Month report
April 2026
Rolled up 2026-09-16 11:40 from 373,491 CVE records
5,814 CVEs published, +44.2% on the same month last year. 564 rated critical, 31 listed by CISA as exploited. linux led with 378; the most common weakness class was CWE-79 (596). spring climbed 62 places, the largest move. 7 vendors ranked for the first time.
Published
5,814
Critical / high
564 / 2,293
Medium / low
2,431 / 313
Added to CISA KEV
31
Public exploit
300
Scanner template
58
Publication to KEV
How long before CISA listed them
Median days to listing
9
Listed within 7 days
38.5%
Listed within 30 days
76.9%
Detection gap
Listed as exploited, no public template
Listed this month
31
With a template
11
No template
20
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 378 | 29 | 1 | 9 | linux (378) · simatic s7 1500 cpu 1518 4 pn dp mfp (74) · simatic s7 1500 cpu 1518f 4 pn dp mfp (74) | ↑2 | |
| 2 | redhat | 273 | 30 | 3 | 38 | 12 | red hat enterprise linux 9 (152) · red hat enterprise linux 8 (149) · red hat enterprise linux 10 (119) | ↓1 |
| 3 | microsoft | 183 | 15 | 4 | 10 | windows server 2025 (121) · windows server 2025 server core installation (121) · windows 11 version 24h2 (118) | ↑3 | |
| 4 | openclaw | 173 | 2 | 1 | openclaw (173) | ↓2 | ||
| 5 | 146 | 9 | 1 | 5 | chrome (144) · android (2) | ↓1 | ||
| 6 | oracle | 102 | 5 | 20 | mysql server (25) · oracle java se (9) · oracle vm virtualbox (9) | · | ||
| 7 | siemens | 98 | 10 | 1 | 3 | simatic s7 1500 cpu 1518 4 pn dp mfp (81) · simatic s7 1500 cpu 1518f 4 pn dp mfp (81) · siplus s7 1500 cpu 1518 4 pn dp mfp (81) | ↑7 | |
| 8 | code projects | 91 | 8 | simple laundry system (14) · vehicle showroom management system (12) · simple it discussion forum (10) | ↑8 | |||
| 9 | apache | 85 | 11 | 2 | 16 | 4 | apache airflow (14) · red hat fuse 7 (14) · red hat jboss enterprise application platform 8 (13) | ↑29 |
| 10 | tenda | 83 | 3 | f456 (27) · f451 (18) · cx12l (5) | — | |||
| 11 | totolink | 72 | 57 | a7100ru (40) · a8000ru (24) · n300rt (2) | ↑44 | |||
| 12 | adobe | 54 | 6 | 1 | 1 | adobe framemaker (11) · adobe connect (8) · indesign desktop (8) | ↓3 | |
| 13 | sourcecodester | 54 | 5 | pizzafy ecommerce system (21) · pharmacy sales and inventory system (20) · record management system (2) | ↑2 | |||
| 14 | mozilla | 52 | 6 | 2 | firefox (51) · thunderbird (50) · red hat enterprise linux 10 (22) | ↑3 | ||
| 15 | ibm | 48 | 1 | security verify access (10) · security verify access container (10) · verify identity access (10) | ↓4 | |||
| 16 | dell | 45 | powerprotect data domain (24) · powerscale onefs (5) · alienware command center awcc (2) | ↑19 | ||||
| 17 | mervinpraison | 44 | 16 | 1 | praisonai (37) · praisonaiagents (10) | new | ||
| 18 | uutils | 44 | coreutils (44) | new | ||||
| 19 | wireshark foundation | 42 | wireshark (42) · red hat enterprise linux 10 (4) · red hat enterprise linux 6 (4) | · | ||||
| 20 | churchcrm | 38 | 5 | 1 | crm (38) | · | ||
| 21 | endian | 34 | endian firewall (34) | new | ||||
| 22 | chamilo | 31 | 3 | 3 | chamilo lms (31) | — | ||
| 23 | cisco | 31 | 6 | 1 | cisco unified computing system standalone (10) · cisco unified computing system e series software ucse (9) · cisco enterprise nfv infrastructure software (8) | ↓11 | ||
| 24 | wwbn | 31 | 2 | avideo (31) | ↓16 | |||
| 25 | fortinet | 28 | 3 | 2 | 3 | 2 | fortisoar on premise (8) · fortisoar paas (8) · fortisandbox (6) | ↑9 |
| 26 | juniper networks | 27 | 1 | junos os (19) · junos os evolved (9) · jsi lwc (2) | · | |||
| 27 | d link | 23 | 1 | dir 605l (6) · dir 513 (3) · di 8100 (2) | ↓4 | |||
| 28 | wolfssl | 23 | 1 | wolfssl (22) · wolfssh (1) | ↑31 | |||
| 29 | ci4 cms erp | 22 | 11 | ci4ms (22) | new | |||
| 30 | freescout help desk | 22 | 2 | 1 | freescout (22) | · | ||
| 31 | gitlab | 22 | 1 | gitlab (22) | ↓1 | |||
| 32 | powerdns | 22 | dnsdist (11) · recursor (9) · authoritative (6) | · | ||||
| 33 | huawei | 20 | 1 | harmonyos (20) · emui (5) | ↑10 | |||
| 34 | itsourcecode | 20 | construction management system (12) · courier management system (2) · online enrollment system (2) | ↓15 | ||||
| 35 | spring | 20 | 1 | 2 | spring boot (8) · spring security (6) · red hat fuse 7 (4) | ↑62 | ||
| 36 | flowiseai | 19 | 5 | 1 | flowise (19) · flowise components (6) | · | ||
| 37 | phpgurukul | 19 | online shopping portal project (9) · news portal project (4) · online course registration (2) | · | ||||
| 38 | aws | 18 | 1 | freertos plus tcp (5) · research and engineering studio res (3) · tough (3) | · | |||
| 39 | electron | 18 | electron (18) · red hat build of podman desktop (4) · red hat build of podman desktop tech preview (4) | · | ||||
| 40 | belden | 17 | 6 | hirschmann industrial hivision (4) · hirschmann eaglesdv (2) · hirschmann hios (2) | new | |||
| 41 | qualcomm | 17 | snapdragon (17) | ↑10 | ||||
| 42 | samsung open source | 17 | one (9) · escargot (8) | new | ||||
| 43 | sap se | 17 | 1 | sap businessobjects business intelligence platform (2) · material master application (1) · sap business analytics and sap content management (1) | ↑15 | |||
| 44 | apple | 16 | macos (15) · ios and ipados (3) · ipados (2) | ↓37 | ||||
| 45 | foxit software | 16 | foxit pdf editor (14) · foxit pdf reader (13) · foxit pdf services api (1) | · | ||||
| 46 | axios | 15 | 1 | axios (15) · cryostat 4 (7) · gatekeeper 3 (7) | · | |||
| 47 | 1panel dev | 14 | maxkb (14) | · | ||||
| 48 | nimiq | 14 | 1 | core rs albatross (6) · network libp2p (2) · nimiq transaction (2) | new | |||
| 49 | nvidia | 14 | 1 | triton inference server (5) · flare sdk (3) · kai scheduler (2) | ↓10 | |||
| 50 | rack | 14 | 1 | 2 | rack (13) · logging subsystem for red hat openshift (2) · red hat 3scale api management platform 2 (2) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-04 that are on the CISA KEV catalog today. The 31 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-7959623 critical—
- 2CWE-8937741 critical—
- 3CWE-86225619 critical—
- 4CWE-2224528 critical—
- 5CWE-7822186 critical↑8
- 6CWE-742070 critical↓1
- 7CWE-9419732 critical↑1
- 8CWE-91818913 critical↑3
- 9CWE-7718270 critical↑14
- 10CWE-28417714 critical↑4
- 1CWE-4161586 critical↑11
- 2CWE-12014510 critical↑14
- 3CWE-1191404 critical↓1
- 4CWE-6391154 critical↑2
- 5CWE-78711011 critical↓8
- 6CWE-2001095 critical↑2
- 7CWE-201089 critical↑2
- 8CWE-1211075 critical↓9
- 9CWE-1251053 critical↓4
- 10CWE-8631034 critical↓10
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.