Week 14, 2026
30 March to 5 April 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,293CVEs publishedin the whole week
- 140CriticalCVSS 9.0 and above
- 448HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2026-3502
TrueConf Client Update Integrity Verification Bypass
TrueConf · TrueConf Client
ExploitedHigh7.8 - CVE-2026-5281
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code…
Google · Chrome
ExploitedHigh8.8 - CVE-2026-3055
Insufficient input validation leading to memory overread
NetScaler · ADC
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
nocobase · nocobase
Critical10.0 - CVE-2026-34938
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
MervinPraison · PraisonAI
Critical10.0 - CVE-2025-15379
Command Injection in mlflow/mlflow
mlflow · mlflow/mlflow
Critical10.0 - CVE-2026-34838
Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
Intermesh · groupoffice
Critical10.0 - CVE-2026-32213
Azure AI Foundry Elevation of Privilege Vulnerability
Microsoft · Azure AI Foundry
Critical10.0 - CVE-2026-32871
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
PrefectHQ · fastmcp
Critical10.0 - CVE-2026-33105
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Microsoft · Azure Kubernetes Service
Critical10.0 - CVE-2026-32186
Microsoft Bing Elevation of Privilege Vulnerability
Microsoft · Microsoft Bing
Critical10.0 - CVE-2026-33107
Azure Databricks Elevation of Privilege Vulnerability
Microsoft · Azure Databricks
Critical10.0 - CVE-2026-34612
Kestra: Remote Code Execution via SQL Injection
kestra-io · kestra
Critical10.0