Last updated: October 27, 2026 · Data from the last 30 days ·
Updated daily at 21:00 UTC
Exploitation Activity — Last 30 Days
Daily count of new CVEs added to the CISA Known Exploited Vulnerabilities catalog
and ransomware victims tracked by Ransomware.live. Taller bars mean busier days —
use this to spot clusters and decide whether your team is in a high-tempo period.
134 new KEVs and 5,314 ransomware victims recorded in this window.
New KEVs per Day
Ransomware Victims per Day
EPSS Movement Tracker
CVEs whose exploitation probability (EPSS) has increased the most since they were
first published on ThreatPodium. EPSS is a daily probability score from FIRST.org
estimating the likelihood of exploitation within 30 days. A large jump means
attacker tooling or active scanning has increased — these are the CVEs trending
toward confirmed exploitation before the KEV catalog catches up.
Showing 15 CVEs with a movement of
5 percentage points or more.
| CVE | Vendor / Product | First EPSS | Current EPSS | Change |
|---|---|---|---|---|
| CVE-2026-71362 | Adobe Commerce and Magento | 2.3% | 87.5% | +85.2pp |
| CVE-2026-59310 | Broadcom VMware vCenter | 1.1% | 45.9% | +44.8pp |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 35.9% | 75.8% | +39.9pp |
| CVE-2026-34486 | Apache Tomcat | 42.6% | 81.2% | +38.6pp |
| CVE-2023-49105 | ownCloud ownCloud | 11.1% | 43.2% | +32.1pp |
| CVE-2026-93616 | Check Point Multiple Products | 2.4% | 19.7% | +17.3pp |
| CVE-2026-87902 | WordPress Core | 2.9% | 19.8% | +16.9pp |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions | 55.9% | 72.7% | +16.9pp |
| CVE-2026-64849 | MLflow MLflow | 1.1% | 16.4% | +15.3pp |
| CVE-2026-9198 | IBM Langflow | 1.9% | 17.1% | +15.2pp |
| CVE-2026-8037 | Progress LoadMaster | 84.8% | 99.3% | +14.5pp |
| CVE-2021-3199 | ONLYOFFICE Docs | 8.2% | 19.4% | +11.2pp |
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | 1.2% | 12.3% | +11.1pp |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | 1.1% | 12.0% | +10.9pp |
| CVE-2026-9586 | Sangoma Switchvox | 1.1% | 11.8% | +10.7pp |
Vendor Risk Leaderboard — Last 30 Days
Vendors ranked by cumulative KEV exposure over the last 30 days.
A vendor at the top of this list has had actively exploited vulnerabilities confirmed
by CISA repeatedly — not just in a single busy week. The “Days with KEV Activity”
column shows consistency: a vendor appearing on 8 of 30 days is a structural
concern worth continuous monitoring, not just a one-off patch event.
| # | Vendor | Total KEVs (30d) | Days with KEV Activity |
|---|---|---|---|
| 1 | Citrix | 14 | 10 |
| 2 | Plex | 14 | 5 |
| 3 | Fortinet | 10 | 10 |
| 4 | Zammad Gmbh | 10 | 5 |
| 5 | Cisco | 9 | 9 |
| 6 | Microsoft | 6 | 6 |
| 7 | Eg Secure Solutions | 5 | 5 |
| 8 | Siemens | 5 | 5 |
| 9 | Apple | 4 | 4 |
| 10 | Strapi | 4 | 4 |