| CVE | Vendor · product | Added to KEV | Due | EPSS | APAC news |
|---|---|---|---|---|---|
| CVE-2026-39987
Marimo Remote Code Execution Vulnerability |
Marimo · Marimo | Apr 23, 2026 | May 7, 2026 | 99.7% | — |
| CVE-2026-33825 Ransomware
Microsoft Defender Insufficient Granularity of Access Control Vulnerability |
Microsoft · Defender | Apr 22, 2026 | May 6, 2026 | 6.9% | — |
| CVE-2023-27351 Ransomware
PaperCut NG/MF Improper Authentication Vulnerability |
PaperCut · NG/MF | Apr 20, 2026 | May 4, 2026 | 78.1% | — |
| CVE-2024-27199 Ransomware
JetBrains TeamCity Relative Path Traversal Vulnerability |
JetBrains · TeamCity | Apr 20, 2026 | May 4, 2026 | 100.0% | — |
| CVE-2025-2749
Kentico Xperience Path Traversal Vulnerability |
Kentico · Kentico Xperience | Apr 20, 2026 | May 4, 2026 | 4.0% | — |
| CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerabi… |
Quest · KACE Systems Management Appliance (SMA) | Apr 20, 2026 | May 4, 2026 | 2.5% | — |
| CVE-2025-48700
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability |
Synacor · Zimbra Collaboration Suite (ZCS) | Apr 20, 2026 | Apr 23, 2026 | 1.7% | — |
| CVE-2026-20122
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability |
Cisco · Catalyst SD-WAN Manger | Apr 20, 2026 | Apr 23, 2026 | 25.8% | — |
| CVE-2026-20128
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnera… |
Cisco · Catalyst SD-WAN Manager | Apr 20, 2026 | Apr 23, 2026 | 8.3% | — |
| CVE-2026-20133
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthori… |
Cisco · Catalyst SD-WAN Manager | Apr 20, 2026 | Apr 23, 2026 | 35.3% | — |
| CVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability |
Apache · ActiveMQ | Apr 16, 2026 | Apr 30, 2026 | 98.3% | — |
| CVE-2009-0238
Microsoft Office Remote Code Execution |
Microsoft · Office | Apr 14, 2026 | Apr 28, 2026 | 42.9% | — |
| CVE-2026-32201
Microsoft SharePoint Server Improper Input Validation Vulnerability |
Microsoft · SharePoint Server | Apr 14, 2026 | Apr 28, 2026 | 44.0% | — |
| CVE-2012-1854
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability |
Microsoft · Visual Basic for Applications (VBA) | Apr 13, 2026 | Apr 27, 2026 | 20.9% | — |
| CVE-2020-9715
Adobe Acrobat Use-After-Free Vulnerability |
Adobe · Acrobat | Apr 13, 2026 | Apr 27, 2026 | 33.3% | — |
| CVE-2023-21529 Ransomware
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability |
Microsoft · Exchange Server | Apr 13, 2026 | Apr 27, 2026 | 59.3% | — |
| CVE-2023-36424
Microsoft Windows Out-of-Bounds Read Vulnerability |
Microsoft · Windows | Apr 13, 2026 | Apr 27, 2026 | 12.1% | — |
| CVE-2025-60710 Ransomware
Microsoft Windows Link Following Vulnerability |
Microsoft · Windows | Apr 13, 2026 | Apr 27, 2026 | 4.6% | 1 last Nov 10 |
| CVE-2026-21643
Fortinet FortiClient EMS SQL Injection Vulnerability |
Fortinet · FortiClient EMS | Apr 13, 2026 | Apr 16, 2026 | 97.7% | — |
| CVE-2026-34621
Adobe Acrobat and Reader Prototype Pollution Vulnerability |
Adobe · Acrobat and Reader | Apr 13, 2026 | Apr 27, 2026 | 7.3% | — |
| CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
Ivanti · Endpoint Manager Mobile (EPMM) | Apr 8, 2026 | Apr 11, 2026 | 98.6% | — |
| CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability |
Fortinet · FortiClient EMS | Apr 6, 2026 | Apr 9, 2026 | 94.0% | — |
| CVE-2026-3502
TrueConf Client Download of Code Without Integrity Check Vulnerability |
TrueConf · Client | Apr 2, 2026 | Apr 16, 2026 | 5.8% | — |
| CVE-2026-5281
Google Dawn Use-After-Free Vulnerability |
Google · Dawn | Apr 1, 2026 | Apr 15, 2026 | 13.7% | — |
| CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability |
Citrix · NetScaler | Mar 30, 2026 | Apr 2, 2026 | 91.5% | — |
| CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability |
F5 · BIG-IP | Mar 27, 2026 | Mar 30, 2026 | 2.3% | — |
| CVE-2026-33634
Aquasecurity Trivy Embedded Malicious Code Vulnerability |
Aquasecurity · Trivy | Mar 26, 2026 | Apr 9, 2026 | 60.4% | — |
| CVE-2026-33017
Langflow Code Injection Vulnerability |
Langflow · Langflow | Mar 25, 2026 | Apr 8, 2026 | 96.4% | — |
| CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability |
Apple · Multiple Products | Mar 20, 2026 | Apr 3, 2026 | 1.7% | — |
| CVE-2025-32432
Craft CMS Code Injection Vulnerability |
Craft CMS · Craft CMS | Mar 20, 2026 | Apr 3, 2026 | 99.8% | — |
| CVE-2025-43510
Apple Multiple Products Improper Locking Vulnerability |
Apple · Multiple Products | Mar 20, 2026 | Apr 3, 2026 | 0.4% | — |
| CVE-2025-43520
Apple Multiple Products Classic Buffer Overflow Vulnerability |
Apple · Multiple Products | Mar 20, 2026 | Apr 3, 2026 | 0.4% | — |
| CVE-2025-54068
Laravel Livewire Code Injection Vulnerability |
Laravel · Livewire | Mar 20, 2026 | Apr 3, 2026 | 96.3% | — |
| CVE-2026-20131 Ransomware
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud… |
Cisco · Secure Firewall Management Center (FMC) | Mar 19, 2026 | Mar 22, 2026 | 44.4% | — |
| CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability |
Synacor · Zimbra Collaboration Suite (ZCS) | Mar 18, 2026 | Apr 1, 2026 | 20.2% | — |
| CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
Microsoft · SharePoint | Mar 18, 2026 | Mar 21, 2026 | 29.2% | — |
| CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability |
Wing FTP Server · Wing FTP Server | Mar 16, 2026 | Mar 30, 2026 | 62.5% | — |
| CVE-2026-3909
Google Skia Out-of-Bounds Write Vulnerability |
Google · Skia | Mar 13, 2026 | Mar 27, 2026 | 2.3% | — |
| CVE-2026-3910
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Me… |
Google · Chromium V8 | Mar 13, 2026 | Mar 27, 2026 | 2.7% | — |
| CVE-2025-68613
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability |
n8n · n8n | Mar 11, 2026 | Mar 25, 2026 | 99.0% | — |
| CVE-2021-22054
Omnissa Workspace ONE Server-Side Request Forgery |
Omnissa · Workspace One UEM | Mar 9, 2026 | Mar 23, 2026 | 99.7% | — |
| CVE-2025-26399 Ransomware
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability |
SolarWinds · Web Help Desk | Mar 9, 2026 | Mar 12, 2026 | 90.6% | — |
| CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability |
Ivanti · Endpoint Manager (EPM) | Mar 9, 2026 | Mar 23, 2026 | 88.3% | — |
| CVE-2017-7921
Hikvision Multiple Products Improper Authentication Vulnerability |
Hikvision · Multiple Products | Mar 5, 2026 | Mar 26, 2026 | 100.0% | — |
| CVE-2021-22681
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability |
Rockwell · Multiple Products | Mar 5, 2026 | Mar 26, 2026 | 63.6% | — |
| CVE-2021-30952
Apple Multiple Products Integer Overflow or Wraparound Vulnerability |
Apple · Multiple Products | Mar 5, 2026 | Mar 26, 2026 | 7.0% | — |
| CVE-2023-41974
Apple iOS and iPadOS Use-After-Free Vulnerability |
Apple · iOS and iPadOS | Mar 5, 2026 | Mar 26, 2026 | 2.0% | — |
| CVE-2023-43000
Apple Multiple products Use-After-Free Vulnerability |
Apple · Multiple Products | Mar 5, 2026 | Mar 26, 2026 | 4.0% | — |
| CVE-2026-21385
Qualcomm Multiple Chipsets Memory Corruption Vulnerability |
Qualcomm · Multiple Chipsets | Mar 3, 2026 | Mar 24, 2026 | 1.3% | — |
| CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability |
Broadcom · VMware Aria Operations | Mar 3, 2026 | Mar 24, 2026 | 18.3% | — |
Sources: CISA KEV and FIRST EPSS, refreshed daily. EPSS estimates the probability that a CVE is exploited in the next 30 days. CVEs named in the news but absent from KEV are listed under "In Asia-Pacific news" as well.