🧰 CISA Known Exploited Vulnerabilities Catalog

The items that name it 46

• A quiet week in infosec <.<
  articleas tools2026-10-29It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Catalog to which CISA added the two PHP vulnerabilities (reported by Federal News Network)

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas tools2026-10-29It is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog.

  CISA's list of actively exploited vulnerabilities. CVE-2026-46300 was added on Wednesday, and the PHP2Shell flaws were added on Monday.

• Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  articleas tools2026-10-29It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists vulnerabilities exploited in attacks; CVE-2026-41709 was added, with federal agencies urged to patch within two weeks.

  KEV

• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
  writeupas tools2026-10-29

  Lists CVE-2026-111497 as exploited.

• CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the Wild
  advisoryas tools2026-10-28It is written here as CISA Known Exploited Vulnerabilities catalog: referenced to note the CVE was not yet listed.
• CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
  articleas tools2026-10-28It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists vulnerabilities known to be exploited; now includes CVE-2026-111497.

  KEV

• The Impact of AI on CVEs: Industry Challenges
  articleas tools2026-10-27It is written here as CISA Known Exploited Vulnerabilities Catalog: list used by NIST to prioritize NVD analysis.
• This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
  articleas tools2026-10-27It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: public catalog of exploited CVEs; emergency additions were made on a Sunday for the NetScaler issues.

  KEV

• PHP2Shell Exploitation Moves From Probes to Working Shells
  articleas tools2026-10-26It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: as of the morning of October 26, 2026, the PHP2Shell vulnerabilities had not been added.

  KEV

• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  articleas tools2026-10-23It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: neither PHP2Shell CVE had been added as of the morning of October 23, 2026.

  KEV

• lee1981 (@lee1981b) on X
  articleas tools2026-10-21It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists the CVE, added 20 October 2026; required action references BOD 26-04..

  KEV

• Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
  advisoryas tools2026-10-20

  Catalog checked for the CVEs; as of October 22, 2026 neither CVE had been added

• Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
  articleas tools2026-10-19It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists exploited flaws; CVE-2025-61624 was added on a Friday, with federal agencies urged to patch immediately.

  KEV

• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas tools2026-10-18It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists vulnerabilities known to be exploited; version 2026.10.16, released 1:15 PM ET on 16 October 2026, still lists CVE-2026-21589.

  KEV

• Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)
  advisoryas tools2026-10-16It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Added CVE-2026-102764 on October 16, 2026 after exploitation in the wild; also lists earlier BeyondTrust Remote Support vulnerabilities

• BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)
  advisoryas tools2026-10-16It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Added CVE-2026-102764 on October 16, 2026, confirming exploitation in the wild

• Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
  articleas tools2026-10-15It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists actively exploited vulnerabilities; CVE-2026-0322 added on Wednesday with federal agency remediation deadline of October 17.

  KEV

• Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
  articleas tools2026-10-14It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: tracks exploited vulnerabilities and remediation deadlines.

  KEV

• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas tools2026-10-13It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog (tracks vulnerabilities exploited in the wild).

  KEV

• Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
  advisoryas tools2026-10-13It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists vulnerabilities confirmed as exploited in the wild; CVE-2026-104935 added October 13, 2026.

  KEV

• Frequently Asked Questions About the Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)
  advisoryas tools2026-10-13

  Added CVE-2026-104935 on October 13, 2026 after exploitation in the wild was reported by the vendor and CISA.

• Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)
  advisoryas tools2026-10-13It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Added CVE-2026-104935 on October 13, 2026, confirming exploitation in the wild

• Configuring your AI vulnerability harness, Part 2: The steering file
  articleas tools2026-10-07It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Threat intelligence feed indicating vulnerabilities exploited in the wild, including ransomware campaign ties; integrated as a scoring signal in the steering file

• Atlassian Jira, Confluence (and more) Arbitrary File Read Vulnerability (CVE-2026-21589)
  advisoryas tools2026-10-06It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Added CVE-2026-21589 on October 15, 2026, confirming exploitation in the wild

• Critical Citrix NetScaler Zero-Days Under Active Exploitation
  advisoryas tools2026-09-29It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: lists CVE-2026-88771 and CVE-2026-88772 as actively exploited.

  KEV

• Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
  articleas tools2026-09-24It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Real-world exploitation signal used to prioritize vulnerability scan results.

• When Business Email Compromise Starts Rewriting Reality
  writeupas tools2026-09-24It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Tracks vulnerabilities confirmed as actively exploited; referenced for cataloging multiple Zimbra CVEs and setting remediation deadlines for federal agencies.

• Cyber Resilience Act is here! Myth busting and first impressions
  articleas tools2026-09-23It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Monitored by Aikido to identify vulnerabilities with known exploits in the wild

• Claude Code & Gemini CLI: GitHub Issue → CI Secrets
  writeupas tools2026-09-01It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  referenced to confirm neither CVE appears listed as exploited

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeupas tools2026-09-01It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Public catalog listing the two WebKit entry-point CVEs (CVE-2025-31277, CVE-2025-43529) as known exploited

• N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
  writeupas tools2026-08-20

  Lists CVE-2026-39987 (Marimo)

• Have We Seen an Acceleration in Discoveries?
  articleas affected products2026-08-14It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: on track to exceed 2025 total, with lower growth than CVEs.

  on track to exceed 2025 total, with lower growth than CVEs

• NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence
  articleas tools2026-06-25It is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog.

  Catalog of vulnerabilities confirmed to be actively exploited, used by NVD as a prioritization criterion for enrichment (targeting enrichment within one business day of receipt)

• Orca: 8 Container Security Best Practices for 2026
  articleas tools2026-06-11It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  KEV

• Socket: Federal Audit
  articleas tools2026-06-04It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Federal government list of vulnerabilities known to be exploited in the wild; used as prioritization source for NVD enrichment

• CSA: VulnOps in the Age of AI
  articleas tools2026-05-13It is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  Exploitability signal used for risk-based prioritization and as one of the criteria NVD now uses for full enrichment

• #StopRansomware: SafePay Ransomware (AA26-293A)
  advisoryas tools
• AI Agents for Cybersecurity: A Guided Tour of a Repository with Tons of Resources and Examples
  articleas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: pulled and analyzed by agent.

  KEV

• AI Agents for Cybersecurity: A Guided Tour of a Repository with Tons of Resources and Examples
  articleas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) catalog: pulled and analyzed by agents.

  KEV

• CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data
  advisoryas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog.

  KEV

• CISA KEV: Fortinet FortiMail CVE-2026-104286 path traversal, actively exploited, no patch yet
  advisoryas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog (CISA's catalog of vulnerabilities with evidence of active exploitation, used to prioritize remediation).

  KEV

• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
  advisoryas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog (CVE-2026-88771 and CVE-2026-88772 added Sept. 27, 2026; CVE-2026-88779 added Oct. 4, 2026).

  KEV

• Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
  articleas tools

  Reference catalog checked to confirm none of the eleven CVEs is listed as of August 5, 2026

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisoryas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) Catalog: list of CVEs with evidence of active exploitation, used to prioritize remediation.

  KEV

• Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
  advisoryas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  U.S. Cybersecurity and Infrastructure Security Agency catalog to which CVE-2026-76460 was added on September 16, 2026, requiring FCEB agencies to apply patches by September 19, 2026.

• Three CVEs and the May 2026 Exploit Chain Nobody's Taking Seriously (nginx Rift)
  articleas toolsIt is written here as CISA Known Exploited Vulnerabilities (KEV) catalog.

  KEV