Week 18, 2026
27 April to 3 May 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,092
- Critical
- 86
- High
- 388
- Added to KEV
- 4
Critical 86High 388Medium 591Low 27Not scored 0All 1,092 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
Linux · Linux
ExploitedHigh7.8 - CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
WebPros · cPanel
ExploitedCritical9.3 - CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise · ScreenConnect
ExploitedHigh8.4 - CVE-2026-32202
Windows Shell Spoofing Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium4.3
Most severe new CVEsBy CVSS score
- CVE-2026-33453
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
Apache Software Foundation · Apache Camel
Critical10.0 - CVE-2026-26015
Unauthenticated RCE in DocsGPT MCP STDIO Configuration
arc53 · DocsGPT
Critical10.0 - CVE-2026-37541
Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not…
Product not named
Critical10.0 - CVE-2026-42996
JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead…
JS8Call · JS8Call
Critical10.0 - CVE-2026-36767
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a…
Product not named
Critical10.0 - CVE-2026-3325
SQL injection in MegaCMS by CRM Sistemas de Fidelización
CRM Sistemas de Fidelización · MegaCMS
Critical10.0 - CVE-2026-40453
Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
Apache Software Foundation · Apache Camel JMS
Critical9.9 - CVE-2026-7567
Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
elemntor · Temporary Login
Critical9.8 - CVE-2026-4670
Improper Authentication vulnerability in Progress MOVEit Automation
Progress Software · MOVEit Automation
Critical9.8 - CVE-2026-40860
Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
Apache Software Foundation · Apache Camel
Critical9.8