Threat feed · CISA KEV 2026.11.06FIRST EPSS · hourly

Exploited now.Patch these first.

Every CVE here is on CISA's Known Exploited Vulnerabilities catalog: there is evidence attackers are using it. This page ranks the latest 100 by ransomware use, the EPSS exploit forecast and how recently CISA added them. The rules are printed under the list, and every CVE has its own page with the sources.

the numberschecked Nov 8, 2026, 4:51 PM UTC

added in the last 7 days

labelled patch now

with known ransomware use

in the whole catalog

1,769

the listnewest first · 100

Exploited CVEs100 of 1,769 in the catalog

Sources: CISA Known Exploited Vulnerabilities catalog (version 2026.11.06) and FIRST EPSS. Pulled hourly, last checked Nov 8, 2026, 4:51 PM. CISA catalog · EPSS · Atom feed

how the labels work

Three labels, all from public data.

Patch now: CISA reports known ransomware use, or EPSS is 50% or higher, or CISA added it in the last 7 days.
This week: CISA added it in the last 30 days, or EPSS is 10% or higher.
Next cycle: Everything else. Still exploited in the wild, just lower in the queue.

EPSS is FIRST's daily estimate of the probability that a CVE is exploited in the next 30 days. The federal deadline on each page binds US federal civilian agencies only.