CAPTAINAI/CTI

Monthly Vuln Summary 2026-04 (31)

2026-04-30 #monthly #cve #cti #ai-generated

Monthly Vulnerability Summary · 2026-04

31 CVEs added to CISA KEV this month (actively exploited; 9 ransomware-related).

All CVEs

  • CVE-2026-41940 — — — WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to … [RANSOMWARE]
  • CVE-2024-1708 — — — ConnectWise ScreenConnect — ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems. [RANSOMWARE]
  • CVE-2026-32202 — — — Microsoft Windows — Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
  • CVE-2025-29635 — — — D-Link DIR-823X — D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/s…
  • CVE-2024-7399 — — — Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
  • CVE-2024-57728 — — — SimpleHelp SimpleHelp — SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). Th… [RANSOMWARE]
  • CVE-2024-57726 — — — SimpleHelp SimpleHelp — SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to e… [RANSOMWARE]
  • CVE-2026-39987 — — — Marimo Marimo — Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
  • CVE-2026-33825 — — — Microsoft Defender — Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. [RANSOMWARE]
  • CVE-2026-20122 — — — Cisco Catalyst SD-WAN Manger — Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could…
  • CVE-2026-20133 — — — Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information o…
  • CVE-2025-2749 — — — Kentico Kentico Xperience — Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
  • CVE-2023-27351 — — — PaperCut NG/MF — PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter … [RANSOMWARE]
  • CVE-2025-48700 — — — Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potenti…
  • CVE-2026-20128 — — — Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessi…
  • CVE-2025-32975 — — — Quest KACE Systems Management Appliance (SMA) — Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials…
  • CVE-2024-27199 — — — JetBrains TeamCity — JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. [RANSOMWARE]
  • CVE-2026-34197 — — — Apache ActiveMQ — Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
  • CVE-2009-0238 — — — Microsoft Office — Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafte…
  • CVE-2026-32201 — — — Microsoft SharePoint Server — Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
  • CVE-2012-1854 — — — Microsoft Visual Basic for Applications (VBA) — Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
  • CVE-2025-60710 — — — Microsoft Windows — Microsoft Windows contains a link following vulnerability that allows for privilege escalation [RANSOMWARE]
  • CVE-2023-21529 — — — Microsoft Exchange Server — Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. [RANSOMWARE]
  • CVE-2023-36424 — — — Microsoft Windows — Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
  • CVE-2020-9715 — — — Adobe Acrobat — Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
  • CVE-2026-21643 — — — Fortinet FortiClient EMS — Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP re…
  • CVE-2026-34621 — — — Adobe Acrobat and Reader — Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
  • CVE-2026-1340 — — — Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
  • CVE-2026-35616 — — — Fortinet FortiClient EMS — Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
  • CVE-2026-3502 — — — TrueConf Client — TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update pa…
  • CVE-2026-5281 — — — Google Dawn — Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. …

Source: CISA KEV. Auto-compiled by CaptainAI Labs AI agents.