Vulnerabilidades exploradas (CISA KEV)

CVE-2026-41940 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 29/04/2026

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2026-31431 Alta · 7.8 KEV Urgente · 72 Exploit público CWE-669 22/04/2026

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVE-2026-33825 Alta · 7.8 KEV Alta · 62 Exploit público Ransomware CWE-1220 14/04/2026

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVE-2026-33824 Crítica · 9.8 KEV Alta · 65 Exploit público CWE-415 14/04/2026

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVE-2026-32201 Média · 6.5 KEV Alta · 62 Exploit público CWE-20 14/04/2026

Microsoft SharePoint Server Improper Input Validation Vulnerability

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-32202 Média · 4.3 KEV Alta · 66 Exploit público CWE-693 14/04/2026

Microsoft Windows Protection Mechanism Failure Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-39808 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-78 14/04/2026

Fortinet FortiSandbox OS Command Injection Vulnerability

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVE-2026-34621 Alta · 8.6 KEV Alta · 59 Exploit público CWE-1321 11/04/2026

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-34486 Alta · 7.5 KEV Alta · 68 Exploit público CWE-311 09/04/2026

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVE-2026-39987 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-306 09/04/2026

Marimo Remote Code Execution Vulnerability

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

CVE-2026-34197 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-20 07/04/2026

Apache ActiveMQ Improper Input Validation Vulnerability

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

CVE-2026-35616 Crítica · 9.8 KEV Urgente · 72 Exploit público CWE-284 03/04/2026

Fortinet FortiClient EMS Improper Access Control Vulnerability

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

CVE-2026-5281 Alta · 8.8 KEV Alta · 55 Exploit público CWE-416 01/04/2026

Google Dawn Use-After-Free Vulnerability

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)