# Newly exploited vulnerabilities: week of 27 April to 3 May 2026 (week 18)

Source: https://junglewise.ai/threats/exploited/2026-04-27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-04-27.json  
License: CC BY 4.0 with a link back

In the week of 27 April to 3 May 2026, 4 vulnerabilities were newly recorded as exploited in the wild, 4 of them critical. The technology hit most was Microsoft Windows (2), followed by ABB Ability Edgenius (1) and Amazon AWS (1).

## Newly exploited this week

- [CVE-2026-31431: Linux Kernel crypto algif_aead improper memory handling](https://junglewise.ai/threats/cve-2026-31431-linux-kernel-crypto-algif-aead-improper-memory-handling) (critical, exploited in the wild, CVSS 7.8, exploited since 1 May 2026, published 22 Apr 2026)
- [CVE-2026-41940: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows…](https://junglewise.ai/threats/cve-2026-41940-webpros-cpanel-whm-authentication-bypass-in-login-flow) (critical, exploited in the wild, CVSS 9.8, exploited since 30 Apr 2026, published 29 Apr 2026)
- [CVE-2024-1708: ConnectWise ScreenConnect path traversal](https://junglewise.ai/threats/cve-2024-1708-connectwise-screenconnect-path-traversal) (critical, exploited in the wild, CVSS 8.4, exploited since 28 Apr 2026, published 28 Apr 2026)
- [CVE-2026-32202: Microsoft Windows Shell protection mechanism failure spoofing](https://junglewise.ai/threats/cve-2026-32202-microsoft-windows-shell-protection-mechanism-failure-spoofing) (critical, exploited in the wild, CVSS 4.3, exploited since 28 Apr 2026, published 14 Apr 2026)

## Technologies hit most

1. [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-): 2 vulnerabilities
2. ABB Ability Edgenius: 1 vulnerability
3. [Amazon AWS](https://junglewise.ai/threats/technologies/aws): 1 vulnerability
4. Amazon Deep Learning AMI: 1 vulnerability
5. Amazon EKS-optimized AMI: 1 vulnerability
6. Amazon Elastic Container Service: 1 vulnerability
7. Amazon Linux: 1 vulnerability
8. [ConnectWise ScreenConnect](https://junglewise.ai/threats/technologies/screenconnect): 1 vulnerability
9. [Linux Kernel](https://junglewise.ai/threats/technologies/kernel): 1 vulnerability
10. [Microsoft Windows Shell](https://junglewise.ai/threats/technologies/windows-shell): 1 vulnerability
11. Siemens SIMATIC AX Runtime Core: 1 vulnerability
12. [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100): 1 vulnerability
13. Siemens SIMATIC HMI MTP1000 Unified Basic: 1 vulnerability
14. Siemens SIMATIC HMI MTP1000 Unified Comfort Panel: 1 vulnerability
15. Siemens SIMATIC HMI MTP1200 Comfort Pro: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 27 April to 3 May 2026 (week 18)", https://junglewise.ai/threats/exploited/2026-04-27, 2 October 2026.