Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 24 to 30 August 2026 (week 35)
Final report, published . It does not change.
In the week of 24 to 30 August 2026, 11 vulnerabilities were newly recorded as exploited in the wild, 11 of them critical. The technology hit most was Linux Kernel (2), followed by Ajax.net Professional (1) and AjaxNetProfessional (NuGet) (1).
- Newly exploited
- 11
- Critical
- 11
- Technologies hit
- 15
Newly exploited this week
- CVE-2023-49105: ownCloud improper authentication vulnerabilitycriticalExploited since Published Owncloud
- CVE-2026-66384: An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.criticalCVSS 5.3Exploited since Published JFrog Artifactory
- CVE-2026-53362: Linux Kernel buffer overflow in IPv6 paged allocationcriticalCVSS 6.2Exploited since Published Linux Kernel, Linux Kernel, Red Hat Enterprise Linux
- CVE-2019-1068: Microsoft SQL Server remote code executioncriticalExploited since Published Microsoft SQL Server
- CVE-2022-0995: Linux Kernel out-of-bounds write vulnerabilitycriticalExploited since Published Linux Kernel, Linux Kernel
- CVE-2015-3246: Red Hat Libuser race condition in passwd file handlingcriticalExploited since Published Red Hat Libuser
- CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attackcriticalCVSS 7Exploited since Published Red Hat Automatic Bug Reporting Tool
- CVE-2026-8452: NetScaler ADC and Gateway memory overflow in Gateway or AAA virtual servercriticalCVSS 8.8Exploited since Published Citrix NetScaler ADC, Citrix NetScaler Gateway
- CVE-2021-23758: Remote Code Execution in AjaxNetProfessionalcriticalCVSS 3.1Exploited since Published Ajax.net Professional, AjaxNetProfessional (NuGet)
- CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.criticalCVSS 9.8Exploited since Published code.gitea.io/gitea (Go), Gitea, gitea.dev (Go)
- CVE-2026-21962: Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware…criticalCVSS 10Exploited since Published Oracle Weblogic Server Proxy Plug-In, Oracle Weblogic Server Proxy Plug-In
Technologies hit most
- 1.Linux Kernel2 vulnerabilities
- 2.Ajax.net Professional1 vulnerability
- 3.AjaxNetProfessional (NuGet)1 vulnerability
- 4.Citrix NetScaler ADC1 vulnerability
- 5.Citrix NetScaler Gateway1 vulnerability
- 6.code.gitea.io/gitea (Go)1 vulnerability
- 7.Gitea1 vulnerability
- 8.gitea.dev (Go)1 vulnerability
- 9.JFrog Artifactory1 vulnerability
- 10.Microsoft SQL Server1 vulnerability
- 11.Oracle Weblogic Server Proxy Plug-In1 vulnerability
- 12.Owncloud1 vulnerability
- 13.Red Hat Automatic Bug Reporting Tool1 vulnerability
- 14.Red Hat Enterprise Linux1 vulnerability
- 15.Red Hat Libuser1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-08-24.json, and this page as text at https://junglewise.ai/threats/exploited/2026-08-24.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 24 to 30 August 2026 (week 35)", https://junglewise.ai/threats/exploited/2026-08-24, 2 October 2026.