Skip to content
Insights · exploited this week

What CISA added in the last seven days, and the weakness behind each.

8 vulnerabilities were added to CISA's exploited list from 26 Oct to 29 October 2026; 5 are due within three days or already late. This page rebuilds itself after each refresh of our knowledge graph, so it moves without anyone writing it. The reasoning and the fix steps are in the dated notes beside it.

Updated 30 October 2026 at 16:39 UTC. Entries and due dates are CISA's, as loaded into our graph; CVSS is the base score on the NVD record (version 3.x), so it can differ from the score in our notes, which quote the highest on the CVE record, often version 4.0; EPSS is FIRST's probability of exploitation in the next 30 days; a score the record does not have yet says so instead of showing 0. Rule: Today when the CISA due date has passed or is within three days; This week when EPSS is 0.40 or more; otherwise next patch cycle. A rule of thumb, not a verdict on your estate.

The weaknesses behind them

A weakness class (a CWE) is the kind of mistake in the code. Seeing the same class in several entries is the useful signal: it is where a review of your own software or your suppliers pays most.

Weekly and monthly trend, and the weakness ranking →

Start with one piece of work.

Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.

Talk to us