IT security 2026-08-04

Level Critical — 85/100 — 2026-08-04

Critical day: 21 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (82/100).

  1. Apache Tomcat Missing Encryption of Sensitive Data Vulnerability — 82/100 (CVE-2026-34486)
  2. IBM Langflow Code Injection Vulnerability — 69/100 (CVE-2026-9198)
  3. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 66/100 (CVE-2026-18577)
  4. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 62/100 (CVE-2026-18556)
  5. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 37/100 (CVE-2026-70470)
  6. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 37/100 (CVE-2026-70477)
  7. flowiseai flowise: Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly… — 36/100 (CVE-2026-69264)
  8. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 35/100 (CVE-2026-70478)
  9. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 34/100 (CVE-2026-69258)
  10. CVE-2026-10050 — In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as b… — 34/100 (CVE-2026-10050)