Threat intelligence for defenders · updated hourly
Threat overview
What is exploited, what just got weaponized and what is likely next; which threat actors use it, who they target and how to detect them. Every CVE gets a patch priority, every link shows its evidence. Rebuilt hourly from CISA, NVD, FIRST, MITRE ATT&CK, MISP, Metasploit, ExploitDB, Nuclei, Sigma, ransomlook.io and Have I Been Pwned.
Analyst briefing
Last 7 days, built from the data below- Patch firstCISA added no new exploited vulnerabilities this week.
- Weaponized0 CVEs gained new public exploit code this week.
- Ransomware0 victims posted this week, no comparison yet.
Exploited per week
CISA KEV · 26 weeksTable
| Period | added |
|---|---|
| Week of 2026-04-27 | 0 |
| Week of 2026-05-04 | 0 |
| Week of 2026-05-11 | 0 |
| Week of 2026-05-18 | 0 |
| Week of 2026-05-25 | 0 |
| Week of 2026-06-01 | 0 |
| Week of 2026-06-08 | 0 |
| Week of 2026-06-15 | 0 |
| Week of 2026-06-22 | 0 |
| Week of 2026-06-29 | 0 |
| Week of 2026-07-06 | 0 |
| Week of 2026-07-13 | 0 |
| Week of 2026-07-20 | 0 |
| Week of 2026-07-27 | 0 |
| Week of 2026-08-03 | 0 |
| Week of 2026-08-10 | 0 |
| Week of 2026-08-17 | 0 |
| Week of 2026-08-24 | 0 |
| Week of 2026-08-31 | 0 |
| Week of 2026-09-07 | 0 |
| Week of 2026-09-14 | 0 |
| Week of 2026-09-21 | 0 |
| Week of 2026-09-28 | 0 |
| Week of 2026-10-05 | 0 |
| Week of 2026-10-12 | 0 |
| Week of 2026-10-19 | 0 |
New CVEs per day
Last 7 days- Critical
- Other
Table
| Period | CVEs | Critical |
|---|---|---|
| 2026-10-18 | 0 | 0 |
| 2026-10-19 | 0 | 0 |
| 2026-10-20 | 0 | 0 |
| 2026-10-21 | 0 | 0 |
| 2026-10-22 | 0 | 0 |
| 2026-10-23 | 0 | 0 |
| 2026-10-24 | 0 | 0 |
Exploit coverage
All CVEsOnly 0% of all CVEs are ever confirmed exploited. That is why ranking by exploit evidence beats ranking by CVSS.
Countries targeted by tracked actors
0 actorsRansomware, 30 days
0 victimsTable
| Period | victims |
|---|---|
| 2026-09-25 | 0 |
| 2026-09-26 | 0 |
| 2026-09-27 | 0 |
| 2026-09-28 | 0 |
| 2026-09-29 | 0 |
| 2026-09-30 | 0 |
| 2026-10-01 | 0 |
| 2026-10-02 | 0 |
| 2026-10-03 | 0 |
| 2026-10-04 | 0 |
| 2026-10-05 | 0 |
| 2026-10-06 | 0 |
| 2026-10-07 | 0 |
| 2026-10-08 | 0 |
| 2026-10-09 | 0 |
| 2026-10-10 | 0 |
| 2026-10-11 | 0 |
| 2026-10-12 | 0 |
| 2026-10-13 | 0 |
| 2026-10-14 | 0 |
| 2026-10-15 | 0 |
| 2026-10-16 | 0 |
| 2026-10-17 | 0 |
| 2026-10-18 | 0 |
| 2026-10-19 | 0 |
| 2026-10-20 | 0 |
| 2026-10-21 | 0 |
| 2026-10-22 | 0 |
| 2026-10-23 | 0 |
| 2026-10-24 | 0 |
Victim sectors (estimated from descriptions): .
Weaponized this week
All 0- Nothing moved this week yet.
Likely next
Ranking- No candidates yet.
Newly exploited
All 0How to read this page
- P1 to P4
- Our patch priority. P1 patch now: confirmed exploited in the wild (CISA KEV, or CISA reports active exploitation). P2 this week: a Metasploit module or Nuclei template exists, it ranks in the top 25 likely next, or EPSS is 50% or more. P3 schedule: public exploit code, EPSS 10% or more, or CVSS 9+. P4 routine: no exploitation signal yet. The reason is always shown next to the label.
- Weaponization ladder
- Five squares, left to right: GitHub PoC, ExploitDB entry, Nuclei template, Metasploit module, exploited in the wild (red). Each step lowers the skill needed to attack: a Nuclei template means anyone can scan the internet for it, a Metasploit module means anyone can exploit it with one command.
- EPSS
- FIRST's Exploit Prediction Scoring System: the estimated probability that a CVE is exploited in the next 30 days, from observed attack data. The percentile compares it with every other CVE. It measures likelihood, not impact.
- KEV
- CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of exploitation in the wild. The due date is binding for US federal agencies and a useful upper limit for everyone else.
- Likely next
- CVEs outside KEV ranked by signals that usually come before exploitation. Each entry into the top 25 is logged, and the track record counts how many CISA later confirmed.