# august 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for august 2026, painted from 12,260 published cves](https://media.cvegen.art/posters/2026-08/1280.jpg?v=26f0f9bb18)

what the poster shows: 31 days as bands of dry brush, the first day at the top. every one ran above the 2025 average for their weekday, so every band sweeps fast and wide. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-08.mp4?v=8e5369830d)

| fact | value |
| --- | --- |
| cves | 12,260 |
| against an average 2025 month | 3.1× |
| busiest day | aug 18, 1,405 |
| rated critical, cvss 9 or higher | 1,743 |
| critical with no login and no click | 1,319 |
| used in real attacks | 20 |

## august 2026 in numbers

august 2026 brought 12,260 cves, 3.1 times an average 2025 month. every one of its 31 days ran above the 2025 average for that weekday.

- 1,405 on aug 18, the busiest day. oracle published 889 of them at once.
- 1,743 rated critical, cvss 9 or higher. 1,319 of them can be hit over the network with no login and nothing for a user to click.
- 505 in browsers, 11 times their 2025 monthly average. no other kind of software grew as fast.
- 2,135 came in three single drops: oracle 889 on aug 18, the linux kernel team 844 on aug 15, microsoft 402 on aug 11.

## 20 already used in real attacks

cisa kev, as of oct 24.

### by product

- 3 jfrog artifactory, aug 12, 28
- 2 n-able n-central, aug 1, 2
- 2 trueconf server, aug 19
- 2 papercut ng/mf, aug 28
- 1 apple macos, aug 6
- 1 wso2 products, aug 6
- 1 metabase, aug 10
- 1 adobe commerce and magento, aug 11
- 1 cisco secure firewall adaptive security appliance and secure firewall threat defense, aug 11
- 1 microsoft sharepoint, aug 11
- 1 microsoft windows ancillary function driver for winsock, aug 11
- 1 synacor zimbra collaboration suite, aug 13
- 1 mlflow, aug 17
- 1 citrix netscaler, aug 19
- 1 gitea, aug 26

### every cve

- aug 1, n-able n-central, [cve-2026-18556](https://www.cve.org/CVERecord?id=CVE-2026-18556)
- aug 2, n-able n-central, [cve-2026-18577](https://www.cve.org/CVERecord?id=CVE-2026-18577)
- aug 6, wso2 multiple products, [cve-2026-5430](https://www.cve.org/CVERecord?id=CVE-2026-5430)
- aug 6, apple macos, [cve-2026-65400](https://www.cve.org/CVERecord?id=CVE-2026-65400)
- aug 10, metabase metabase, [cve-2026-72898](https://www.cve.org/CVERecord?id=CVE-2026-72898)
- aug 11, cisco secure firewall adaptive security appliance (asa) and secure firewall threat defense (ftd), [cve-2026-20349](https://www.cve.org/CVERecord?id=CVE-2026-20349)
- aug 11, microsoft sharepoint, [cve-2026-65660](https://www.cve.org/CVERecord?id=CVE-2026-65660)
- aug 11, microsoft windows ancillary function driver for winsock, [cve-2026-68820](https://www.cve.org/CVERecord?id=CVE-2026-68820)
- aug 11, adobe commerce and magento, [cve-2026-71362](https://www.cve.org/CVERecord?id=CVE-2026-71362)
- aug 12, jfrog artifactory, [cve-2026-42018](https://www.cve.org/CVERecord?id=CVE-2026-42018)
- aug 12, jfrog artifactory, [cve-2026-66384](https://www.cve.org/CVERecord?id=CVE-2026-66384)
- aug 13, synacor zimbra collaboration suite (zcs), [cve-2026-73570](https://www.cve.org/CVERecord?id=CVE-2026-73570)
- aug 17, mlflow mlflow, [cve-2026-64849](https://www.cve.org/CVERecord?id=CVE-2026-64849)
- aug 19, citrix netscaler, [cve-2026-19490](https://www.cve.org/CVERecord?id=CVE-2026-19490)
- aug 19, trueconf server, [cve-2026-72529](https://www.cve.org/CVERecord?id=CVE-2026-72529)
- aug 19, trueconf server, [cve-2026-72530](https://www.cve.org/CVERecord?id=CVE-2026-72530)
- aug 26, gitea gitea, [cve-2026-60004](https://www.cve.org/CVERecord?id=CVE-2026-60004)
- aug 28, papercut ng/mf, [cve-2026-81578](https://www.cve.org/CVERecord?id=CVE-2026-81578)
- aug 28, papercut ng/mf, [cve-2026-82078](https://www.cve.org/CVERecord?id=CVE-2026-82078)
- aug 28, jfrog artifactory, [cve-2026-82329](https://www.cve.org/CVERecord?id=CVE-2026-82329)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | august 1 to 31, 2026 |
| cves | 12,260 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-08/2000.jpg?v=26f0f9bb18)

## other months

- before: [july 2026](https://cvegen.art/2026/07.md), 9,759 cves
- after: [september 2026](https://cvegen.art/2026/09.md), 14,934 cves
- [all months](https://cvegen.art/index.md)