IT security 2026-08-25

Level Critical — 80/100 — 2026-08-25

Critical day: 7 stories ranked, 2 of the top 7 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (88/100).

  1. Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability — 88/100 (CVE-2026-21962)
  2. Gitea Code Injection Vulnerability — 86/100 (CVE-2026-60004)
  3. CVE-2026-16286 — Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Softwa… — 38/100 (CVE-2026-16286)
  4. CVE-2026-65081 — NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause… — 38/100 (CVE-2026-65081)
  5. CVE-2026-65084 — NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause i… — 38/100 (CVE-2026-65084)
  6. CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker co… — 38/100 (CVE-2026-65098)
  7. CVE-2026-79787 — Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allo… — 36/100 (CVE-2026-79787)