Vulnerability Management
CISA KEV, FIRST EPSS, Microsoft Patch Tuesday and NVD data in one ranked list. Each CVE gets an EVULNABLE Risk Score (EVRS) from 0 to 100 for how soon to act.
Tracked CVEs2,960CISA KEV plus Microsoft Patch Tuesday
Exigent361Immediate band with every strong signal at once
Ransomware-linked244Known ransomware use, per CISA
New in CISA KEV, 30 days35Added to the catalog since 22 Sep
Top 10 by EVRS
of 2,960 tracked All 10: CISA KEV Ransomware Exigent| # | CVE · title | EVRS | CVSS | EPSS | In KEV since | CISA deadline |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-55182Meta — Meta React Server Components Remote Code Execution VulnerabilityCISA federal deadline · Overdue by 10 months | 97 | 10.0 | 99.8% · 99.96th | 2025-12-05 | 2025-12-12CISA federal deadline · Overdue by 10 months |
| 2 | CVE-2026-35273Oracle — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 4 months | 96 | 9.8 | 96.7% · 99.89th | 2026-06-12 | 2026-06-15CISA federal deadline · Overdue by 4 months |
| 3 | CVE-2025-3248Langflow — Langflow Missing Authentication VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.99th | 2025-05-05 | 2025-05-26KEV since 2025 · listed over a year |
| 4 | CVE-2025-22457Ivanti — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.98th | 2025-04-04 | 2025-04-11KEV since 2025 · listed over a year |
| 5 | CVE-2025-31161CrushFTP — CrushFTP Authentication Bypass VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.98th | 2025-04-07 | 2025-04-28KEV since 2025 · listed over a year |
| 6 | CVE-2025-10035Fortra — Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.8% · 99.96th | 2025-09-29 | 2025-10-20KEV since 2025 · listed over a year |
| 7 | CVE-2025-61882Oracle — Oracle E-Business Suite Unspecified VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.7% · 99.95th | 2025-10-06 | 2025-10-27KEV since 2025 · listed over a year |
| 8 | CVE-2025-31324SAP — SAP NetWeaver Unrestricted File Upload VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.5% · 99.94th | 2025-04-29 | 2025-05-20KEV since 2025 · listed over a year |
| 9 | CVE-2026-41940WebPros — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 6 months | 95 | 9.3 | 98.5% · 99.92nd | 2026-04-30 | 2026-05-03CISA federal deadline · Overdue by 6 months |
| 10 | CVE-2026-23760SmarterTools — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 8 months | 95 | 9.3 | 96.4% · 99.88th | 2026-01-26 | 2026-02-16CISA federal deadline · Overdue by 8 months |
Ranked by EVRS, then EPSS. Rows 11–2,960 are on the Priority Feed.Open Priority Feed →
CISA KEV additions per week
Last 26 weeks · 27 Apr – 19 Oct; busiest week: 14 added.- Added to KEV
- Ransomware-linked (part of the bar)
- This week so far (6)
| Week of | Added | Ransomware-linked |
|---|---|---|
| 2026-04-27 | 4 | 2 |
| 2026-05-04 | 3 | 0 |
| 2026-05-11 | 2 | 0 |
| 2026-05-18 | 10 | 0 |
| 2026-05-25 | 5 | 3 |
| 2026-06-01 | 5 | 0 |
| 2026-06-08 | 7 | 2 |
| 2026-06-15 | 4 | 0 |
| 2026-06-22 | 6 | 1 |
| 2026-06-29 | 2 | 1 |
| 2026-07-06 | 6 | 0 |
| 2026-07-13 | 10 | 2 |
| 2026-07-20 | 6 | 0 |
| 2026-07-27 | 3 | 1 |
| 2026-08-03 | 6 | 1 |
| 2026-08-10 | 3 | 0 |
| 2026-08-17 | 9 | 1 |
| 2026-08-24 | 11 | 0 |
| 2026-08-31 | 10 | 0 |
| 2026-09-07 | 14 | 0 |
| 2026-09-14 | 7 | 0 |
| 2026-09-21 | 12 | 0 |
| 2026-09-28 | 6 | 0 |
| 2026-10-05 | 5 | 0 |
| 2026-10-12 | 9 | 0 |
| 2026-10-19 (so far) | 6 | 0 |