- 2CWE-78721630 critical↑8
- 3CWE-1252113 critical↑1
- 4CWE-12220410 critical↑2
- 5CWE-7420018 critical↑7
- 6CWE-30619867 critical↓12
- 7CWE-2016821 critical↓8
- 8CWE-41616015 critical↓10
- 9CWE-28715942 critical↓2
- 10CWE-7701562 critical↑1
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.