Patchfirst
Patchfirst
CISA confirmed 10 new exploited vulnerabilities this week. 6 have public exploit code.

Exploited CVEs and the techniques used with them.

For security and IT teams deciding what to patch first.

All 398,633 CVEs, ranked by whether attackers are using them. For exploited ones: how attackers get in, what they do next, and how to detect it. Every fact shows its source.

See what to patch first Check your lockfile

Data from CISA KEV · FIRST EPSS · MITRE ATT&CK · updated 31 Oct 2026, 05:11 UTC

Exploited & likelyTop 10 with attack flows
  1. CVE-2025-55182Meta React Server Components Remote Code Execution Vulnerability
    Meta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter5 reports
    99.8%Top 0.04%
    95.0priority
  2. CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
    Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1133External Remote Services4 reports
    95.0%Top 0.14%
    93.3priority
  3. CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
    BeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports
    93.1%Top 0.17%
    91.0priority
  4. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    >99.9%Top 0.01%
    90.0priority
  5. CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports
    >99.9%Top 0.01%
    90.0priority
  6. CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
    Citrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 6 reports
    99.7%Top 0.05%
    89.9priority
  7. CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
    F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reports
    >99.9%Top 0.01%
    89.9priority
  8. CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
    Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more · 8 reports
    >99.9%Top 0.01%
    89.9priority
  9. CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability
    Fortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application5 reports
    >99.9%Top 0.01%
    89.9priority
  10. CVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
    JetBrains · TeamCityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    93.6%Top 0.16%
    89.8priority
CVE-2025-55182KEVRansomwarePublic exploit

Meta React Server Components Remote Code Execution Vulnerability

Priority 95.0 · EPSS 99.8%
Attack flow
  1. ExploitationExploit Public-Facing Application
  2. Primary impactCommand and Scripting Interpreter

See all exploited CVEs

Exploited this month

Most recent additions to , the list of vulnerabilities confirmed as exploited.

CVE-2026-111357 Ivanti · Connect Secure Added to KEV 15 days after disclosure CVE-2026-118527 Ivanti · Connect Secure Added to KEV on disclosure day CVE-2026-97229Public exploit GitLab · Community Edition and Enterprise Edition Added to KEV 16 days after disclosure CVE-2026-76418 Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software Added to KEV 1 day after disclosure CVE-2026-46300Public exploit Linux · Kernel Added to KEV 158 days after disclosure CVE-2026-41709 Broadcom · VMware ESX Added to KEV 90 days after disclosure CVE-2026-111497Public exploit Google · Brotli Added to KEV 5 days after disclosure CVE-2026-48356Public exploit Adobe · Commerce and Magento Added to KEV 105 days after disclosure CVE-2026-109618Public exploit PHP Group · PHP Added to KEV 5 days after disclosure CVE-2026-109619Public exploit PHP Group · PHP Added to KEV 5 days after disclosure CVE-2026-110447Public exploit Collabora · Collabora Online – Built-in CODE Server Added to KEV 9 days after disclosure CVE-2026-114625Public exploit Arista · VeloCloud Orchestrator Added to KEV 1 day after disclosure
CVE-2026-96656Public exploit Plex · Media Server Added to KEV 27 days after disclosure CVE-2026-96652Public exploit Plex · Media Server Added to KEV 27 days after disclosure CVE-2026-106931 EG Secure Solutions · SiteGuard Server Edition Added to KEV 6 days after disclosure CVE-2026-96654 Plex · Media Server Added to KEV 27 days after disclosure CVE-2026-96655 Plex · Media Server Added to KEV 27 days after disclosure CVE-2026-110936 Siemens · Software Center Added to KEV 5 days after disclosure CVE-2026-102764Public exploit BeyondTrust · Remote Support Added to KEV 1 day after disclosure CVE-2025-61624 Fortinet · Multiple Products Added to KEV 185 days after disclosure CVE-2026-21589Public exploit Atlassian · Multiple Products Added to KEV 10 days after disclosure CVE-2026-105134Public exploit Ahsay · AhsayCBS Added to KEV 10 days after disclosure CVE-2026-105133Public exploit Ahsay · AhsayCBS Added to KEV 10 days after disclosure CVE-2026-76519Public exploit Cisco · Secure Email Gateway Added to KEV on disclosure day

Patch these first

Highest-priority CVEs added to CISA KEV in the last 30 days, with their ATT&CK techniques.

CVE-2026-110447KEVPublic exploitCritical · 9.8

Collabora Collabora Online – Built-in CODE Server

The Built-in CODE Server of Collabora Online, a component of the richdocumentscode Nextcloud app, is affected by an OS command injection flaw in proxy.php that exists in versions before 26.4.303. Standalone Collabora Online servers are not affected; the issue arises only in this CODE Server deployment and when the CODE server is not running, such as shortly after a restart, and an attacker with only network access and no authentication or user interaction can execute commands on the server.

9days from disclosure to CISA KEV
Attack flow
  1. ExploitationExploit Public-Facing Application
  2. Primary impactCommand and Scripting Interpreter
Priority 89.4Full evidence
CVE-2026-109618KEVPublic exploitCritical · 9.8

PHP Group PHP

A memory corruption flaw in PHP's request handling lets out-of-memory conditions, which are handled via longjmp(), leave request memory uninitialized before a later allocation, and the cleanup routine then reads or branches on that memory. An unauthenticated remote attacker with network access can trigger this without user interaction by using one of several out-of-memory strategies that consistently reproduce the condition, potentially achieving remote code execution.

5days from disclosure to CISA KEV
Attack flow
  1. ExploitationExploit Public-Facing Application
  2. Primary impactCommand and Scripting Interpreter
Priority 79.9Full evidence
CVE-2026-105134KEVPublic exploitCritical · 10.0

Ahsay AhsayCBS

AhsayCBS (up to 9.15.2.69 and 10.3.4.44) has a command injection flaw in the Replication Receiver component, specifically in the file /rps/api/json/UpdateReceivers.do, where the random argument is not properly neutralised before being passed to the operating system. An attacker with remote network access and no authentication or user interaction can manipulate that argument to execute arbitrary OS commands on the affected server.

10days from disclosure to CISA KEV
Attack flow
  1. ExploitationExploit Public-Facing Application
  2. Primary impactCommand and Scripting Interpreter
Priority 79.9Full evidence

Trending ATT&CK techniques

from linked to CISA KEV additions in the last 90 days, compared with the previous 90 days.

Last 90 daysPrevious 90 days
  1. 1 Exploit Public-Facing ApplicationT1190 76 +28
  2. 2 Command and Scripting InterpreterT1059 53 +22
  3. 3 Valid AccountsT1078 21 +12
  4. 4 Exploitation for Privilege EscalationT1068 18 +10
  5. 5 Data from Local SystemT1005 8 ±0
  6. 6 Application or System ExploitationT1499.004 7 +6
  7. 7 Drive-by CompromiseT1189 4 -1
  8. 8 ProxyT1090 3 +2
Open the ATT&CK matrix

Time from disclosure to KEV listing

Days from CVE publication to CISA KEV listing. KEV listing is the date exploitation was confirmed, not the first attack.

14 days

Median days to KEV in 2026, across 279 KEV additions. 2025: 30 days. A quarter were listed within 1 day.

2021median days by year · peak 14842026
More in Insights
Last 12 weeks104 KEV additions
10 Aug 2026FewerMoreToday

Vendors with the most KEV additions

CISA KEV additions in the last 90 days.

#1 Microsoft 8exploited SharePoint, SQL Server T1059Command and Scripting Interpreter #2 Cisco 7exploited Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, Identity Services Engine T1190Exploit Public-Facing Application #3 Linux 6exploited Kernel T1068Exploitation for Privilege Escalation #4 Citrix 5exploited NetScaler, NetScaler ADC and NetScaler Gateway T1190Exploit Public-Facing Application #5 Google 4exploited Brotli, Chromium V8 T1059Command and Scripting Interpreter

MCP server

Query Patchfirst from Claude Code, Cursor or Codex over MCP: look up a CVE, list exploited CVEs, or check a lockfile.

sh
claude mcp add --transport http patchfirst https://patchfirst.co/mcp

How claims are sourced

Each claim carries one of four provenance badges. Badges are never upgraded.

  1. SourceCISA KEV, NVD, EPSS, MITRE CTID, threat reports
  2. EvidenceThe mapping, or the quoted passage, linked to the original
  3. BadgeShown next to the claim, on every page and in the API
  • Copied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset.
  • Found by keyword or pattern matching over threat-report text.
  • Written by a language model from the source data on this page.
  • Confirmed by a named reviewer in Patchfirst's review workflow.

Tools

Check a lockfile, subscribe to a feed, or load the techniques into ATT&CK Navigator.

Stack checkCheck a lockfile for vulnerable dependencies. Runs in your browser.Check a lockfile Watch feedsRSS and JSON feeds for KEV additions, a vendor or an ATT&CK technique.Pick a feed ATT&CK heatmapThe ATT&CK techniques linked to known CVEs, shaded by CVE priority, in MITRE's ATT&CK Navigator. Load it next to your detection coverage to find gaps.Open in Navigator ↗
↑ ↓ chooseEnter openEsc close