cvegen

april 2026

cves
5,813
against an average 2025 month
1.4×
busiest day
apr 8, 484
used in real attacks
14

april 2026 brought 5,813 cves, 1.4 times an average 2025 month.

21 of its 30 days ran above the 2025 average for that weekday.

484

on apr 8, the busiest day. patchstack published 164 of them at once.

565

rated critical, cvss 9 or higher. 430 of them can be hit over the network with no login and nothing for a user to click.

263

in ai software, 5.0 times their 2025 monthly average. no other kind of software grew as fast.

465

came in three single drops: patchstack 164 on apr 8, microsoft 163 on apr 14, the linux kernel team 138 on apr 24.

14 already used in real attacks

cisa kev, as of oct 24

  • 1
    google dawn
    apr 1
  • 1
    fortinet forticlient ems
    apr 4
  • 1
    apache activemq
    apr 7
  • 1
    apache tomcat
    apr 9
  • 1
    marimo
    apr 9
  • 1
    adobe acrobat and reader
    apr 11
  • 1
    fortinet fortisandbox
    apr 14
  • 1
    fortinet products
    apr 14
  • 1
    microsoft defender
    apr 14
  • 1
    microsoft internet key exchange service extensions
    apr 14
and 4 more productsall 14 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
april 1 to 30, 2026
cves
5,813
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667