# Newly exploited vulnerabilities: week of 31 August to 6 September 2026 (week 36)

Source: https://junglewise.ai/threats/exploited/2026-08-31  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:23 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-08-31.json  
License: CC BY 4.0 with a link back

In the week of 31 August to 6 September 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was PaperCut MF (2), followed by PaperCut NG (2) and SonicWall SMA1000 (2).

## Newly exploited this week

- [CVE-2026-85046: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…](https://junglewise.ai/threats/cve-2026-85046-google-chromium-v8-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, exploited since 4 Sep 2026, published 3 Sep 2026)
- [CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…](https://junglewise.ai/threats/cve-2026-83549-sonicwall-sma1000-os-command-injection) (critical, exploited in the wild, CVSS 7.8, exploited since 2 Sep 2026, published 1 Sep 2026)
- [CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…](https://junglewise.ai/threats/cve-2026-83548-sonicwall-sma1000-server-side-request-forgery) (critical, exploited in the wild, CVSS 10, exploited since 2 Sep 2026, published 1 Sep 2026)
- [CVE-2026-82329: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated…](https://junglewise.ai/threats/cve-2026-82329-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, exploited since 2 Sep 2026, published 28 Aug 2026)
- [CVE-2026-9586: Sangoma Switchvox SMB SQL injection in /pa endpoint](https://junglewise.ai/threats/cve-2026-9586-sangoma-switchvox-smb-sql-injection-in-pa-endpoint) (critical, exploited in the wild, CVSS 9.3, exploited since 2 Sep 2026, published 17 Jul 2026)
- [CVE-2026-59822: BerriAI LiteLLM authentication bypass in MCP endpoint](https://junglewise.ai/threats/cve-2026-59822-berriai-litellm-authentication-bypass-in-mcp-endpoint) (critical, exploited in the wild, CVSS 4, exploited since 2 Sep 2026, published 8 Jul 2026)
- [CVE-2026-49869: Kestra OSS authentication bypass in AuthenticationFilter](https://junglewise.ai/threats/cve-2026-49869-kestra-oss-authentication-bypass-in-authenticationfilter) (critical, exploited in the wild, CVSS 10, exploited since 2 Sep 2026, published 26 Jun 2026)
- [CVE-2026-48710: Starlette auth bypass via malformed Host header](https://junglewise.ai/threats/cve-2026-48710-starlette-auth-bypass-via-malformed-host-header) (critical, exploited in the wild, CVSS 6.5, exploited since 2 Sep 2026, published 26 May 2026)
- [CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG…](https://junglewise.ai/threats/cve-2026-82078-papercut-ng-mf-unsafe-reflection-vulnerability) (critical, exploited in the wild, CVSS 9.1, exploited since 31 Aug 2026, published 28 Aug 2026)
- [CVE-2026-81578: An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under…](https://junglewise.ai/threats/cve-2026-81578-papercut-ng-mf-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, exploited since 31 Aug 2026, published 28 Aug 2026)

## Technologies hit most

1. [PaperCut MF](https://junglewise.ai/threats/technologies/mf): 2 vulnerabilities
2. [PaperCut NG](https://junglewise.ai/threats/technologies/ng): 2 vulnerabilities
3. SonicWall SMA1000: 2 vulnerabilities
4. [SonicWall SMA1000 Appliances](https://junglewise.ai/threats/technologies/sma1000-appliances): 2 vulnerabilities
5. [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm): 1 vulnerability
6. [Google Chrome](https://junglewise.ai/threats/technologies/chrome): 1 vulnerability
7. [Google Chromium](https://junglewise.ai/threats/technologies/chromium): 1 vulnerability
8. [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8): 1 vulnerability
9. Google V8: 1 vulnerability
10. [JFrog Artifactory](https://junglewise.ai/threats/technologies/artifactory): 1 vulnerability
11. Kestra OSS: 1 vulnerability
12. [Kludex Starlette](https://junglewise.ai/threats/technologies/starlette): 1 vulnerability
13. Kludex Starlette-Context: 1 vulnerability
14. [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm): 1 vulnerability
15. [Microsoft Edge](https://junglewise.ai/threats/technologies/edge-chromium-based): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 31 August to 6 September 2026 (week 36)", https://junglewise.ai/threats/exploited/2026-08-31, 2 October 2026.