FR
ENLast updated:
CVEs published in 7 days
3,159
-37% vs previous 7 daysCritical severity
232
CVSS score 9.0 to 10Exploited vulnerabilities added (30 days)
32
CISA KEV catalogKnown ransomware use
361
of 1,760 in the catalogCVEs published per week
Last 12 seven-day periods, the most recent highlighted.
0
2K
4K
6K
View the data
| Period | CVE |
|---|---|
| Aug 5 – Aug 11 | 2,994 |
| Aug 12 – Aug 18 | 4,068 |
| Aug 19 – Aug 25 | 2,839 |
| Aug 26 – Sep 1 | 2,496 |
| Sep 2 – Sep 8 | 3,321 |
| Sep 9 – Sep 15 | 4,190 |
| Sep 16 – Sep 22 | 3,393 |
| Sep 23 – Sep 29 | 3,061 |
| Sep 30 – Oct 6 | 3,055 |
| Oct 7 – Oct 13 | 4,812 |
| Oct 14 – Oct 20 | 4,980 |
| Oct 21 – Oct 27 | 3,159 |
CVE severity (7 days)
Best available CVSS score (NVD or publisher).
Most targeted vendors (12 months)
Vulnerabilities added to the CISA KEV catalog (311 in total).
Latest actively exploited flaws
Recent additions to the CISA KEV catalog. The EPSS score estimates the probability of exploitation within 30 days.
| Added | CVE | Product | EPSS | Ransomware |
|---|---|---|---|---|
| Oct 27 | CVE-2026-48356 | Adobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 30.6% | Not reported |
| Oct 27 | CVE-2026-111497 | Google BrotliGoogle Brotli Unchecked Return Value Vulnerability | 55.5% | Not reported |
| Oct 26 | CVE-2026-109619 | PHP Group PHPPHP Stale Internal Request-State Vulnerability | 100% | Not reported |
| Oct 26 | CVE-2026-109618 | PHP Group PHPPHP Memory Corruption Vulnerability | 100% | Not reported |
| Oct 23 | CVE-2026-114625 | Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability | 1% | Not reported |
| Oct 23 | CVE-2026-110447 | Collabora Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability | 11.6% | Not reported |
| Oct 20 | CVE-2026-96656 | Plex Media ServerPlex Media Server External Control of File Name or Path Vulnerability | 1.8% | Not reported |
| Oct 20 | CVE-2026-96655 | Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 1.6% | Not reported |
Are your systems exposed?
A penetration test or security audit finds the exploitable flaws in your environment before attackers do.
Sources and method
- NVD (NIST) : CVEs published per 7-day period (UTC) and severity from the best available CVSS score (v4, then v3.1, v3.0, v2), whether assigned by NVD or by the organization that published the CVE.
- CISA KEV : catalog of vulnerabilities known to be exploited (version 2026.10.27).
- FIRST EPSS : probability of exploitation within 30 days (Oct 27).
This product uses data from the NVD API but is not endorsed or certified by the NVD.