Week 17, 2026

20 April to 26 April 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 1,446
Critical: 146
High: 478
Added to KEV: 14

Critical 146High 478Medium 751Low 70Not scored 1All 1,446 in the list

Added to KEVAttackers use these now; patch them first

CVE-2024-57726
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions.…
Product not named
ExploitedCritical9.9
CVE-2024-7399
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write…
Samsung Electronics · MagicINFO 9 Server
ExploitedHigh8.8
CVE-2025-29635
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending…
Product not named
ExploitedHigh7.2
CVE-2024-57728
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file…
Product not named
ExploitedHigh7.2
CVE-2026-39987
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
marimo-team · marimo
ExploitedCritical9.3
CVE-2026-33825
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft · Microsoft Defender Antimalware Platform
ExploitedHigh7.8
CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and…
Product not named
ExploitedCritical10.0
CVE-2023-27351
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not…
PaperCut · NG
ExploitedHigh8.2
CVE-2026-20128
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedHigh7.5
CVE-2024-27199
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
JetBrains · TeamCity
ExploitedHigh7.3
CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Kentico · Xperience
ExploitedHigh7.2
CVE-2026-20133
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This…
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedMedium6.5
CVE-2025-48700
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI…
Product not named
ExploitedMedium6.1
CVE-2026-20122
Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedMedium5.4

Most severe new CVEsBy CVSS score

CVE-2026-41679
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
paperclipai · paperclip
Critical10.0
CVE-2026-40933
Flowise: Authenticated RCE Via MCP Adapters
FlowiseAI · Flowise
Critical10.0
CVE-2026-33819
Microsoft Bing Remote Code Execution Vulnerability
Microsoft · Microsoft Bing
Critical10.0
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
WWBN · AVideo
Critical10.0
CVE-2017-20230
Storable versions before 3.05 for Perl has a stack overflow
NWCLARK · Storable
Critical10.0
CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
spinnaker · spinnaker
Critical10.0
CVE-2025-15638
Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt
ATRODO · Net::Dropbear
Critical10.0
CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
spinnaker · spinnaker
Critical10.0
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
froxlor · froxlor
Critical10.0
CVE-2026-35431
Microsoft Entra ID Entitlement Management Spoofing Vulnerability
Microsoft · Microsoft Entra
Critical10.0

Week 17, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses