Week 13, 2026
23 March to 29 March 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,704
- Critical
- 173
- High
- 707
- Added to KEV
- 3
Critical 173High 707Medium 773Low 49Not scored 2All 1,704 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-53521
BigIP APM Vulnerability
F5 · BIG-IP
ExploitedCritical9.3 - CVE-2026-33634
Trivy ecosystem supply chain briefly compromised
aquasecurity · setup-trivy
ExploitedCritical9.4 - CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
langflow-ai · langflow
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2026-33309
Langflow has an Arbitrary File Write (RCE) via v2 API
langflow-ai · langflow
Critical10.0 - CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
WWBN · AVideo
Critical10.0 - CVE-2026-30302
The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The…
Product not named
Critical10.0 - CVE-2026-33396
OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
OneUptime · oneuptime
Critical10.0 - CVE-2026-4689
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
Mozilla · Firefox
Critical10.0 - CVE-2026-3587
Hidden CLI Function Allows Root Access
WAGO · Lean Managed Switch 852-1812
Critical10.0 - CVE-2026-33494
Ory Oathkeeper has a path traversal authorization bypass
ory · oathkeeper
Critical10.0 - CVE-2026-33897
Incus vulnerable to arbitrary file read and write through pongo templates
lxc · incus
Critical10.0 - CVE-2026-33945
Abitrary file write through systemd-creds option
lxc · incus
Critical10.0 - CVE-2026-4606
GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege
GeoVision · GV-Edge Recording Manager
Critical10.0