Timeline
Known Exploited Vulnerabilities
CISA's catalogue of CVEs confirmed as actively exploited; mandatory patch deadlines for US federal agencies.
36 of 36 entries (36 events, 0 interactions)
Filters
#12 28 Jul
Recorded a shortened remediation-deadline distribution since 10 June
Cybersecurity: Threats and Defences: KEV patch clocks fell to three days#11 22 Jul
Mentioned in: SharePoint stays under active KEV fire
Cybersecurity: Threats and Defences#11 21 Jul
Mentioned in: Langflow hits KEV a second time
Cybersecurity: Threats and Defences#11 16 Jul
Mentioned in: CISA's KEV list runs a month late
Cybersecurity: Threats and Defences#11 15 Jul
Mentioned in: Oracle EBS gets a 3-day patch clock
Cybersecurity: Threats and Defences#10 14 Jul
A quiet KEV fortnight, then a 2008 bug
Cybersecurity: Threats and Defences#9 4 Jul
Mentioned in: BOD 26-04, a fortnight of triage
Cybersecurity: Threats and Defences#9 1 Jul
Mentioned in: BlueHammer turns into a ransomware step
Cybersecurity: Threats and Defences#9 1 Jul
Mentioned in: SharePoint patch clock runs out today
Cybersecurity: Threats and Defences#9 29 Jun
Mentioned in: Cisco tops a five-vendor KEV batch
Cybersecurity: Threats and Defences#8 23 Jun
Mentioned in: Triple CVSS-10 Ubiquiti chain hits root
Cybersecurity: Threats and Defences#8 18 Jun
Mentioned in: Splunk lands its first-ever KEV entry
Cybersecurity: Threats and Defences#8 17 Jun
Mentioned in: A handle keeps dropping MS zero-days
Cybersecurity: Threats and Defences#8 10 Jun
Reached 1,627 entries under the new regime as of 23 June
Cybersecurity: Threats and Defences: CISA tears up its KEV deadline rules#7 9 Jun
Mentioned in: Arista refuses to patch KEV flaw
Cybersecurity: Threats and Defences#7 9 Jun
Mentioned in: 200 fixes, six zero-days, late Exchange
Cybersecurity: Threats and Defences#7 8 Jun
Mentioned in: VPN zero-day open a month pre-patch
Cybersecurity: Threats and Defences#7 5 Jun
Mentioned in: SolarWinds Serv-U back on KEV list
Cybersecurity: Threats and Defences#6 3 Jun
Received CVE-2026-45247 as a new entry on 3 June 2026
Cybersecurity: Threats and Defences: Magento RCE forces 9-day patch race#6 2 Jun
Mentioned in: Old Linux container bug back in the wild
Cybersecurity: Threats and Defences#6 1 Jun
Mentioned in: WebLogic flaw revived as ransomware vector
Cybersecurity: Threats and Defences#5 22 May
Mentioned in: Drupal SQL flaw hits PostgreSQL sites
Cybersecurity: Threats and Defences#5 21 May
Listed CVE-2025-34291 and CVE-2026-34926 with a 4 June federal patch deadline
Cybersecurity: Threats and Defences: AI orchestration flaw joins CISA's KEV#5 18 May
Mentioned in: GitHub's own code cloned via add-on
Cybersecurity: Threats and Defences#4 15 May
Mentioned in: Exchange repeats the CISA deadline-before-patch trap
Cybersecurity: Threats and Defences#4 14 May
Mentioned in: UAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and Defences#4 13 May
Mentioned in: Patch Tuesday clean streak hides out-of-band KEVs
Cybersecurity: Threats and Defences#3 7 May
Mentioned in: Ivanti EPMM logs fourth KEV zero-day since 2023
Cybersecurity: Threats and Defences#3 6 May
Received CVE-2026-0300 entry on 6 May
Cybersecurity: Threats and Defences: CISA deadline for PAN-OS RCE lands four days early#3 30 Apr
Mentioned in: cPanel zero-day ran 65 days before patch; Sorry ransomware active
Cybersecurity: Threats and Defences#2 20 Apr
CISA gives Cisco SD-WAN three days to patch
Cybersecurity: Threats and Defences#3 19 Apr
Mentioned in: KB5091157, Gentlemen C2 intel, ENISA CNAs: in brief
Cybersecurity: Threats and Defences#1 14 Apr
Mentioned in: 17-year-old Office RCE back on KEV
Cybersecurity: Threats and Defences#1 7 Apr
Mentioned in: Trump proposes $707m CISA cut, 860 jobs
Cybersecurity: Threats and Defences#1 28 Mar
Mentioned in: F5 reclassifies DoS bug to 9.8 RCE
Cybersecurity: Threats and Defences#1 23 Mar