Week 16, 2026
13 April to 19 April 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,171
- Critical
- 112
- High
- 474
- Added to KEV
- 10
Critical 112High 474Medium 517Low 68Not scored 0All 1,171 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Apache Software Foundation · Apache ActiveMQ Broker
ExploitedHigh8.8 - CVE-2009-0238
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and…
Product not named
ExploitedHigh8.8 - CVE-2026-32201
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedMedium6.5 - CVE-2026-21643
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…
Fortinet · FortiClientEMS
ExploitedCritical9.1 - CVE-2023-21529
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23
ExploitedHigh8.8 - CVE-2026-34621
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
Adobe · Acrobat DC
ExploitedHigh8.6 - CVE-2025-60710
Host Process for Windows Tasks Elevation of Privilege Vulnerability
Microsoft · Windows 11 Version 24H2
ExploitedHigh7.8 - CVE-2023-36424
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 22H3
ExploitedHigh7.8 - CVE-2020-9715
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free…
Adobe · Adobe Acrobat and Reader
ExploitedHigh7.8 - CVE-2012-1854
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications…
Product not named
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2026-31843
goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution
goodoneuz · pay-uz
Critical10.0 - CVE-2026-39842
OpenRemote is Vulnerable to Expression Injection
openremote · openremote
Critical10.0 - CVE-2026-35031
Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
jellyfin · jellyfin
Critical10.0 - CVE-2026-40342
Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution
FirebirdSQL · firebird
Critical10.0 - CVE-2026-34865
Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Huawei · HarmonyOS
Critical10.0 - CVE-2026-20147
Cisco Identity Services Engine Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
Critical9.9 - CVE-2026-20180
Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
Critical9.9 - CVE-2026-20186
Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
Critical9.9 - CVE-2026-38526
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary…
Product not named
Critical9.9 - CVE-2026-27681
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
SAP_SE · SAP Business Planning and Consolidation and SAP Business Warehouse
Critical9.9