April 2026
Published in April 2026
- highexploited2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")cert-eu
- criticalexploitedCVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function …cisa-kev
- known exploitedCVE-2009-0238
- unknownJenkins Security Advisory 2026-04-29jenkins
- unknownGitLab Patch Release: 18.11.2, 18.10.5gitlab
- known exploitedCVE-2012-1854
- unknownGitLab Patch Release: 18.11.2, 18.10.5gitlab
- criticalCisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilitiescisco-psirt
- known exploitedpublic exploitCVE-2020-9715
- highCisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerabilitycisco-psirt
- criticalexploitedCVE-2025-29635: D-Link DIR-823X Command Injection Vulnerabilitycisa-kev
- known exploitedCVE-2023-21529
- criticalexploitedCVE-2024-57726: SimpleHelp Missing Authorization Vulnerabilitycisa-kev
- criticalexploitedCVE-2024-57728: SimpleHelp Path Traversal Vulnerabilitycisa-kev
- known exploitedpublic exploitCVE-2023-27351
- mediumCisco Integrated Management Controller Cross-Site Scripting Vulnerabilitiescisco-psirt
- highCisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilitiescisco-psirt
- known exploitedpublic exploitCVE-2023-36424
- criticalexploitedCisco Catalyst SD-WAN Vulnerabilitiescisco-psirt
- criticalGitLab Patch Release: 18.11.1, 18.10.4, 18.9.6gitlab
- known exploitedpublic exploitCVE-2024-1708
- criticalGitLab Patch Release: 18.11.1, 18.10.4, 18.9.6gitlab
- criticalexploitedCVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerabilitycisa-kev
- known exploitedpublic exploitCVE-2024-27199
- criticalexploitedCVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerabilitycisa-kev
- known exploitedCVE-2024-57726
- criticalCisco Webex Services Certificate Validation Vulnerabilitycisco-psirt
- mediumCisco Secure Web Appliance Authentication Bypass Vulnerabilitycisco-psirt
- known exploitedCVE-2024-57728
- criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003drupal
- criticalDrupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002drupal
- known exploitedpublic exploitCVE-2024-7399
- criticalDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001drupal
- mediumCisco Unity Connection Arbitrary File Download Vulnerabilitiescisco-psirt
- known exploitedCVE-2025-2749
- mediumCisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerabilitycisco-psirt
- mediumCisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilitiescisco-psirt
- known exploitedpublic exploitCVE-2025-29635
- mediumCisco Identity Services Engine Authenticated Privilege Escalation Vulnerabilitycisco-psirt
- mediumCisco Webex Contact Center Cross-Site Scripting Vulnerabilitycisco-psirt
- known exploitedCVE-2025-32975
- mediumCisco Unity Connection Cross-Site Scripting, Open Redirect, and SQL Injection Vulnerabilitiescisco-psirt
- criticalCisco Identity Services Engine Remote Code Execution Vulnerabilitiescisco-psirt
- known exploitedCVE-2025-48700
- unknownOut-Of-Bounds Write in administrative interfacefortinet
- unknownexploitedSecurity Alert: Microsoft Releases April 2026 Security Updatesjpcert
- known exploitedpublic exploitCVE-2025-60710
- unknownSecurity Alert: Alert Regarding Vulnerabilities in Adobe Acrobat and Reader (APSB26-44)jpcert
- unknownunauthorized backup file accessfortinet
- known exploitedpublic exploitCVE-2026-1340
- unknownUnauthenticated Authentication bypass and Privilege escalation in FortiSandboxfortinet
- unknownStored Cross Site Scripting (XSS) in Reports View pagefortinet
- known exploitedCVE-2026-20122
- unknownSSRF via Report template and schedulingfortinet
- unknownSQL Injection via JSON RPC APIfortinet
- known exploitedCVE-2026-20128
- unknownSQL Injection via APIfortinet
- unknownReflected XSS in Operation Centerfortinet
- known exploitedCVE-2026-20133
- unknownPath Traversal on File Content Extraction connectorfortinet
- unknownPath Traversal in CLIfortinet
- known exploitedpublic exploitCVE-2026-21643
- unknownPath Traversal in CLIfortinet
- unknownOpen Redirection via Import CSV optionfortinet
- known exploitedpublic exploitCVE-2026-31431
- unknownexploitedOS Command Injection through API endpointfortinet
- unknownMultiple Stored XSSfortinet
- known exploitedCVE-2026-32201
- unknownMultiple SQL Injectionsfortinet
- unknownMultiple Path traversals in CLIfortinet
- known exploitedpublic exploitCVE-2026-32202
- criticalMissing Authentication for critical function in CAPWAP daemonfortinet
- unknownInteger Overflow Denial of Service in administrative interfacefortinet
- known exploitedpublic exploitCVE-2026-33825
- unknownHeap-based buffer overflow in oftpd daemonfortinet
- unknownHardcoded symmetric encryption key for Postgresqlfortinet
- known exploitedpublic exploitCVE-2026-34197
- unknownCredential disclosure in LDAP configuration web page.fortinet
- unknownCleartext Credentials in response for API endpointsfortinet
- known exploitedCVE-2026-34621
- unknownClear-text credentials retrievable with IP modification for connectorsfortinet
- unknownClear-text credentials retrievable with IP modification for LDAPfortinet
- known exploitedCVE-2026-3502
- unknownAxios npm Package Compromisedfortinet
- unknownArbitrary directory delete on vmimages delete featurefortinet
- known exploitedpublic exploitCVE-2026-35616
- unknown2FA request can be replayed without a valid token after one successful requestfortinet
- criticalexploitedCVE-2009-0238: Microsoft Office Remote Code Executioncisa-kev
- known exploitedpublic exploitCVE-2026-39808
- criticalGitLab Patch Release: 18.10.3, 18.9.5, 18.8.9gitlab
- criticalGitLab Patch Release: 18.10.3, 18.9.5, 18.8.9gitlab
- known exploitedpublic exploitCVE-2026-39987
- unknownAPI authentication and authorization bypassfortinet
- mediumCisco IOS XE Software Denial of Service Vulnerabilitycisco-psirt
- known exploitedpublic exploitCVE-2026-41940
- criticalexploitedCVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerabilitycisa-kev
- highCisco Evolved Programmable Network Manager Improper Authorization Vulnerabilitycisco-psirt
- known exploitedpublic exploitCVE-2026-5281
- highCisco Smart Software Manager On-Prem Privilege Escalation Vulnerabilitycisco-psirt
- criticalCisco Integrated Management Controller Authentication Bypass Vulnerabilitycisco-psirt
- mediumCisco Nexus Dashboard Insights Arbitrary File Write Vulnerabilitycisco-psirt
- criticalCisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerabilitycisco-psirt
- criticalexploitedCVE-2026-5281: Google Dawn Use-After-Free Vulnerabilitycisa-kev