Vulnerability surveillanceVol. 2026No. 45Updated 7 November 2026 Sources: NVD · CISA KEV · EPSS

Nimstead Pulse

Snapshot Source dates & coverage
NVD
Feed 7 Nov 2026. Publication and severity; recent records may be incomplete.
CISA KEV
Released 6 Nov 2026. Confirmed exploitation; absence does not establish safety.
FIRST EPSS
Scored 7 Nov 2026. Probability of exploitation activity in the next 30 days, not severity.

Public intelligence, not an inventory or a record of your remediation. Confirm affected versions, exposure and business impact before deciding what to fix. CISA due dates apply to US federal civilian agencies.

Exploitation in the wild

CISA added 1,478 CVEs to KEV from Dec 2021 to Nov 2026. 38% came within 30 days of publication, and 19% are linked to ransomware.

When CISA adds a CVE to KEV, how long after NVD publication it is listed, and which products appear in the catalogue. Listing dates do not establish when exploitation began.

Period · shared across tabs Dec 2021 – Nov 2026 · 60 months

Use Left and Right Arrow to move one month, Shift and Arrow to move one year, and Home or End to move to the beginning or end. On the selected period slider, arrows move the whole range. Drag the range to move it or drag either handle to change an endpoint.

Figure 4. New KEV listings per month

1,478 listings from Dec 2021 to Nov 2026; 19% linked to known ransomware campaigns

Known ransomware use Other exploitation Catalogue launch and backfill, Nov 2021 – Jun 2022
0204022620222023202420252026

Use Left and Right Arrow to step through the data, Home and End to jump to the first and last value. Escape clears the selected value.

The tallest month here is March 2022, with 226 listings. CISA launched the catalogue in November 2021 with a backlog of older, already-exploited CVEs and added more of them in large batches through 2022. Bars with a break are taller than the axis; hover or step to one for its total.

Figure 5. Are KEV listings closer to publication?

All years: KEV listings each year, split by days from CVE publication to listing. Hover a year for its median.

Within 30 days 1–12 months 1–5 years 5+ years
0%20%40%60%80%100%202120222023202420252026

Use Left and Right Arrow to step through the data, Home and End to jump to the first and last value. Escape clears the selected value.

Median days per year: 2021 446 · 2022 1,436 · 2023 12 · 2024 22 · 2025 26 · 2026 14. Crimson is listings within 30 days of publication. Grey is exploitation of CVEs over a year old, which is still a large share. Patching only new CVEs leaves that tail open.

Figure 6. Most-exploited vendors

KEV listings made in the period, with their top products

#NameListings RansomwareTrend
1 MicrosoftWindows (146), Internet Explorer (28), Office (21) 309 82
2 CiscoIOS and IOS XE Software (14), IOS software (6), Catalyst SD-WAN Manager (5) 90 6
3 AdobeFlash Player (31), ColdFusion (14), Acrobat and Reader (11) 77 10
4 AppleMultiple Products (43), iOS, iPadOS, and macOS (7), iOS and iPadOS (5) 71 0
5 GoogleChromium V8 (29), Pixel (6), Framework (6) 68 1
6 OracleWebLogic Server (8), Java SE (6), Fusion Middleware (5) 38 12
7 IvantiEndpoint Manager Mobile (EPMM) (7), Endpoint Manager (EPM) (4), Connect Secure (3) 30 9
8 FortinetMultiple Products (7), FortiOS (6), FortiOS and FortiProxy (4) 29 11
9 ApacheTomcat (6), ActiveMQ (3), OFBiz (3) 29 3
10 VMwarevCenter Server (5), ESXi (2), VMware ESX (1) 26 5
11 D-LinkMultiple Routers (3), DCS-2530L and DCS-2670L Devices (2), DIR-859 Router (2) 26 2
12 CitrixNetScaler (6), NetScaler ADC and NetScaler Gateway (5), Session Recording (2) 21 4
13 LinuxKernel (19) 19 0
14 SynacorZimbra Collaboration Suite (ZCS) (15), Zimbra Collaboration Suite (1), Zimbra Collaboration Suite (ZCS) (1) 18 6
15 Palo Alto NetworksPAN-OS (13), Expedition (3), Kernel (1) 17 6

Figure 7. Register of KEV listings in the period

Newest first. Select an ID for its full record.

CVEVendor · productSeverityPublishedAddedDaysEPSSRansomware
SonicWall SonicOS SSLVPNHigh 7.56 Nov 20266 Nov 2026≤00.6%—
Apple Multiple ProductsMedium 5.514 May 20244 Nov 20269041.5%—
WordPress WordPress CoreHigh 8.131 Oct 20263 Nov 202631.2%—
Ivanti Connect SecureMedium 4.33 Nov 202630 Oct 2026≤00.8%—
Ivanti Connect SecureHigh 7.015 Oct 202630 Oct 2026150.5%—
GitLab Community Edition and Enterprise EditionCritical 10.013 Oct 202629 Oct 20261665.2%—
Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareHigh 8.628 Oct 202629 Oct 202610.8%—
Broadcom VMware ESXLow 2.730 Jul 202628 Oct 2026900.7%—
Linux KernelHigh 7.823 May 202628 Oct 202615816.1%—
Adobe Commerce and MagentoCritical 9.314 Jul 202627 Oct 202610547.5%—
Google BrotliCritical 9.822 Oct 202627 Oct 2026582.6%—
PHP Group PHPCritical 9.821 Oct 202626 Oct 20265>99.9%—
PHP Group PHPHigh 8.121 Oct 202626 Oct 20265>99.9%—
Arista VeloCloud OrchestratorCritical 9.922 Oct 202623 Oct 202611.0%—
Collabora Collabora Online – Built-in CODE ServerCritical 9.814 Oct 202623 Oct 2026973.3%—
EG Secure Solutions SiteGuard Server EditionHigh 7.814 Oct 202620 Oct 202662.5%—
Plex Media ServerHigh 7.223 Sep 202620 Oct 2026271.8%—
Plex Media ServerMedium 4.323 Sep 202620 Oct 20262710.7%—
Plex Media ServerMedium 6.523 Sep 202620 Oct 2026271.9%—
Plex Media ServerMedium 4.323 Sep 202620 Oct 20262711.9%—
Siemens Software CenterMedium 6.715 Oct 202620 Oct 202651.0%—
BeyondTrust Remote SupportCritical 9.815 Oct 202616 Oct 2026178.0%—
Fortinet Multiple ProductsMedium 6.514 Apr 202616 Oct 20261851.3%—
Atlassian Multiple ProductsHigh 7.55 Oct 202615 Oct 20261099.7%—
Ahsay AhsayCBSCritical 10.04 Oct 202614 Oct 20261081.8%—
Pulsea Nimstead product

Generated 2026-11-07 22:22 UTC from public data. Pulse was partly Alex Early's idea. Not affiliated with NIST, CISA or FIRST. Code MIT; the Nimstead name and marks are not licensed.

Open any full CVE ID. Search names across KEV entries and tracked vendors.

  • CVE-2026-19868Latest KEV · SonicWall SonicOS SSLVPN
  • CVE-2024-27834Latest KEV · Apple Multiple Products
  • CVE-2026-119977Latest KEV · WordPress WordPress Core
  • CVE-2026-118527Latest KEV · Ivanti Connect Secure
  • CVE-2026-111357Latest KEV · Ivanti Connect Secure
  • CVE-2026-97229Latest KEV · GitLab Community Edition and Enterprise Edition
6 suggestions
↑↓ to move · Enter to open · Esc to close

Loading NVD details…