April 2026 CVE Landscape
- CVEs
- CVE-2026-33032CVE-2026-39987CVE-2009-0238CVE-2012-1854CVE-2020-9715CVE-2023-21529CVE-2023-27351CVE-2023-36424CVE-2024-1708CVE-2024-27199CVE-2024-57726CVE-2024-57728CVE-2024-7399CVE-2025-2749CVE-2025-29635CVE-2025-32975CVE-2025-48700CVE-2025-60710CVE-2026-1340CVE-2026-20122CVE-2026-20128CVE-2026-20133CVE-2026-21643CVE-2026-32201CVE-2026-32202CVE-2026-33825CVE-2026-34197CVE-2026-34621CVE-2026-35616CVE-2026-41940CVE-2026-3502CVE-2026-5281CVE-2024-3721
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-0238 | Remote Code Execution in Microsoft Office Excel via Crafted Spreadsheet | — | 43% | KEV | — KEV |
| CVE-2012-1854 | Insecure Library Loading (CWE-426) in Microsoft Visual Basic for Applications | — | 21% | KEV | — KEV |
| CVE-2020-9715 | Use-After-Free Code Execution Flaw in Adobe Acrobat | 7.8 | 33% | KEVPoC | KEV |
| CVE-2023-21529 | Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529) | 8.8 | 59% | KEVRansomware | KEV |
| CVE-2023-27351 | Authentication Bypass in PaperCut NG/MF Print Management Software | 7.5 | 78% | KEVRansomware | KEV |
| CVE-2023-36424 | Local Privilege Escalation via Out-of-Bounds Read in Windows CLFS Driver | 7.8 | 12% | KEV | KEV |
| CVE-2024-1708 | Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708) | 8.4 | 95% | KEVRansomwarePoC | KEV |
| CVE-2024-27199 | Path Traversal in JetBrains TeamCity Allows Limited Admin Actions | 7.3 | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-3721 | TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the… | 6.3 | 86% | ||
CVE-2024-57726+1 related CVE | Missing-Authorization Privilege Escalation in SimpleHelp Remote Support <= 5.5.7 | 9.9 group max | 66% | KEVRansomware | KEV |
| CVE-2024-7399 | Unauthenticated Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 92% | KEV | KEV |
| CVE-2025-2749 | Path Traversal to Authenticated RCE in Kentico Xperience Through 13.0.178 | 7.2 | 4% | KEVPoC | KEV |
| CVE-2025-29635 | Authenticated Command Injection in D-Link DIR-823X Routers Exploited by Mirai Botnet | 7.2 | 88% | KEVPoC ×2 | KEV |
| CVE-2025-32975 | Authentication Bypass in Quest KACE Systems Management Appliance (SSO) | 10.0 | 2% | KEV | KEV |
| CVE-2025-48700 | Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI | 6.1 | 2% | KEV | KEV |
| CVE-2025-60710 | Link Following Privilege Escalation in Microsoft Windows Host Process for Tasks | 7.8 | 5% | KEVRansomware | KEV |
| CVE-2026-1340 | Unauthenticated Code Injection RCE in Ivanti Endpoint Manager Mobile | 9.8 | 99% | KEV | KEV |
| CVE-2026-20122 | Arbitrary File Overwrite via Privileged APIs in Cisco Catalyst SD-WAN Manager | 5.4 | 26% | KEV | KEV |
CVE-2026-20133+1 related CVE | Actively Exploited Information Disclosure in Cisco Catalyst SD-WAN Manager | 7.5 | 31% | KEV | KEV |
| CVE-2026-21643 | Unauthenticated SQL Injection to Code Execution in Fortinet FortiClient EMS 7.4.4 | 9.8 | 98% | KEVPoC | KEV |
| CVE-2026-32201 | Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server | 6.5 | 43% | KEV | KEV |
| CVE-2026-32202 | Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited | 4.3 | 71% | KEV | KEV |
| CVE-2026-33032 | Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover | 9.8 | 35% | PoC | |
| CVE-2026-33825 | Local Privilege Escalation in Microsoft Defender Antimalware Platform | 7.8 | 7% | KEVRansomwarePoC | KEV |
| CVE-2026-34197 | Authenticated RCE in Apache ActiveMQ via Jolokia JMX-HTTP Bridge | 8.8 | 98% | KEV | KEV |
| CVE-2026-34621 | Actively Exploited Prototype Pollution RCE in Adobe Acrobat and Reader | 8.6 | 7% | KEV | KEV |
| CVE-2026-3502 | Arbitrary Code Execution via Unverified Updates in TrueConf Client | 7.8 | 6% | KEV | KEV |
| CVE-2026-35616 | Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.8 | 94% | KEVPoC | KEV |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
| CVE-2026-5281 | Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution | 8.8 | 14% | KEV | KEV |
From the original article
8 min read at recordedfuture.com
In April 2026, Insikt Group® identified 37 high-impact vulnerabilities that should be prioritized for remediation , 35 of which had a Very Critical Recorded Future Risk Score. This represents a 19% increase from last month. 31 of the 37 were included in the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, and six were surfaced only through honeypot data.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.