CISA Known Exploited Vulnerabilities
KEV additions — April 2026
23 CVEs entered the KEV catalog in April 2026.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added April 30, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | 9.8 | 98.5 % | May 3, 2026 |
Added April 28, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-1708 | ConnectWise ScreenConnect Path Traversal Vulnerability | 8.4 | 95.4 % | May 12, 2026 |
| CVE-2026-32202 | Windows Shell Spoofing Vulnerability | 4.3 | 4.9 % | May 12, 2026 |
Added April 24, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-57726 | SimpleHelp Missing Authorization Vulnerability | 9.9 | 66.6 % | May 8, 2026 |
| CVE-2024-57728 | SimpleHelp Path Traversal Vulnerability | 7.2 | 64.7 % | May 8, 2026 |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Path Traversal Vulnerability | 7.5 | 91.9 % | May 8, 2026 |
| CVE-2025-29635 | D-Link DIR-823X Command Injection Vulnerability | 8.8 | 87.9 % | May 8, 2026 |
Added April 23, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-39987 | Marimo Remote Code Execution Vulnerability | — | 37.9 % | May 7, 2026 |
Added April 22, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-33825 | Microsoft Defender Elevation of Privilege Vulnerability | 7.8 | 0.4 % | May 6, 2026 |
Added April 20, 20268
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-27351 | PaperCut NG/MF Improper Authentication Vulnerability | 7.5 | 78.1 % | May 4, 2026 |
| CVE-2024-27199 | JetBrains TeamCity Relative Path Traversal Vulnerability | 7.3 | 100.0 % | May 4, 2026 |
| CVE-2025-2749 | Kentico Xperience Path Traversal Vulnerability | 7.2 | 4.0 % | May 4, 2026 |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability | 10 | 2.5 % | May 4, 2026 |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 6.1 | 1.7 % | Apr 23, 2026 |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability | 5.4 | 25.5 % | Apr 23, 2026 |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 7.5 | 7.2 % | Apr 23, 2026 |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 6.5 | 32.4 % | Apr 23, 2026 |
Added April 14, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-32201 | Microsoft SharePoint Server Spoofing Vulnerability | 6.5 | 43.4 % | Apr 28, 2026 |
Added April 13, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-9715 | Adobe Acrobat Use-After-Free Vulnerability | 7.8 | 33.5 % | Apr 27, 2026 |
| CVE-2025-60710 | Microsoft Windows Link Following Vulnerability | 7.8 | 4.6 % | Apr 27, 2026 |
| CVE-2026-21643 | SQL Injection Vulnerability in FortiClientEMS 7.4.4 Allows Unauthenticated Remote Code Execution | 9.8 | 93.9 % | Apr 16, 2026 |
Added April 8, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-1340 | Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile | 9.8 | 98.6 % | Apr 11, 2026 |
Added April 1, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-5281 | chromium-browser: Use after free in Dawn | — | 0.7 % | Apr 15, 2026 |