This Week in Threats: Apr 28–May 12, 2026

Weekly Threat Summary

7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 9.8.

This week includes 3 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2026-42208 — BerriAI LiteLLM SQL Injection Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-05-08
• Description: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-04-30
• Description: WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-0300 — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-06
• Description: Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required.

CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability

• CVSS Score: 8.4 (HIGH)
• Date Added: 2026-04-28
• Description: ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-05-01
• Description: Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege...
• Required Action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-6973 — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

• CVSS Score: 7.2 (HIGH)
• Date Added: 2026-05-07
• Description: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-32202 — Microsoft Windows Protection Mechanism Failure Vulnerability

• CVSS Score: 4.3 (MEDIUM)
• Date Added: 2026-04-28
• Description: Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2026-42208 → D2 Threats & Vulnerabilities, D3 Security Architecture
• CVE-2026-41940 → D2 Threats & Vulnerabilities
• CVE-2026-31431 → D2 Threats & Vulnerabilities
• CVE-2026-6973 → D4 Security Operations

ISC2 CISSP

• CVE-2026-42208 → D6 Security Assessment
• CVE-2026-41940 → D5 IAM, D6 Security Assessment
• CVE-2026-0300 → D4 Communication & Network, D5 IAM, D6 Security Assessment
• CVE-2024-1708 → D6 Security Assessment
• CVE-2026-31431 → D6 Security Assessment
• CVE-2026-6973 → D6 Security Assessment
• CVE-2026-32202 → D6 Security Assessment

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.