Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 27 April to 3 May 2026 (week 18)
Final report, published . It does not change.
In the week of 27 April to 3 May 2026, 4 vulnerabilities were newly recorded as exploited in the wild, 4 of them critical. The technology hit most was Microsoft Windows (2), followed by ABB Ability Edgenius (1) and Amazon AWS (1).
- Newly exploited
- 4
- Critical
- 4
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-31431: Linux Kernel crypto algif_aead improper memory handlingcriticalCVSS 7.8Exploited since Published ABB Ability Edgenius, Amazon Linux, Amazon AWS
- CVE-2026-41940: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows…criticalCVSS 9.8Exploited since Published WebPros cPanel, WebPros cPanel & WHM, WebPros WHM
- CVE-2024-1708: ConnectWise ScreenConnect path traversalcriticalCVSS 8.4Exploited since Published ConnectWise ScreenConnect, Microsoft Windows
- CVE-2026-32202: Microsoft Windows Shell protection mechanism failure spoofingcriticalCVSS 4.3Exploited since Published Microsoft Windows, Microsoft Windows Shell
Technologies hit most
- 1.Microsoft Windows2 vulnerabilities
- 2.ABB Ability Edgenius1 vulnerability
- 3.Amazon AWS1 vulnerability
- 4.Amazon Deep Learning AMI1 vulnerability
- 5.Amazon EKS-optimized AMI1 vulnerability
- 6.Amazon Elastic Container Service1 vulnerability
- 7.Amazon Linux1 vulnerability
- 8.ConnectWise ScreenConnect1 vulnerability
- 9.Linux Kernel1 vulnerability
- 10.Microsoft Windows Shell1 vulnerability
- 11.Siemens SIMATIC AX Runtime Core1 vulnerability
- 12.Siemens SIMATIC CN 41001 vulnerability
- 13.Siemens SIMATIC HMI MTP1000 Unified Basic1 vulnerability
- 14.Siemens SIMATIC HMI MTP1000 Unified Comfort Panel1 vulnerability
- 15.Siemens SIMATIC HMI MTP1200 Comfort Pro1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-04-27.json, and this page as text at https://junglewise.ai/threats/exploited/2026-04-27.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 27 April to 3 May 2026 (week 18)", https://junglewise.ai/threats/exploited/2026-04-27, 2 October 2026.