threat feedCISA KEV · FIRST EPSS · hourly

Exploited now. Ranked by what to patch first.

Every CVE here is on CISA's Known Exploited Vulnerabilities catalog: there is evidence attackers are using it. This page ranks the latest 100 by ransomware use, the EPSS exploit forecast and how recently CISA added them. The rules are printed under the list, and every CVE has its own page with the sources.

added in the last 7 days

labelled patch now

with known ransomware use

1,756

in the whole catalog

the listnewest first · 100

Sources: CISA Known Exploited Vulnerabilities catalog (version 2026.10.23) and FIRST EPSS. Pulled hourly, last checked Oct 26, 2026, 11:36 AM. CISA catalog · EPSS · Atom feed

how the labels work

Three labels, all from public data.

Patch now: CISA reports known ransomware use, or EPSS is 50% or higher, or CISA added it in the last 7 days.
This week: CISA added it in the last 30 days, or EPSS is 10% or higher.
Next cycle: Everything else. Still exploited in the wild, just lower in the queue.

EPSS is FIRST's daily estimate of the probability that a CVE is exploited in the next 30 days. The federal deadline on each page binds US federal civilian agencies only.