IT security 2026-08-05

Level Critical — 90/100 — 2026-08-05

Critical day: 20 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (84/100).

  1. Apache Tomcat Missing Encryption of Sensitive Data Vulnerability — 84/100 (CVE-2026-34486)
  2. IBM Langflow Code Injection Vulnerability — 79/100 (CVE-2026-9198)
  3. JetBrains TeamCity Deserialization of Untrusted Data Vulnerability — 77/100 (CVE-2026-63077)
  4. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 63/100 (CVE-2026-18556)
  5. CVE-2026-10025 — IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity… — 38/100 (CVE-2026-10025)
  6. redhat build of keycloak: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and us… — 38/100 (CVE-2026-16442)
  7. CVE-2026-17617 — IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due t… — 38/100 (CVE-2026-17617)
  8. CVE-2026-8400 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous deliv… — 38/100 (CVE-2026-8400)
  9. CVE-2026-9205 — IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() functi… — 38/100 (CVE-2026-9205)
  10. redhat build of keycloak: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the c… — 35/100 (CVE-2026-16443)