https://patchfirst.co/technique/T1056/New and newly exploited CVEs that lead to ATT&CK T1056 Input Capture, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-48700/CVE-2025-48700#kevMon, 20 Apr 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1059.007 JavaScript. Priority 62.7 of 100.kevT1566.002T1056T1059.007https://patchfirst.co/cve/CVE-2024-42009/CVE-2024-42009#kevMon, 09 Jun 2025 00:00:00 GMTRoundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.kevpublic-exploitT1566.002T1056T1114https://patchfirst.co/cve/CVE-2020-8195/CVE-2020-8195#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1005 Data from Local System; T1082 System Information Discovery. Priority 77.2 of 100.kevpublic-exploitT1056T1005T1082https://patchfirst.co/cve/CVE-2020-8196/CVE-2020-8196#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 26.3% (higher than 98% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1082 System Information Discovery; T1005 Data from Local System. Priority 75.6 of 100.kevpublic-exploitT1056T1082T1005