Week 20, 2026
11 May to 17 May 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,879
- Critical
- 163
- High
- 820
- Added to KEV
- 2
Critical 163High 820Medium 805Low 86Not scored 5All 1,879 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-42897
Microsoft Exchange Server Spoofing Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23
ExploitedHigh8.1 - CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Controller
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Controller
ExploitedCritical10.0 - CVE-2026-43997
vm2: Sandbox Escape
patriksimek · vm2
Critical10.0 - CVE-2026-44005
vm2: Sandbox escape
patriksimek · vm2
Critical10.0 - CVE-2026-44006
vm2: Sandbox Escape
patriksimek · vm2
Critical10.0 - CVE-2026-42288
ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
ChurchCRM · CRM
Critical10.0 - CVE-2026-41553
Remote Code Execution in PDF Export Module
DHTMLX · PDF Export Module
Critical10.0 - CVE-2026-42869
SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools
socfortress · CoPilot
Critical10.0 - CVE-2026-2031
Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.
Google Cloud · Internal Integration Platform APIs
Critical10.0 - CVE-2026-44523
Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery
enchant97 · note-mark
Critical10.0 - CVE-2026-42898
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Microsoft · Microsoft Dynamics 365 (on-premises) version 9.1
Critical9.9