KEV tracker · catalog version 2026.11.06

CISA KEV catalog tracker: every known exploited vulnerability, counted daily

Name: CISA KEV Catalog Tracker: Known Exploited Vulnerabilities, Updated Daily
Creator: Daily CISO

The CISA KEV catalog is the Cybersecurity and Infrastructure Security Agency’s public list of software vulnerabilities that have been exploited in the wild. As of catalog version 2026.11.06, released November 6, 2026, it lists 1,769 vulnerabilities from 291 vendors and projects, and CISA added 30 of them in the 30 days ending November 8, 2026.

Updated November 8, 2026

By email, once a week

Get the week’s briefings on Friday

Unsubscribe any time.

entries in the catalog: 1,769
added in the 7 days to Nov 8: 3
added in the 90 days to Nov 8: 107
marked known ransomware use: 361

Built by Daily CISO from CISA’s own KEV JSON feed; not an official CISA page. Snapshot taken November 8, 2026. Each row links to the CVE’s NVD record and to CISA’s catalog. For what the catalog is and how the federal deadlines work, read what CISA KEV is and how CISOs use it; for the newest additions with FIRST.org EPSS scores, see must-patch now; for how long each flaw was public before CISA confirmed exploitation, see exploit lag; for every guide and glossary term on this subject in one place, see the patch and vulnerability management hub.

Additions per day, 90 days to Nov 8

Aug 11107 additions on 45 days; busiest day 7Nov 8

The 120 newest additions

Added November 6, 2026
CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall · SonicOS SSLVPN
Due November 20, 2026
Added November 4, 2026
CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability
Apple · Multiple Products
Due November 18, 2026
Added November 3, 2026
CVE-2026-119977 WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress · WordPress Core
Due November 6, 2026
Added October 30, 2026
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti · Connect Secure
Due November 13, 2026
Added October 30, 2026
CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti · Connect Secure
Due November 2, 2026
Added October 29, 2026
CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab · Community Edition and Enterprise Edition
Due November 1, 2026
Added October 29, 2026
CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software
Due November 1, 2026
Added October 28, 2026
CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
Linux · Kernel
Due October 31, 2026
Added October 28, 2026
CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom · VMware ESX
Due November 11, 2026
Added October 27, 2026
CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe · Commerce and Magento
Due November 10, 2026
Added October 27, 2026
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Google · Brotli
Due November 10, 2026
Added October 26, 2026
CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
PHP Group · PHP
Due October 29, 2026
Added October 26, 2026
CVE-2026-109618 PHP Memory Corruption Vulnerability
PHP Group · PHP
Due October 29, 2026
Added October 23, 2026
CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista · VeloCloud Orchestrator
Due October 26, 2026
Added October 23, 2026
CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora · Collabora Online – Built-in CODE Server
Due October 26, 2026
Added October 20, 2026
CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
Plex · Media Server
Due October 23, 2026
Added October 20, 2026
CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex · Media Server
Due November 3, 2026
Added October 20, 2026
CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex · Media Server
Due October 23, 2026
Added October 20, 2026
CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex · Media Server
Due November 3, 2026
Added October 20, 2026
CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens · Software Center
Due November 3, 2026
Added October 20, 2026
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions · SiteGuard Server Edition
Due October 23, 2026
Added October 16, 2026
CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support
Due October 19, 2026
Added October 16, 2026
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
Fortinet · Multiple Products
Due October 19, 2026
Added October 15, 2026
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products
Due October 18, 2026
Added October 14, 2026
CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco · Secure Email Gateway
Due October 17, 2026
Added October 14, 2026
CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBS
Due October 17, 2026
Added October 14, 2026
CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay · AhsayCBS
Due October 17, 2026
Added October 14, 2026
CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks · PAN-OS
Due October 17, 2026
Added October 13, 2026
CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
Microsoft · Windows
Due October 16, 2026
Added October 13, 2026
CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect Secure
Due October 16, 2026
Added October 8, 2026
CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi · Strapi
Due October 11, 2026
Added October 8, 2026
CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs
Due October 11, 2026
Added October 8, 2026
CVE-2016-3081 Apache Struts Command Injection Vulnerability
Apache · Struts
Due October 11, 2026
Added October 8, 2026
CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability
ISC · BIND
Due October 11, 2026
Added October 8, 2026
CVE-2015-3306 ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD
Due October 11, 2026
Added October 4, 2026
CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler
Due October 7, 2026
Added October 2, 2026
CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH · Zammad
Due October 5, 2026
Added October 2, 2026
CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH · Zammad
Due October 5, 2026
Added October 1, 2026
CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
Fortinet · FortiMail
Due October 4, 2026
Added September 30, 2026
CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco · Catalyst SD-WAN Manager
Due October 3, 2026
Added September 29, 2026
CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple · Multiple Products
Due October 13, 2026
Added September 27, 2026
CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler
Due September 30, 2026
Added September 27, 2026
CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability
Citrix · NetScaler
Due September 30, 2026
Added September 25, 2026
CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability
WordPress · Core
Due September 28, 2026
Added September 25, 2026
CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
MikroTik · RouterOS
Due September 28, 2026
Added September 25, 2026
CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability
Microsoft · SharePoint
Due September 28, 2026
Added September 24, 2026
CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe · Commerce and Magento
Due September 27, 2026
Added September 24, 2026
CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
WSO2 · Multiple Products
Due September 27, 2026
Added September 22, 2026
CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 · BIG-IP APM
Due September 25, 2026
Added September 22, 2026
CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista · VeloCloud Orchestrator
Due September 25, 2026
Added September 22, 2026
CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability
Check Point · Multiple Products
Due September 25, 2026
Added September 22, 2026
CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point · Multiple Products
Due September 25, 2026
Added September 21, 2026
CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel · GS1900 Series Switches
Due September 24, 2026
Added September 18, 2026
CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability
Linux · Kernel
Due September 21, 2026
Added September 18, 2026
CVE-2025-39964 Linux Kernel Race Condition Vulnerability
Linux · Kernel
Due September 21, 2026
Added September 18, 2026
CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux · Kernel
Due September 21, 2026
Added September 16, 2026
CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability
Acronis · Backup
Due September 19, 2026
Added September 16, 2026
CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco · Identity Services Engine
Due September 19, 2026
Added September 16, 2026
CVE-2026-58704 Google Pixel Improper Authorization Vulnerability
Google · Pixel
Due September 19, 2026
Added September 14, 2026
CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco · Secure Email Gateway
Due September 17, 2026
Added September 11, 2026
CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab · Community Edition and Enterprise Edition
Due September 14, 2026
Added September 11, 2026
CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise · ScreenConnect
Due September 14, 2026
Added September 11, 2026
CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
JFrog · Artifactory
Due September 25, 2026
Added September 11, 2026
CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability
JFrog · Artifactory
Due September 25, 2026
Added September 10, 2026
CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik · RouterOS
Due September 13, 2026
Added September 10, 2026
CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
MikroTik · RouterOS
Due September 13, 2026
Added September 9, 2026
CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability
Google · Chromium V8
Due September 23, 2026
Added September 9, 2026
CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Due September 12, 2026
Added September 9, 2026
CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix · NetScaler
Due September 12, 2026
Added September 9, 2026
CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Fortinet · Multiple Products
Due September 12, 2026
Added September 8, 2026
CVE-2026-86218 N-able N-central Static Code Injection Vulnerability
N-able · N-central
Due September 11, 2026
Added September 8, 2026
CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Microsoft · Windows
Due September 22, 2026
Added September 8, 2026
CVE-2026-81963 Microsoft Windows Link Following Vulnerability
Microsoft · Windows
Due September 22, 2026
Added September 8, 2026
CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Adobe · Commerce and Magento
Due September 11, 2026
Added September 4, 2026
CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
Due September 18, 2026
Added September 2, 2026
CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability
Sangoma · Switchvox
Due September 5, 2026
Added September 2, 2026
CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability
SonicWall · SMA1000 Appliances
Due September 5, 2026
Added September 2, 2026
CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances
Due September 5, 2026
Added September 2, 2026
CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability
JFrog · Artifactory
Due September 5, 2026
Added September 2, 2026
CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability
BerriAI · LiteLLM
Due September 16, 2026
Added September 2, 2026
CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability
Kestra · Kestra OSS
Due September 5, 2026
Added September 2, 2026
CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex · Starlette
Due September 16, 2026
Added August 31, 2026
CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut · NG/MF
Due September 14, 2026
Added August 31, 2026
CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut · NG/MF
Due September 14, 2026
Added August 27, 2026
CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
JFrog · Artifactory
Due September 10, 2026
Added August 27, 2026
CVE-2026-53362 Linux Kernel Unspecified Vulnerability
Linux · Kernel
Due August 30, 2026
Added August 27, 2026
CVE-2023-49105 ownCloud Improper Authentication Vulnerability
ownCloud · ownCloud
Due August 30, 2026
Added August 26, 2026
CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler ADC and NetScaler Gateway
Due August 29, 2026
Added August 26, 2026
CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability
Linux · Kernel
Due August 29, 2026
Added August 26, 2026
CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional · Ajax.NET Professional
Due September 9, 2026
Added August 26, 2026
CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft · SQL Server
Due August 29, 2026
Added August 26, 2026
CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Red Hat · Automatic Bug Reporting Tool
Due September 9, 2026
Added August 26, 2026
CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability
Red Hat · Libuser
Due September 9, 2026
Added August 25, 2026
CVE-2026-60004 Gitea Code Injection Vulnerability
Gitea · Gitea
Due August 28, 2026
Added August 24, 2026
CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
Due August 27, 2026
Added August 21, 2026
CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
Due August 24, 2026
Added August 20, 2026
CVE-2026-72530 TrueConf Server Code Injection Vulnerability
TrueConf · Server
Due September 3, 2026
Added August 20, 2026
CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability
TrueConf · Server
Due August 23, 2026
Added August 19, 2026
CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability
MLflow · MLflow
Due September 2, 2026
Added August 18, 2026
CVE-2026-65400 Apple macOS Improper Authentication Vulnerability
Apple · macOS
Due August 21, 2026
Added August 18, 2026
CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom · VMware vCenter · known ransomware use
Due August 21, 2026
Added August 18, 2026
CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability
Microsoft · SharePoint
Due August 21, 2026
Added August 18, 2026
CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Microsoft · Internet Key Exchange (IKE) Service Extensions
Due August 21, 2026
Added August 17, 2026
CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability
Ray-Project · Ray
Due August 20, 2026
Added August 11, 2026
CVE-2026-72898 Metabase SQL Injection Vulnerability
Metabase · Metabase
Due August 14, 2026
Added August 11, 2026
CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Microsoft · Windows Ancillary Function Driver for WinSock
Due August 25, 2026
Added August 11, 2026
CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Due August 14, 2026
Added August 7, 2026
CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability
Progress · LoadMaster
Due August 10, 2026
Added August 5, 2026
CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains · TeamCity · known ransomware use
Due August 8, 2026
Added August 4, 2026
CVE-2026-9198 IBM Langflow Code Injection Vulnerability
IBM · Langflow
Due August 7, 2026
Added August 4, 2026
CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache · Tomcat
Due August 7, 2026
Added August 4, 2026
CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
Due August 7, 2026
Added August 3, 2026
CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
Due August 6, 2026
Added July 29, 2026
CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco · Secure Firewall Management Center (FMC) · known ransomware use
Due August 1, 2026
Added July 27, 2026
CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Arista · VeloCloud Orchestrator
Due July 30, 2026
Added July 27, 2026
CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet · FortiOS
Due August 10, 2026
Added July 22, 2026
CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint
Due July 25, 2026
Added July 22, 2026
CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability
Check Point · SmartConsole
Due July 25, 2026
Added July 21, 2026
CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability
WordPress · Core
Due July 24, 2026
Added July 21, 2026
CVE-2026-60137 WordPress Core SQL Injection Vulnerability
WordPress · Core
Due August 4, 2026

Due in the 30 days from Nov 8

CVE-2026-111497 Google BrotliNovember 10, 2026
CVE-2026-48356 Adobe Commerce and MagentoNovember 10, 2026
CVE-2026-41709 Broadcom VMware ESXNovember 11, 2026
CVE-2026-118527 Ivanti Connect SecureNovember 13, 2026
CVE-2024-27834 Apple Multiple ProductsNovember 18, 2026
CVE-2026-19868 SonicWall SonicOS SSLVPNNovember 20, 2026

The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

Vendors with the most entries

Microsoft390
Cisco102
Apple96
Adobe83
Google76
Oracle46
Apache41
Ivanti38
Fortinet32
Linux32
Citrix27
D-Link26
VMware26
SonicWall20
Synacor19
Android17
Palo Alto Networks16
Samsung15
Atlassian14
SAP14

Additions by year

2026285 added
2025245 added
2024186 added
2023187 added
2022555 added
2021311 added

Counted by the dateAdded field in CISA’s feed.

Questions about the KEV catalog

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is the Cybersecurity and Infrastructure Security Agency's public list of software vulnerabilities that have been exploited in the wild. CISA adds an entry only when the flaw has a CVE ID, there is reliable evidence of active exploitation, and there is a clear remediation action such as a vendor update.

How many vulnerabilities are in CISA KEV?

As of catalog version 2026.11.06 (released November 6, 2026), the catalog lists 1,769 vulnerabilities from 291 vendors and projects, the oldest added on November 3, 2021. CISA marks 361 of them as known to have been used in ransomware campaigns.

How often is CISA KEV updated?

CISA updates the catalog as it adds entries. In the 90 days ending November 8, 2026, it added 107 vulnerabilities on 45 different days; the most recent addition is dated November 6, 2026. This page is rebuilt from CISA's feed every day.

What does the KEV due date mean?

Each entry carries a due date: the remediation deadline CISA sets for federal civilian agencies. Other organizations are not bound by it, but CISA recommends that every organization prioritize KEV entries in its own vulnerability management.

Sources

Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
Cybersecurity and Infrastructure Security Agency, Reducing the Significant Risk of Known Exploited Vulnerabilities · primary source