Skip to content

Patch first Vendors Added Changes Method

Home
Added
April 2026

CISA's list that month

April 2026

In April 2026 CISA added 31 vulnerabilities to its list of exploited vulnerabilities, on 13 days.

1 April 2026

1 added

CVE-2026-5281

2 April 2026

1 added

CVE-2026-3502

6 April 2026

1 added

CVE-2026-35616

8 April 2026

1 added

CVE-2026-1340

13 April 2026

7 added

CVE-2012-1854
CVE-2020-9715
CVE-2023-21529
CVE-2023-36424
CVE-2025-60710
CVE-2026-21643
CVE-2026-34621

14 April 2026

2 added

CVE-2009-0238
CVE-2026-32201

16 April 2026

1 added

CVE-2026-34197

20 April 2026

8 added

CVE-2023-27351
CVE-2024-27199
CVE-2025-2749
CVE-2025-32975
CVE-2025-48700
CVE-2026-20122
CVE-2026-20128
CVE-2026-20133

21 April 2026

7 changes

22 April 2026

1 added

CVE-2026-33825

23 April 2026

1 added

CVE-2026-39987

24 April 2026

4 added

CVE-2024-7399
CVE-2024-57726
CVE-2024-57728
CVE-2025-29635

28 April 2026

2 added

CVE-2024-1708
CVE-2026-32202

30 April 2026

1 added

CVE-2026-41940

← March 2026Every monthMay 2026 →

Sources and licence

CISA Known Exploited Vulnerabilities catalog. Not affiliated with or endorsed by CISA (source). Licence: CC0 1.0 Universal

Our text and compilation: CC BY 4.0. How to reuse and cite this page.

On this site

Patch first
Used in ransomware
Exploited, low EPSS
Likely next
Vendors
Added by day
Changes
Statistics
Federal deadlines
Methodology
Sources
About
Corrections
Privacy
Licence and reuse

Every vulnerability CISA lists as exploited, ranked by what to patch first with an open method, with EPSS scores, public exploits, US federal deadlines and the changes CISA's list does not keep.

whattopatch is independent and not affiliated with or endorsed by CISA, FIRST or MITRE. Our patch-first rank is our own reading of public data, not advice for your systems.

Corrections and questions: hello@whattopatch.com