Security — Exploited & Patch Tuesday
KEV & Patch Tuesday
CISA's Known Exploited Vulnerabilities catalogue — 1,766 entries confirmed under attack in the real world — tracked against Microsoft's second-Tuesday release cadence. Sorted by what has a deadline attached, because a KEV listing you have already blown the date on is not a reading item.
was the previous second Tuesday, 20 days ago. CISA has added 27 vulnerabilities to the exploited catalogue since then, 1 of them Microsoft.
- CVE-2026-96951Windows
KEV is CISA's exploited-in-the-wild catalogue, not Microsoft's release manifest — this is what became known-exploited in the window, not the size of the patch drop. We do not have a source for the latter, so we do not print a number for it.
Vendor concentrationlast 90 days · 109 additions
Most recent additionsnewest 15
| CVE | Vendor / product | Vulnerability | Added | CISA due date |
|---|---|---|---|---|
| CVE-2026-111357 | IvantiConnect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | 02 Nov 2026due today | |
| CVE-2026-118527 | IvantiConnect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | 13 Nov 202611d left | |
| CVE-2026-76418 | CiscoSecure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | 01 Nov 20261d overdue | |
| CVE-2026-97229 | GitLabCommunity Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | 01 Nov 20261d overdue | |
| CVE-2026-41709 | BroadcomVMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | 11 Nov 20269d left | |
| CVE-2026-46300 | LinuxKernel | Linux Kernel Missing Initialization of a Variable Vulnerability | 31 Oct 20262d overdue | |
| CVE-2026-111497 | GoogleBrotli | Google Brotli Unchecked Return Value Vulnerability | 10 Nov 20268d left | |
| CVE-2026-48356 | AdobeCommerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 10 Nov 20268d left | |
| CVE-2026-109618 | PHP GroupPHP | PHP Memory Corruption Vulnerability | 29 Oct 20264d overdue | |
| CVE-2026-109619 | PHP GroupPHP | PHP Stale Internal Request-State Vulnerability | 29 Oct 20264d overdue | |
| CVE-2026-110447 | CollaboraCollabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 26 Oct 20267d overdue | |
| CVE-2026-114625 | AristaVeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | 26 Oct 20267d overdue | |
| CVE-2026-106931 | EG Secure SolutionsSiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | 23 Oct 202610d overdue | |
| CVE-2026-110936 | SiemensSoftware Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability | 03 Nov 20261d left | |
| CVE-2026-96652 | PlexMedia Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 03 Nov 20261d left |
Due dates are CISA's binding operational directive deadlines for federal civilian agencies. Everyone else should read them as the date the exploitation curve is expected to have peaked.