cvegen

august 2026

cves
12,260
against an average 2025 month
3.1×
busiest day
aug 18, 1,405
used in real attacks
20

august 2026 brought 12,260 cves, 3.1 times an average 2025 month.

every one of its 31 days ran above the 2025 average for that weekday.

1,405

on aug 18, the busiest day. oracle published 889 of them at once.

1,743

rated critical, cvss 9 or higher. 1,319 of them can be hit over the network with no login and nothing for a user to click.

505

in browsers, 11 times their 2025 monthly average. no other kind of software grew as fast.

2,135

came in three single drops: oracle 889 on aug 18, the linux kernel team 844 on aug 15, microsoft 402 on aug 11.

20 already used in real attacks

cisa kev, as of oct 24

  • 3
    jfrog artifactory
    aug 12, 28
  • 2
    n-able n-central
    aug 1, 2
  • 2
    trueconf server
    aug 19
  • 2
    papercut ng/mf
    aug 28
  • 1
    apple macos
    aug 6
  • 1
    wso2 products
    aug 6
  • 1
    metabase
    aug 10
  • 1
    adobe commerce and magento
    aug 11
  • 1
    cisco secure firewall adaptive security appliance and secure firewall threat defense
    aug 11
  • 1
    microsoft sharepoint
    aug 11
and 5 more productsall 20 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
august 1 to 31, 2026
cves
12,260
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667