Week 35, 2026 — Aug 24 – Aug 30, 2026

week in progress339 advisories4708 distinct CVEs15 critical11 exploited2 KEV additions

Everything the 24 aggregated CERT, PSIRT and vulnerability-database feeds published in this ISO week so far, condensed: what was added to the CISA KEV catalog, which advisories matter most and which products were hit. Daily detail lives in the daily briefings.

Added to the CISA KEV catalog

criticalCVE-2026-60004added 2026-08-25 · public exploit code
criticalCVE-2026-21962added 2026-08-24 · public exploit code

Notable advisories

[UPDATE] [critical] Oracle Fusion Middleware: Multiple Vulnerabilities

criticalexploitedcert-bund2026-08-25

CVE-2026-60004: Gitea Code Injection Vulnerability

criticalexploitedcisa-kev2026-08-25

Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2

criticalexploitedcccs2026-08-24

CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

criticalexploitedcisa-kev2026-08-24

CISA Adds One Known Exploited Vulnerability to Catalog

highexploitedcisa2026-08-25

[UPDATE] [high] Linux Kernel: Multiple vulnerabilities

highexploitedcert-bund2026-08-25

CISA Adds One Known Exploited Vulnerability to Catalog

highexploitedcisa2026-08-24

[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service

mediumexploitedcert-bund2026-08-25

Gitea security advisory (AV26-845)

unknownexploitedcccs2026-08-25

Zimbra Multiple Vulnerabilities

unknownexploitedhkcert2026-08-24

Multiple vulnerabilities in Metabase (August 24, 2026)

unknownexploitedcert-fr-avis2026-08-24

Bendix EC80 Brake ECU

criticalcisa2026-08-25

Most-affected products

Kernel · 96 Driver · 13 CPython · 9 WebSphere Application Server · 7 Erlang/OTP · 7 Enterprise Linux · 6 libssh2 · 5 ffmpeg · 4 GStreamer · 4 vllm · 4 Grafana · 3 WebKitGTK · 3 QEMU · 3 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in · 3 Gitea · 3

Volume by source

cert-bund: 284 ubuntu: 13 cisa: 10 jvn: 7 cccs: 6 debian: 5 hkcert: 4 cert-fr-avis: 4 ncsc-nl: 3 cisa-kev: 2 aws: 1

Other weeks

2026-W34 →daily briefings

Don't wait a week. The daily briefing lands in your inbox every morning after 06:00 UTC — subscribe free, or watch specific products for instant advisory alerts.