Exploited vulnerabilities (CISA KEV)

CVE-2026-41940 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-306 Apr 29, 2026

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2026-31431 High · 7.8 KEV Urgent · 72 Public exploit CWE-669 Apr 22, 2026

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVE-2026-33825 High · 7.8 KEV High · 62 Public exploit Ransomware CWE-1220 Apr 14, 2026

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVE-2026-33824 Critical · 9.8 KEV High · 65 Public exploit CWE-415 Apr 14, 2026

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVE-2026-32201 Medium · 6.5 KEV High · 62 Public exploit CWE-20 Apr 14, 2026

Microsoft SharePoint Server Improper Input Validation Vulnerability

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-32202 Medium · 4.3 KEV High · 66 Public exploit CWE-693 Apr 14, 2026

Microsoft Windows Protection Mechanism Failure Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-39808 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 Apr 14, 2026

Fortinet FortiSandbox OS Command Injection Vulnerability

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVE-2025-61624 Medium · 6.5 KEV High · 48 CWE-22 Apr 14, 2026

Fortinet Multiple Products Path Traversal Vulnerability

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

CVE-2026-34621 High · 8.6 KEV High · 59 Public exploit CWE-1321 Apr 11, 2026

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-34486 High · 7.5 KEV High · 68 Public exploit CWE-311 Apr 9, 2026

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVE-2026-39987 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-306 Apr 9, 2026

Marimo Remote Code Execution Vulnerability

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

CVE-2026-34197 High · 8.8 KEV Urgent · 76 Public exploit CWE-20 Apr 7, 2026

Apache ActiveMQ Improper Input Validation Vulnerability

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

CVE-2026-35616 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-284 Apr 3, 2026

Fortinet FortiClient EMS Improper Access Control Vulnerability

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

CVE-2026-5281 High · 8.8 KEV High · 55 Public exploit CWE-416 Apr 1, 2026

Google Dawn Use-After-Free Vulnerability

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)