Weekly digest
Week 15, 2026 (6–12 Apr)
A heavy week: 487 new CVEs, well above the recent average of about 183. Severity skewed high: 40 critical and 222 high, 54% of the total. 38 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. google was the most-affected vendor with 58.
New this week, ranked by depth score
The 12 that matter most of the 487 published.
CVE-2026-34197High· 8.8CISA KEVPoCImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web conso…
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web conso…
CVE-2026-34486High· 7.5CISA KEVPoCMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to …
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to …
CVE-2026-5059Critical· 9.80dayPoCaws-mcp has a Command Injection Remote Code Execution Vulnerability
aws-mcp has a Command Injection Remote Code Execution Vulnerability
CVE-2026-4631Critical· 9.8PoCCockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP r…
CVE-2026-33439Critical· 9.8PoCOpen Access Management (OpenAM) is an access management solution
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP…
CVE-2025-62718Critical· 9.9PoC⚖ disputedAxios is a promise based HTTP client for the browser and Node.js
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a tra…
CVE-2026-3296Critical· 9.8PoCThe Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php…
CVE-2026-34444Critical· 10.0PoCLupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
CVE-2026-33229Critical· 9.8PoCXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the…
CVE-2026-2942Critical· 9.8PoCThe ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for…
CVE-2026-40035Critical· 9.1PoCUnfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-em…
CVE-2025-69515Critical· 9.1PoCAn issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.
An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.
Most-affected vendors
By CVEs published in the period.