Weekly CVE Report: 11 Exploited Flaws Added to KEV

CVE WATCHTOWER logged 2,488 new vulnerabilities between August 24 and August 30, 2026. This weekly CVE report breaks down that flood of disclosures. It also flags the 11 flaws that CISA confirmed as actively exploited. The numbers show a busy week for defenders across enterprise, cloud, and open-source software.

The Week in Numbers

The volume of new disclosures stayed high. Of the 2,488 fresh CVEs, 286 rated Critical and 795 rated High. Another 720 landed at Medium severity, while the rest were low, unscored, or pending analysis.

This weekly CVE report counted 18 flaws with the maximum CVSS score of 10.0. Many affected cloud-native and AI tooling, a pattern worth watching. Web application flaws also surged, driven by a large wave of WordPress plugin bugs.

Exploited Vulnerabilities Added to CISA KEV

CISA added 11 vulnerabilities to its Known Exploited Vulnerabilities catalog this week. Attackers are using each one in real attacks. Notably, the list mixes brand-new flaws with bugs that are a decade old, which shows that unpatched legacy systems remain a soft target. Federal agencies must patch these by their due dates, and every organization should do the same.

The Oracle WebLogic proxy flaw, CVE-2026-21962, is the standout. It carries a perfect 10.0 score and sits in widely deployed middleware. The Gitea remote code execution bug is another priority for teams running self-hosted repositories.

Notable New Critical Flaws

Beyond the exploited set, several new Critical bugs deserve attention. ServiceNow patched three 10.0-rated issues, including a SQL injection and a code injection flaw. Cloud and AI projects also featured heavily, with maximum-severity bugs in Kubeflow Pipelines, KubePi, and several MCP server packages that exposed network interfaces by default.

Apache Tomcat drew scrutiny too. An authentication bypass in its DIGEST authenticator and an incomplete earlier fix both scored 9.8. WordPress site owners face the largest cleanup. Dozens of plugins and themes, from Tutor LMS to the Avada theme, shipped Critical authentication bypass, privilege escalation, and file write flaws.

What Defenders Should Do

Start with the exploited list. Prioritize the CISA KEV entries above, since attackers are already using them. Next, review your exposure to the 10.0-rated cloud and AI tooling flaws. Finally, audit WordPress installs and update every affected plugin. Regular attention to each weekly CVE report keeps patch backlogs from turning into breaches.

Never Miss a Critical CVE Again

Tracking 2,488 new CVEs by hand is not realistic. Our CVE email alert service does the watching for you. Pick the vendors you care about, and get an email the moment one of their flaws enters the CISA KEV catalog or crosses a high EPSS exploit-probability threshold. No noise, just the alerts that matter to your stack.

Start free with up to three vendors, or go Pro for unlimited vendors and coverage of every new CVE. Teams can add Slack and Microsoft Teams webhook delivery. Choose your plan below and get your first alert today.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.