April 2026
6,440 CVEs published, −6% on March 2026 and +50% on April 2025. CISA added 31 to KEV.
2026 month by month
- Critical
- 60711% of the 5,693 with a CVSS score
- Added to CISA KEV
- 3110 of this month's CVEs are in KEV, listed a median 5 days after publication
- Vendors
- 1,9714,836 products
- Top weakness
- XSSCWE-79 · 620 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux, Linux Kernel379291new
- 2npmOpenclaw, Flowise, Flowise-components3090nonenew
- 3MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation)185153new
- 4OpenclawOpenclaw1742nonenew
- 5GoogleChrome, Google Chrome, Android14791new
- 6OracleMySQL Server, Jdk, Oracle Java Se1025nonenew
- 7TotolinkA7100RU, A8000RU, A3300R Firmware9463nonenew
- 8code-projectsSimple Laundry System, Vehicle Showroom Management System, Simple It Discussion Forum910nonenew
- 9TendaF456, F456 Firmware, F451876nonenew
- 10Apache Software FoundationApache Airflow, Apache Tomcat, Apache Thrift86111new
- 11ApacheAirflow, Tomcat, Camel84111new
- 12Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 77331new
- 13GoGithub.com/lin-snow/ech0, Github.com/patrickhener/goshs/v2, Github.com/kyverno/kyverno620nonenew
- 14PyPIPraisonai, Praisonaiagents, Openssl-encrypt590nonenew
- 15AdobeFramemaker, Adobe Framemaker, Adobe Indesign5771new
- 16PackagistWwbn/avideo, Froxlor/froxlor, Pocketmine/pocketmine-mp570nonenew
- 17SourcecodesterPizzafy Ecommerce System, Pharmacy Sales and Inventory System, Record Management System540nonenew
- 18DlinkDi-8003 Firmware, Di-8003, Dir-605l Firmware521nonenew
- 19MozillaFirefox, Thunderbird, Firefox Esr528nonenew
- 20IBMVerify Identity Access, Verify Identity Access Container, Security Verify Access Container481nonenew
- 21DellData Domain Operating System, Powerprotect Data Domain, Powerprotect Dp Series Appliance450nonenew
- 22PraisonPraisonai, Praisonaiagents4414nonenew
- 23UutilsCoreutils440nonenew
- 24WiresharkWireshark420nonenew
- 25Wireshark FoundationWireshark420nonenew
Severity
How this month's CVEs score on CVSS; 747 have no score yet. Severity is not exploitation.
- Critical607
- High2,243
- Medium2,568
- Low275
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS620
- CWE-89SQL Injection391
- CWE-22Path Traversal292
- CWE-862Missing Authorization282
- CWE-78OS Command Injection236
- CWE-918SSRF235
- CWE-416Use After Free215
- CWE-74Injection210
- CWE-94Code Injection206
- CWE-77Command Injection189
- CWE-284Improper Access Control188
- CWE-863Incorrect Authorization157
- CWE-120Buffer Overflow143
- CWE-119Memory Buffer Bounds140
- CWE-125Out-of-bounds Read140
- CWE-787Out-of-bounds Write140
- CWE-200Information Exposure130
- CWE-639Auth Bypass via User Key128
- CWE-20Improper Input Validation122
- CWE-306Missing Auth for Critical Function114
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries1,12017% of sector-tagged CVEs
- Web & CMS Plugins1,02516% of sector-tagged CVEs
- Operating Systems76112% of sector-tagged CVEs
- Enterprise Software67610% of sector-tagged CVEs
- Networking Infrastructure5859% of sector-tagged CVEs
- Security Products4236% of sector-tagged CVEs
- AI / ML2494% of sector-tagged CVEs
- 8 smaller sectors1,295
- Not yet classified396
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 22Path Traversal | 862Missing Authorization | 78OS Command Injection | 918SSRF | 416Use After Free | 74Injection | 94Code Injection | 77Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | 65 | |||||||||
| npm | 8 | 3 | 21 | 20 | 10 | 25 | 2 | 6 | 4 | |
| Microsoft | 2 | 2 | 1 | 6 | 55 | 1 | 2 | |||
| Microsoft Corp | 2 | 2 | 1 | 3 | 56 | 2 | ||||
| Openclaw | 6 | 11 | 8 | |||||||
| Сообщество Свободного Программного Обеспечения | 4 | 2 | 8 | 1 | 6 | 3 | 20 | 3 | ||
| 57 | ||||||||||
| Google Inc | 56 | |||||||||
| Ооо «ред Софт» | 4 | 2 | 6 | 2 | 1 | 16 | 2 | |||
| Oracle | ||||||||||
| Oracle Corporation | ||||||||||
| Totolink | 69 | 84 |
In the news
The CVEs security news mentioned most in April 2026.
- CVE-2026-33825Microsoft Defender Elevation of Privilege Vulnerability27.8
- CVE-2019-15126An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper ...13.1
- CVE-2022-1026Kyocera Net View Address Book Exposure18.6
- CVE-2023-1389TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web mana...18.8
- CVE-2023-35317Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability17.8
- CVE-2023-50224TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability16.5
- CVE-2024-50623In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.19.8
- CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet110.0
- CVE-2025-29635A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibi...17.2
- CVE-2025-49704Microsoft SharePoint Remote Code Execution Vulnerability18.8
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, rea...110.0
- CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution Vulnerability19.8
CVEs published in April 2026
46 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityKEV9.8
- CVE-2026-35616A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.KEV9.8
- CVE-2026-39808A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized co...KEV9.8
- CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication BypassKEV9.8
- CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login FlowKEV9.8
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansKEV8.8
- CVE-2026-5281Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium secur...KEV8.8
- CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)KEV8.6
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV7.8
- CVE-2026-33825Microsoft Defender Elevation of Privilege VulnerabilityKEV7.8
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorKEV7.5
- CVE-2026-32201Microsoft SharePoint Server Spoofing VulnerabilityKEV6.5
- CVE-2025-61624An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versio...KEV6.0
- CVE-2026-32202Windows Shell Spoofing VulnerabilityKEV4.3
- CVE-2025-62718Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF9.9
- CVE-2026-0740Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload9.8
- CVE-2026-20160Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability9.8
- CVE-2026-21413A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buff...9.8
- CVE-2026-29014MetInfo CMS Unauthenticated PHP Code Injection RCE9.8
- CVE-2026-31789Heap Buffer Overflow in Hexadecimal Conversion9.8
- CVE-2026-3844Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote9.8
- CVE-2026-39813A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP ...9.8
- CVE-2026-34931hoppscotch: Improper loopback redirect_uri validation in device-login flow9.6
- CVE-2026-28797RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component8.8
- CVE-2026-35029LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint8.8
- CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion8.2
- CVE-2026-32172Microsoft Power Apps Remote Code Execution Vulnerability8.0
- CVE-2026-27919Windows UPnP Device Host Elevation of Privilege Vulnerability7.8
- CVE-2026-31468vfio/pci: Fix double free in dma-buf feature7.8
- CVE-2026-39454SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-administrative user may manipulate and/or pl...7.8
- CVE-2026-33461Incorrect Authorization in Kibana Fleet Leading to Information Disclosure7.7
- CVE-2026-30999A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.7.5
- CVE-2026-31790Incorrect Failure Handling in RSA KEM RSASVE Encapsulation7.5
- CVE-2026-39364Vite has a `server.fs.deny` bypass with queries7.5
- CVE-2026-41279Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials7.5
- CVE-2026-5562provectus kafka-ui Endpoint testexecutions validateAccess code injection7.3
- CVE-2026-34607Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE7.2
- CVE-2026-33691OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks6.8
- CVE-2026-34397himmelblau: NSS fake-primary group lookup reintroduces name collision risk6.3
- CVE-2026-41016Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider5.9
- CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion5.4
- CVE-2026-40763WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability5.3
- CVE-2026-42037Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream5.3
- CVE-2026-26477An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file4.3
- CVE-2026-6591ComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal4.3
- CVE-2026-6830Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch3.3