https://patchfirst.co/technique/T1528/New and newly exploited CVEs that lead to ATT&CK T1528 Steal Application Access Token, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-42018/CVE-2026-42018#kevFri, 11 Sep 2026 00:00:00 GMTJFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1528 Steal Application Access Token. Priority 77.4 of 100.kevpublic-exploitT1190T1528https://patchfirst.co/cve/CVE-2026-45321/CVE-2026-45321#kevWed, 27 May 2026 00:00:00 GMTTanStack · TanStack. In CISA KEV since 2026-05-27, known ransomware use. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.4% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1528 Steal Application Access Token. Named in 1 threat report. Priority 86.3 of 100.kevransomwarepublic-exploitT1195.002T1528https://patchfirst.co/cve/CVE-2024-38475/CVE-2024-38475#kevThu, 01 May 2025 00:00:00 GMTApache · HTTP Server. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1528 Steal Application Access Token. Priority 69.4 of 100.kevpublic-exploitT1190T1005T1059T1528https://patchfirst.co/cve/CVE-2020-0884/CVE-2020-0884Thu, 12 Mar 2020 00:00:00 GMTMicrosoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8). Not in CISA KEV. EPSS 1.7% (higher than 76.8% of CVEs). ATT&CK: T1040 Network Sniffing; T1528 Steal Application Access Token. Priority 15.4 of 100.T1040T1528