Week 17, 2026

20–26 April 2026

New CVEs: 1,459
Critical: 145
High: 493
Newly exploited: 14
Advisories: 620
Malicious pkgs: 151

Newly exploited 14

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.9
CVE-2024-57726 KEV Apr 24, 2026 · ransomware SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. …
EPSS 66%
High 8.8
CVE-2024-7399 KEV Apr 24, 2026 Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitr…
Samsung Electronics · MagicINFO 9 Server

EPSS 92%
High 7.2
CVE-2024-57728 KEV Apr 24, 2026 · ransomware SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (…
EPSS 64%
High 7.2
CVE-2025-29635 KEV Apr 24, 2026 A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending…
EPSS 88%
Critical 9.3
CVE-2026-39987 KEV Apr 23, 2026 marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
marimo-team · marimo

EPSS 100%
High 7.8
CVE-2026-33825 KEV Apr 22, 2026 · ransomware Microsoft Defender Elevation of Privilege Vulnerability
Microsoft · Microsoft Defender Antimalware Platform

EPSS 6.7%
Critical 10.0
CVE-2025-32975 KEV Apr 20, 2026 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1…
EPSS 2.5%
High 8.2
CVE-2023-27351 KEV Apr 20, 2026 · ransomware This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir…
PaperCut · NG

EPSS 78%
High 7.5
CVE-2026-20128 KEV Apr 20, 2026 Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager

EPSS 8.3%
High 7.3
CVE-2024-27199 KEV Apr 20, 2026 · ransomware In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
JetBrains · TeamCity

EPSS 100%
High 7.2
CVE-2025-2749 KEV Apr 20, 2026 Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Kentico · Xperience

EPSS 4%
Medium 6.5
CVE-2026-20133 KEV Apr 20, 2026 A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vul…
Cisco · Cisco Catalyst SD-WAN Manager

EPSS 35%
Medium 6.1
CVE-2025-48700 KEV Apr 20, 2026 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI all…
EPSS 1.7%
Medium 5.4
CVE-2026-20122 KEV Apr 20, 2026 Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager

EPSS 26%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.2
CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
rclone · rclone

EPSS 33%
Critical 10.0
CVE-2026-41679 Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
paperclipai · @paperclipai/server · paperclip

EPSS 32%
Critical 9.8
CVE-2026-3844 Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Cloudways · Breeze Cache

EPSS 28%
Critical 9.3
CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC
Hugging Face · LeRobot

EPSS 16%
Critical 10.0
CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters
FlowiseAI · Flowise · flowise-components

EPSS 12%
Critical 9.1
CVE-2026-40372 ASP.NET Core Elevation of Privilege Vulnerability
Microsoft · ASP.NET Core 10.0 · Microsoft Visual Studio 2026 version 18.5

EPSS 11%
Critical 9.2
CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
rclone · rclone

EPSS 8.6%
Critical 9.8
CVE-2026-34415 Xerte Online Toolkits File Upload RCE via elfinder Connector
thexerteproject · xerteonlinetoolkits

EPSS 3.6%
Critical 9.8
CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
dgraph-io · dgraph

EPSS 3.1%
Critical 9.8
CVE-2026-38835 Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter…
EPSS 2.2%
Critical 9.4
CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM
ASUSTOR · ADM

EPSS 1.9%
Critical 9.8
CVE-2026-6942 radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
radareorg · radare2-mcp

EPSS 1.9%
Critical 9.2
CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
FlowiseAI · Flowise

EPSS 1.8%
Critical 9.8
CVE-2026-7037 Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection
Totolink · A8000RU

EPSS 1.8%
Critical 9.1
CVE-2026-40887 @vendure/core has a SQL Injection vulnerability
vendurehq · vendure

EPSS 1.8%

All 145 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.8
CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-place
Linux · Linux

EPSS 98%
High 7.5
CVE-2026-33626 LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
InternLM · lmdeploy

EPSS 45%
High 7.7
CVE-2026-41268 Flowise: Flowise Parameter Override Bypass Remote Command Execution
FlowiseAI · Flowise

EPSS 17%
High 8.4
CVE-2026-3518 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress Software · LoadMaster · MOVEit WAF · Object Scale Connection Manager

EPSS 17%
High 8.4
CVE-2026-3517 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress Software · LoadMaster · Object Scale Connection Manager · MOVEit WAF

EPSS 15%
Medium 6.9
CVE-2026-40343 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation
free5gc · udr

EPSS 8.6%
High 7.2
CVE-2026-40871 mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API
mailcow · mailcow-dockerized

EPSS 8.6%
High 7.2
CVE-2026-6992 Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection
Linksys · MR9600

EPSS 8.1%

Advisories

USN-8203-1 linux-oracle, linux-oracle-6.8 vulnerabilities 177 CVEs
USN-8204-1 linux-raspi-realtime vulnerabilities 175 CVEs
USN-8179-3 linux-hwe-6.8, linux-ibm-6.8, linux-raspi vulnerabilities 174 CVEs
USN-8183-2 linux-aws, linux-aws-6.17, linux-hwe-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities 138 CVEs
USN-8180-5 linux-ibm, linux-ibm-5.15 vulnerabilities 80 CVEs
USN-8180-4 linux-azure-fips vulnerabilities 80 CVEs
USN-8180-3 linux-azure, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-oracle-5.15 vulnerabilities 80 CVEs
openSUSE-SU-2026:20572-1 Security update for the Linux Kernel 49 CVEs
SUSE-SU-2026:21237-1 Security update for the Linux Kernel 49 CVEs
SUSE-SU-2026:21230-1 Security update for the Linux Kernel 49 CVEs