CVE Tools
Track your stack

April 2026

6,440 CVEs published, −6% on March 2026 and +50% on April 2025. CISA added 31 to KEV.

2026 month by month

2026, month by month. Point at another month to read it.
2026: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2026January 2026: 5,244 CVEs17 added to CISA KEVFebruary 2026: 4,931 CVEs28 added to CISA KEVMarch 2026: 6,821 CVEs26 added to CISA KEVApril 2026: 6,440 CVEs31 added to CISA KEVMay 2026: 7,365 CVEs21 added to CISA KEVJune 2026: 8,314 CVEs23 added to CISA KEVJuly 2026: 10,240 CVEs26 added to CISA KEVAugust 2026: 12,909 CVEs31 added to CISA KEVSeptember 2026 so far: 10,681 CVEs29 added to CISA KEV72,945+88%so far
Critical
60711% of the 5,693 with a CVSS score
Added to CISA KEV
3110 of this month's CVEs are in KEV, listed a median 5 days after publication
Vendors
1,9714,836 products
Top weakness
XSSCWE-79 · 620 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1LinuxLinux, Linux Kernel379291new
  2. 2npmOpenclaw, Flowise, Flowise-components3090nonenew
  3. 3MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation)185153new
  4. 4OpenclawOpenclaw1742nonenew
  5. 5GoogleChrome, Google Chrome, Android14791new
  6. 6OracleMySQL Server, Jdk, Oracle Java Se1025nonenew
  7. 7TotolinkA7100RU, A8000RU, A3300R Firmware9463nonenew
  8. 8code-projectsSimple Laundry System, Vehicle Showroom Management System, Simple It Discussion Forum910nonenew
  9. 9TendaF456, F456 Firmware, F451876nonenew
  10. 10Apache Software FoundationApache Airflow, Apache Tomcat, Apache Thrift86111new
  11. 11ApacheAirflow, Tomcat, Camel84111new
  12. 12Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 77331new
  13. 13GoGithub.com/lin-snow/ech0, Github.com/patrickhener/goshs/v2, Github.com/kyverno/kyverno620nonenew
  14. 14PyPIPraisonai, Praisonaiagents, Openssl-encrypt590nonenew
  15. 15AdobeFramemaker, Adobe Framemaker, Adobe Indesign5771new
  16. 16PackagistWwbn/avideo, Froxlor/froxlor, Pocketmine/pocketmine-mp570nonenew
  17. 17SourcecodesterPizzafy Ecommerce System, Pharmacy Sales and Inventory System, Record Management System540nonenew
  18. 18DlinkDi-8003 Firmware, Di-8003, Dir-605l Firmware521nonenew
  19. 19MozillaFirefox, Thunderbird, Firefox Esr528nonenew
  20. 20IBMVerify Identity Access, Verify Identity Access Container, Security Verify Access Container481nonenew
  21. 21DellData Domain Operating System, Powerprotect Data Domain, Powerprotect Dp Series Appliance450nonenew
  22. 22PraisonPraisonai, Praisonaiagents4414nonenew
  23. 23UutilsCoreutils440nonenew
  24. 24WiresharkWireshark420nonenew
  25. 25Wireshark FoundationWireshark420nonenew

Severity

How this month's CVEs score on CVSS; 747 have no score yet. Severity is not exploitation.

  • Critical60711%
  • High2,24339%
  • Medium2,56845%
  • Low2755%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Openclaw174#4
  2. Praison44#22
  3. Uutils44#23
  4. Wireshark42#24
  5. Wireshark Foundation42#25
  6. Churchcrm38#26
  7. Endian34#28
  8. Chamilo31#31
  9. Wwbn31#32
  10. CI4-CMS-ERP22#40

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS620new
  2. CWE-89SQL Injection391new
  3. CWE-22Path Traversal292new
  4. CWE-862Missing Authorization282new
  5. CWE-78OS Command Injection236new
  6. CWE-918SSRF235new
  7. CWE-416Use After Free215new
  8. CWE-74Injection210new
  9. CWE-94Code Injection206new
  10. CWE-77Command Injection189new
  11. CWE-284Improper Access Control188new
  12. CWE-863Incorrect Authorization157new
  13. CWE-120Buffer Overflow143new
  14. CWE-119Memory Buffer Bounds140new
  15. CWE-125Out-of-bounds Read140new
  16. CWE-787Out-of-bounds Write140new
  17. CWE-200Information Exposure130new
  18. CWE-639Auth Bypass via User Key128new
  19. CWE-20Improper Input Validation122new
  20. CWE-306Missing Auth for Critical Function114new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

In the news

The CVEs security news mentioned most in April 2026.

  1. CVE-2026-33825Microsoft Defender Elevation of Privilege Vulnerability27.8
  2. CVE-2019-15126An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper ...13.1
  3. CVE-2022-1026Kyocera Net View Address Book Exposure18.6
  4. CVE-2023-1389TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web mana...18.8
  5. CVE-2023-35317Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability17.8
  6. CVE-2023-50224TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability16.5
  7. CVE-2024-50623In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.19.8
  8. CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet110.0
  9. CVE-2025-29635A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibi...17.2
  10. CVE-2025-49704Microsoft SharePoint Remote Code Execution Vulnerability18.8
  11. CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, rea...110.0
  12. CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution Vulnerability19.8

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store