Week 15, 2026
6 April to 12 April 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,596
- Critical
- 167
- High
- 582
- Added to KEV
- 2
Critical 167High 582Medium 798Low 48Not scored 1All 1,596 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-1340
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Ivanti · Endpoint Manager Mobile
ExploitedCritical9.8 - CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…
Fortinet · FortiClientEMS
ExploitedCritical9.1
Most severe new CVEsBy CVSS score
- CVE-2026-34976
Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
dgraph-io · dgraph
Critical10.0 - CVE-2026-4149
Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability
Sonos · Era 300
Critical10.0 - CVE-2026-39337
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
ChurchCRM · CRM
Critical10.0 - CVE-2026-34208
SandboxJS: Sandbox integrity escape
nyariv · SandboxJS
Critical10.0 - CVE-2025-54328
An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400,…
Product not named
Critical10.0 - CVE-2026-39888
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
MervinPraison · praisonaiagents
Critical10.0 - CVE-2026-39355
Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)
MGeurts · genealogy
Critical10.0 - CVE-2026-5412
Juju CloudSpec API could leak senstive information
Canonical · Juju
Critical9.9 - CVE-2026-40089
Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client
sonicverse-eu · audiostreaming-stack
Critical9.9 - CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
SaturdayDrive · Ninja Forms - File Uploads
Critical9.8