# april 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for april 2026, painted from 5,813 published cves](https://media.cvegen.art/posters/2026-04/1280.jpg?v=c922d67906)

what the poster shows: 30 days as bands of dry brush, the first day at the top. 21 ran above the 2025 average for their weekday and sweep fast and wide; the other 9 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-04.mp4?v=9fbfb6211c)

| fact | value |
| --- | --- |
| cves | 5,813 |
| against an average 2025 month | 1.4× |
| busiest day | apr 8, 484 |
| rated critical, cvss 9 or higher | 565 |
| critical with no login and no click | 430 |
| used in real attacks | 14 |

## april 2026 in numbers

april 2026 brought 5,813 cves, 1.4 times an average 2025 month. 21 of its 30 days ran above the 2025 average for that weekday.

- 484 on apr 8, the busiest day. patchstack published 164 of them at once.
- 565 rated critical, cvss 9 or higher. 430 of them can be hit over the network with no login and nothing for a user to click.
- 263 in ai software, 5.0 times their 2025 monthly average. no other kind of software grew as fast.
- 465 came in three single drops: patchstack 164 on apr 8, microsoft 163 on apr 14, the linux kernel team 138 on apr 24.

## 14 already used in real attacks

cisa kev, as of oct 24.

### by product

- 1 google dawn, apr 1
- 1 fortinet forticlient ems, apr 4
- 1 apache activemq, apr 7
- 1 apache tomcat, apr 9
- 1 marimo, apr 9
- 1 adobe acrobat and reader, apr 11
- 1 fortinet fortisandbox, apr 14
- 1 fortinet products, apr 14
- 1 microsoft defender, apr 14
- 1 microsoft internet key exchange service extensions, apr 14
- 1 microsoft sharepoint server, apr 14
- 1 microsoft windows, apr 14
- 1 linux kernel, apr 22
- 1 webpros cpanel & whm and wp2, apr 29

### every cve

- apr 1, google dawn, [cve-2026-5281](https://www.cve.org/CVERecord?id=CVE-2026-5281)
- apr 4, fortinet forticlient ems, [cve-2026-35616](https://www.cve.org/CVERecord?id=CVE-2026-35616)
- apr 7, apache activemq, [cve-2026-34197](https://www.cve.org/CVERecord?id=CVE-2026-34197)
- apr 9, apache tomcat, [cve-2026-34486](https://www.cve.org/CVERecord?id=CVE-2026-34486)
- apr 9, marimo marimo, [cve-2026-39987](https://www.cve.org/CVERecord?id=CVE-2026-39987)
- apr 11, adobe acrobat and reader, [cve-2026-34621](https://www.cve.org/CVERecord?id=CVE-2026-34621)
- apr 14, fortinet multiple products, [cve-2025-61624](https://www.cve.org/CVERecord?id=CVE-2025-61624)
- apr 14, microsoft sharepoint server, [cve-2026-32201](https://www.cve.org/CVERecord?id=CVE-2026-32201)
- apr 14, microsoft windows, [cve-2026-32202](https://www.cve.org/CVERecord?id=CVE-2026-32202)
- apr 14, microsoft internet key exchange (ike) service extensions, [cve-2026-33824](https://www.cve.org/CVERecord?id=CVE-2026-33824)
- apr 14, microsoft defender, [cve-2026-33825](https://www.cve.org/CVERecord?id=CVE-2026-33825)
- apr 14, fortinet fortisandbox, [cve-2026-39808](https://www.cve.org/CVERecord?id=CVE-2026-39808)
- apr 22, linux kernel, [cve-2026-31431](https://www.cve.org/CVERecord?id=CVE-2026-31431)
- apr 29, webpros cpanel & whm and wp2 (wordpress squared), [cve-2026-41940](https://www.cve.org/CVERecord?id=CVE-2026-41940)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | april 1 to 30, 2026 |
| cves | 5,813 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-04/2000.jpg?v=c922d67906)

## other months

- before: [march 2026](https://cvegen.art/2026/03.md), 6,236 cves
- after: [may 2026](https://cvegen.art/2026/05.md), 6,933 cves
- [all months](https://cvegen.art/index.md)