Skip to content
eastbaycyber
Data

CISA KEV Velocity Dashboard

How fast are actively exploited CVEs accumulating? This dashboard tracks the CISA Known Exploited Vulnerabilities catalog: monthly addition velocity, vendor concentration, and the share of entries tied to known ransomware campaigns. Rebuilt automatically on every site deploy.

Catalog snapshot: 2026-10-15 · 1745 entries · Source: CISA KEV Catalog · By vendor · RSS · JSON feed

Total KEV entries
1,745
Added, last 30 days
35
▼ -10 vs prior period
Added, last 90 days
98
▲ +20 vs prior period
Ransomware-linked
10%
of entries added in the last 12 months

How old are CVEs when exploitation is confirmed?

212
Same year
37
1 year old
25
2-4 years old
30
5+ years old

18% of KEV entries added in the last 12 months are CVEs from 2+ years ago (by CVE ID year): old, unpatched vulnerabilities keep getting exploited long after disclosure.

Additions per month, last 24 months

2024-11: 22 added2224/112024-12: 16 added162025-01: 14 added142025-02: 27 added2725/022025-03: 32 added322025-04: 15 added152025-05: 24 added2425/052025-06: 20 added202025-07: 20 added202025-08: 15 added1525/082025-09: 16 added162025-10: 31 added312025-11: 11 added1125/112025-12: 20 added202026-01: 17 added172026-02: 28 added2826/022026-03: 26 added262026-04: 31 added312026-05: 21 added2126/052026-06: 23 added232026-07: 26 added262026-08: 31 added3126/082026-09: 43 added432026-10: 15 added15

Most-listed vendors, last 12 months

VendorKEV entries
Microsoft44
Cisco20
Fortinet11
Apple11
Google10
Linux8
Adobe7
Ivanti6
Citrix6
Oracle6

Reading the numbers

A CVE only enters the KEV catalog once CISA confirms active exploitation in the wild, so the monthly addition rate is a floor on real-world exploitation activity, not a count of disclosed vulnerabilities.

Federal agencies must remediate each entry by its CISA due date under BOD 22-01; most organizations treat KEV listing as a patch-now signal regardless of CVSS score.

Vendor concentration reflects both install base and attacker focus. A vendor appearing here repeatedly is a prioritization signal for patch management programs.

Latest 25 KEV additions

CVEVulnerabilityVendor / productAddedRansomware
CVE-2026-105134Ahsay AhsayCBS Command Injection VulnerabilityAhsay AhsayCBS2026-10-14No
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco Secure Email Gateway2026-10-14No
CVE-2026-105133Ahsay AhsayCBS Improper Authentication VulnerabilityAhsay AhsayCBS2026-10-14No
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS2026-10-14No
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti Connect Secure2026-10-13No
CVE-2026-96951Microsoft Windows Command Injection VulnerabilityMicrosoft Windows2026-10-13No
CVE-2015-5477 ISC BIND Data Processing Errors VulnerabilityISC BIND2026-10-08No
CVE-2016-3081Apache Struts Command Injection VulnerabilityApache Struts2026-10-08No
CVE-2023-22894Strapi Cleartext Storage of Sensitive Information VulnerabilityStrapi Strapi2026-10-08No
CVE-2021-3199ONLYOFFICE Docs Server Path Traversal VulnerabilityONLYOFFICE Docs2026-10-08No
CVE-2015-3306ProFTPD Improper Access Control VulnerabilityProFTPD ProFTPD2026-10-08No
CVE-2026-88779Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VCitrix NetScaler2026-10-04No
CVE-2026-102490Zammad GmbH Zammad Improper Privilege Management VulnerabilityZammad GmbH Zammad2026-10-02No
CVE-2026-102489Zammad GmbH Zammad Session Fixation VulnerabilityZammad GmbH Zammad2026-10-02No
CVE-2026-104286Fortinet FortiMail Path Traversal VulnerabilityFortinet FortiMail2026-10-01No
CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCisco Catalyst SD-WAN Manager2026-09-30No
CVE-2026-86950Apple Multiple Products Out-of-Bounds Write VulnerabilityApple Multiple Products2026-09-29No
CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VCitrix NetScaler2026-09-27No
CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityCitrix NetScaler2026-09-27No
CVE-2026-67279Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityMikroTik RouterOS2026-09-25No
CVE-2026-65660Microsoft SharePoint Code Injection VulnerabilityMicrosoft SharePoint2026-09-25No
CVE-2026-87902WordPress Core Remote File Inclusion VulnerabilityWordPress Core2026-09-25No
CVE-2026-5430WSO2 Multiple Products Path Traversal Vulnerability WSO2 Multiple Products2026-09-24No
CVE-2026-71362Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe Commerce and Magento 2026-09-24No
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista VeloCloud Orchestrator2026-09-22No

CVE links go to our explainer when one exists, otherwise to the NVD record.

Methodology & reuse

Data is the official CISA Known Exploited Vulnerabilities catalog, fetched at build time; this page regenerates on every deploy (multiple times daily). Charts and figures may be reused with attribution to East Bay Cyber and CISA. Snapshot date: 2026-10-15.