Week 16/2026: 1,427 CVEs (+21%), 492 CRITICAL/HIGH, 146 POCs, 237 Unpatched
Executive Summary
Overview
Vuln.today data for 2026-04-20 to 2026-04-27 reports 1,427 CVEs published, representing a 21% increase from the previous week (1,180 CVEs). Severity distribution: 123 CRITICAL, 369 HIGH, 597 MEDIUM, 71 LOW, and 267 UNKNOWN. Public exploit code is available for 146 CVEs. Patches are available for 795 CVEs, leaving 237 CRITICAL or HIGH severity vulnerabilities unpatched. Zero CISA KEV entries are present in the dataset for this period.
Critical Threats
- CVE-2026-6942 (CRITICAL, CVSS 9.3): radare2-mcp version 1.6.0 and earlier OS command injection vulnerability enables remote attackers to execute arbitrary commands via shell metacharacters in jsonrpc interface parameters. Public exploit code available. Patch available per vendor advisory.
- CVE-2026-23751 (CRITICAL, CVSS 9.3): Kofax Capture (Tungsten Capture) version 6.0.0.0 exposes unauthenticated .NET Remoting HTTP channel on port 2424, enabling remote attackers to exploit object unmarshalling for code execution. Public exploit code available. No vendor-released patch identified at time of analysis.
- CVE-2026-26210 (CRITICAL, CVSS 9.3): KTransformers through 0.5.3 unsafe deserialization in balance_serve backend allows remote attackers to execute arbitrary code via crafted pickle payload to exposed ZMQ socket. Public exploit code available. Upstream fix available (PR/commit); released patched version not independently confirmed.
- CVE-2026-41468 (CRITICAL, CVSS 9.3): Beghelli Sicuro24 SicuroWeb template injection with AngularJS 1.5.2 sandbox escape enables arbitrary JavaScript execution in operator browsers, leading to session hijacking. Public exploit code available. No vendor-released patch identified at time of analysis. Action: Within 24 hours: Identify all Beghelli Sicuro24 SicuroWeb deployments and verify TLS enforcement-disable HTTP access entirely and enforce HTTPS-only communication; audit logs for suspicious JavaScript.
- CVE-2026-39920 (CRITICAL, CVSS 9.3): BridgeHead FileStore pre-24A remote code execution via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. Public exploit code available. Patch available per vendor advisory. Action: Within 24 hours: Identify all BridgeHead FileStore instances running versions before 24A; isolate affected systems from production networks or restrict network access to the Axis2 admin console.
- CVE-2026-41179 (CRITICAL, CVSS 9.2): rclone remote control API command injection allows remote attackers to execute arbitrary commands through unprotected operations endpoint when RC API is enabled without global HTTP authentication. Public exploit code available. Patch available per vendor advisory. Action: Within 24 hours: Identify all rclone instances with RC API enabled using port scanning and configuration audits; immediately disable --rc or rclone rcd if not operationally critical, or restrict network access.
- CVE-2026-41176 (CRITICAL, CVSS 9.2): rclone RC API authentication bypass allows remote attackers to disable authorization checks via unauthenticated configuration mutation through the options/set endpoint. Public exploit code available. Patch available per vendor advisory. Action: Within 24 hours: Audit all rclone deployments to identify instances with RC endpoints exposed to untrusted networks and verify HTTP authentication status via rclone rc options/get and network exposure.
- CVE-2026-33656 (CRITICAL, CVSS 9.1): EspoCRM path traversal in formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server via attachment sourceId field manipulation. Public exploit code available. Patch available per vendor advisory. Action: Within 24 hours: Identify all EspoCRM instances in use and verify current versions; restrict administrative access to formula scripting features where possible and audit recent admin activities.
- CVE-2026-7037 (HIGH, CVSS 8.9, EPSS 0.9%): Totolink A8000RU firmware 7.1cu.643_b20200521 OS command injection via pptpPassThru parameter enables remote unauthenticated attackers to execute arbitrary system commands. Public exploit code available. No vendor-released patch identified at time of analysis. Action: Within 24 hours: Identify all Totolik A8000RU devices in your environment using network scanning tools and asset management systems, prioritize internet-facing instances for immediate isolation.
- CVE-2026-41473 (HIGH, CVSS 8.8, EPSS 0.2%): CyberPanel prior to 2.4.4 authentication bypass in AI Scanner worker API endpoints allows unauthenticated remote attackers to write arbitrary data to the database. Public exploit code available. Upstream fix available (PR/commit); released patched version not independently confirmed.
Threat Landscape
Linux products represent the largest vendor share with 259 CVEs, followed by Oracle (103), WordPress (70), Mozilla (44), and Microsoft (26). Information Disclosure is the most prevalent attack technique (393 CVEs), followed by Authentication Bypass (274), Denial of Service (168), XSS (125), and Buffer Overflow (109). RCE affects 101 CVEs. Patch coverage is 55.7% across all severities (795 patched of 1,427 total). Five CRITICAL vulnerabilities have linked threat intelligence per MISP Galaxies, MITRE ATT&CK, or CISA attribution: CVE-2026-6074, CVE-2026-40630, CVE-2026-25775, CVE-2026-40620, and CVE-2026-35503.
Key Trends
Week-over-week CVE publication volume increased 21% from 1,180 to 1,427. CRITICAL and HIGH severity vulnerabilities total 492 (34.5% of all CVEs), with 237 remaining unpatched. Public exploit code is available for 146 CVEs (10.2% of the dataset), elevating exploitation risk for these vulnerabilities. Vendor concentration is notable, with the top 10 vendors accounting for 586 CVEs (41% of total volume). Authentication Bypass ranks as the second-most prevalent attack technique (274 CVEs), indicating continued focus on credential and access control weaknesses.
Recommendations
- Within 24 hours: Identify all Beghelli Sicuro24 SicuroWeb deployments and verify TLS enforcement-disable HTTP access entirely and enforce HTTPS-only communication; audit logs for suspicious JavaScript.
- Within 24 hours: Identify all BridgeHead FileStore instances running versions before 24A; isolate affected systems from production networks or restrict network access to the Axis2 admin console.
- Within 24 hours: Identify all rclone instances with RC API enabled using port scanning and configuration audits; immediately disable --rc or rclone rcd if not operationally critical, or restrict network access.
- Within 24 hours: Audit all rclone deployments to identify instances with RC endpoints exposed to untrusted networks and verify HTTP authentication status via rclone rc options/get and network exposure.
- Within 24 hours: Identify all EspoCRM instances in use and verify current versions; restrict administrative access to formula scripting features where possible and audit recent admin activities.
- Within 24 hours: Identify all Totolik A8000RU devices in your environment using network scanning tools and asset management systems, prioritize internet-facing instances for immediate isolation.
- Prioritize remediation for the 237 unpatched CRITICAL and HIGH severity vulnerabilities, focusing on network-accessible systems and those with public exploit code.
- Review the 146 CVEs with public exploit code for presence in the environment, as exploitation risk is elevated for these vulnerabilities.
- For CVE-2026-26210 and CVE-2026-41473, review and apply the upstream fixes after validation in non-production environments, or wait for an official tagged release if operational risk permits delay.
Top 10 Priority CVEs
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering framework to LLM agents) versions 1.6.0 and earlier lets remote, unauthenticated attackers achieve full remote code execution on the host. Attacker-controlled JSON-RPC parameters flow into r2_cmd_str() where shell metacharacters bypass the command filter, and because the fix re-enables radare2's exec/socket sandbox, the flaw effectively granted attackers direct shell access. Publicly available exploit code exists (reported by VulnCheck, POC referenced in issue #45); it is not listed in CISA KEV and EPSS is modest at 0.27% (51st percentile).
Unauthenticated remote file read/write and NTLM coercion in Kofax Capture (rebranded Tungsten Capture) 6.0.0.0 stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on TCP/2424 with a default, publicly known endpoint identifier and no authentication. A remote attacker can abuse .NET Remoting object unmarshalling to instantiate a server-side System.Net.WebClient, allowing arbitrary file read/write and coerced NTLMv2 authentication that can cascade into credential theft, denial of service, remote code execution, or lateral movement depending on the service account's privileges. Publicly available exploit code exists (VulnCheck/gist PoC); it is not listed in CISA KEV, and EPSS is low at 0.16% (37th percentile).
Remote code execution in KTransformers through 0.5.3 lets unauthenticated network attackers run arbitrary code by sending a crafted pickle payload to the scheduler RPC service used in balance_serve backend mode. The affected code binds a ZMQ ROUTER socket to all interfaces (0.0.0.0) with no authentication and passes received frames straight into pickle.loads(), so any host that can reach the scheduler port gains code execution as the ktransformers process. Publicly available exploit code exists (VulnCheck/chocapikk write-up) and a vendor upstream fix is available, though the EPSS probability is currently low at 0.04%.
Template injection combined with AngularJS 1.5.2 sandbox escape primitives in Beghelli Sicuro24 SicuroWeb enables arbitrary JavaScript execution in operator browsers, leading to session hijacking and persistent compromise. Network-adjacent attackers can exploit this via MITM on plaintext HTTP deployments requiring only passive user interaction. Publicly available POC exists (CVE-2026-22191 exploit chain documented by BoffSec Services and kmkz), confirming weaponization risk. CVSS 9.3 reflects adjacent-network access requirement (AV:A), but SSVC indicates total technical impact with POC-confirmed exploitation status.
Remote code execution in BridgeHead FileStore pre-24A via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. The vulnerability exploits exposed Axis2 admin console with unchanged default credentials, enabling full system compromise over the network with no authentication required. Publicly available exploit code exists (GitHub Gist), and CVSS 9.8 reflects critical risk with network vector, low complexity, and no privileges required. EPSS data not provided but exploitation prerequisites are minimal given default credential exposure.
Remote code execution via unauthenticated command injection in rclone's remote control API allows network attackers to execute arbitrary commands on the host system through a single HTTP request. The vulnerability affects rclone deployments with the RC API enabled (--rc or rclone rcd) that are network-accessible and lack global HTTP authentication. An attacker exploits the unprotected operations/fsinfo endpoint by crafting a WebDAV backend definition with a malicious bearer_token_command parameter, which executes during backend initialization. Confirmed exploitable on master branch (commit bf55d5e6) and release v1.73.4 with public proof-of-concept available. CVSS 9.2 reflects critical severity with network attack vector and no authentication required, though exploitation requires specific deployment configuration (AT:P). No CISA KEV listing or EPSS data available at time of analysis.
Authentication bypass in rclone's remote control (RC) API allows network attackers to disable authorization checks via unauthenticated configuration mutation, enabling full administrative access to RC endpoints. The `options/set` endpoint lacks authentication requirements and permits setting `rc.NoAuth=true`, which disables protection for all RC methods marked `AuthRequired: true`. Affects rclone v1.45 onward when RC is network-accessible without HTTP authentication. No CISA KEV listing or public exploit code identified at time of analysis, though GitHub security advisory provides detailed proof-of-concept reproduction steps. CVSS 9.2 reflects critical severity with network vector and no authentication required, though CVSS:4.0 AT:P (Attack Requirements: Present) indicates specific deployment prerequisites limit automatic exploitation.
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server by manipulating attachment sourceId fields. The vulnerability chains unsanitized user input with filesystem operations, enabling admins to overwrite or access files anywhere within PHP's open_basedir restriction. Publicly available exploit code exists. Vendor-released patch version 9.3.4 addresses this critical issue. Despite the 9.1 CVSS score and Changed scope indicating potential container escape or cross-tenant impact, EPSS data was not provided to assess real-world exploitation likelihood.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 enables remote unauthenticated attackers to execute arbitrary system commands via the pptpPassThru parameter in the setVpnPassCfg function. Public exploit code exists on GitHub, dramatically lowering the barrier to exploitation. CVSS v4.0 base score of 8.9 reflects network attack vector, low complexity, and no authentication requirements, with high impact to confidentiality, integrity, and availability of the vulnerable device.
Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.