Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 31 August to 6 September 2026 (week 36)
Final report, published . It does not change.
In the week of 31 August to 6 September 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was PaperCut MF (2), followed by PaperCut NG (2) and SonicWall SMA1000 (2).
- Newly exploited
- 10
- Critical
- 10
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-85046: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…criticalCVSS 8.8Exploited since Published Google Chrome, Google Chromium, Google Chromium V8
- CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…criticalCVSS 7.8Exploited since Published SonicWall SMA1000, SonicWall SMA1000 Appliances
- CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…criticalCVSS 10Exploited since Published SonicWall SMA1000, SonicWall SMA1000 Appliances
- CVE-2026-82329: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated…criticalCVSS 9.8Exploited since Published JFrog Artifactory
- CVE-2026-9586: Sangoma Switchvox SMB SQL injection in /pa endpointcriticalCVSS 9.3Exploited since Published Sangoma Switchvox, Sangoma Switchvox SMB Edition
- CVE-2026-59822: BerriAI LiteLLM authentication bypass in MCP endpointcriticalCVSS 4Exploited since Published Berriai LiteLLM, litellm (PyPI)
- CVE-2026-49869: Kestra OSS authentication bypass in AuthenticationFiltercriticalCVSS 10Exploited since Published Kestra OSS
- CVE-2026-48710: Starlette auth bypass via malformed Host headercriticalCVSS 6.5Exploited since Published starlette (PyPI), Kludex Starlette, Kludex Starlette-Context
- CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG…criticalCVSS 9.1Exploited since Published PaperCut MF, PaperCut NG, PaperCut MF
- CVE-2026-81578: An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under…criticalCVSS 9.8Exploited since Published PaperCut MF, PaperCut NG, PaperCut MF
Technologies hit most
- 1.PaperCut MF2 vulnerabilities
- 2.PaperCut NG2 vulnerabilities
- 3.SonicWall SMA10002 vulnerabilities
- 4.SonicWall SMA1000 Appliances2 vulnerabilities
- 5.Berriai LiteLLM1 vulnerability
- 6.Google Chrome1 vulnerability
- 7.Google Chromium1 vulnerability
- 8.Google Chromium V81 vulnerability
- 9.Google V81 vulnerability
- 10.JFrog Artifactory1 vulnerability
- 11.Kestra OSS1 vulnerability
- 12.Kludex Starlette1 vulnerability
- 13.Kludex Starlette-Context1 vulnerability
- 14.litellm (PyPI)1 vulnerability
- 15.Microsoft Edge1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-08-31.json, and this page as text at https://junglewise.ai/threats/exploited/2026-08-31.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 31 August to 6 September 2026 (week 36)", https://junglewise.ai/threats/exploited/2026-08-31, 2 October 2026.