{
  "generatedAt": "2026-10-30T13:03:54.841Z",
  "inputs": {
    "kevCatalogVersion": "2026.10.29",
    "kevDateReleased": "2026-10-29T19:09:34.4003Z",
    "kevTotalEntries": 1764,
    "epssHeader": "#model_version:v2026.06.15,score_date:2026-10-29T12:03:14Z",
    "downloadTimeUtc": "2026-10-30T03:12:03Z",
    "sha256": "38a7172a5f26470dc7632aaa1c6cff4a51fe7bfec8cdce978a19b816a751e34d *known_exploited_vulnerabilities.json\n221453f92968acfb993022670cd551664d0b42efdb7000b9a3746b7060ecbf0e *epss_scores-current.csv.gz"
  },
  "period": {
    "start": "2026-01-01",
    "cutoff": "2026-10-29"
  },
  "volume": {
    "total": 280,
    "ransomware": 27,
    "byMonth": {
      "2026-01": 17,
      "2026-02": 28,
      "2026-03": 26,
      "2026-04": 31,
      "2026-05": 21,
      "2026-06": 23,
      "2026-07": 26,
      "2026-08": 31,
      "2026-09": 43,
      "2026-10": 34
    },
    "byCveYear": {
      "2025": 38,
      "2026": 193,
      "≤2024": 49
    }
  },
  "vendors": {
    "distinct": 106,
    "top10": [
      [
        "Microsoft",
        40
      ],
      [
        "Cisco",
        20
      ],
      [
        "Apple",
        9
      ],
      [
        "Fortinet",
        9
      ],
      [
        "Google",
        9
      ],
      [
        "Linux",
        9
      ],
      [
        "Adobe",
        7
      ],
      [
        "Citrix",
        6
      ],
      [
        "Ivanti",
        6
      ],
      [
        "Synacor",
        5
      ]
    ],
    "topProducts": [
      [
        "Microsoft · Windows",
        14
      ],
      [
        "Linux · Kernel",
        9
      ],
      [
        "Apple · Multiple Products",
        7
      ],
      [
        "Cisco · Catalyst SD-WAN Manager",
        5
      ],
      [
        "Citrix · NetScaler",
        5
      ],
      [
        "Microsoft · SharePoint",
        5
      ],
      [
        "Google · Chromium V8",
        4
      ],
      [
        "JFrog · Artifactory",
        4
      ],
      [
        "Langflow · Langflow",
        4
      ],
      [
        "Microsoft · Office",
        4
      ]
    ],
    "ransomwareByVendor": [
      [
        "Microsoft",
        4
      ],
      [
        "SmarterTools",
        3
      ],
      [
        "Cisco",
        2
      ],
      [
        "JetBrains",
        2
      ],
      [
        "SimpleHelp",
        2
      ],
      [
        "SonicWall",
        2
      ],
      [
        "BeyondTrust",
        1
      ],
      [
        "Broadcom",
        1
      ],
      [
        "Check Point",
        1
      ],
      [
        "ConnectWise",
        1
      ]
    ]
  },
  "speed": {
    "allWithDate": 280,
    "medianAll": 14,
    "cves2026": 193,
    "median2026": 4,
    "within7_2026": 116,
    "sameDayOrBefore2026": 53,
    "sameDay2026": 50,
    "beforePublication2026": 3,
    "beforePublicationExamples": [
      "CVE-2026-60004 (-1 d)",
      "CVE-2026-85706 (-1 d)",
      "CVE-2026-87886 (-1 d)"
    ],
    "distribution2026": [
      {
        "label": "antes o el mismo día",
        "n": 53
      },
      {
        "label": "1–7 días",
        "n": 63
      },
      {
        "label": "8–30 días",
        "n": 41
      },
      {
        "label": "31–90 días",
        "n": 26
      },
      {
        "label": "91–365 días",
        "n": 10
      },
      {
        "label": "más de 1 año",
        "n": 0
      }
    ],
    "distributionAll": [
      {
        "label": "antes o el mismo día",
        "n": 53
      },
      {
        "label": "1–7 días",
        "n": 66
      },
      {
        "label": "8–30 días",
        "n": 45
      },
      {
        "label": "31–90 días",
        "n": 32
      },
      {
        "label": "91–365 días",
        "n": 34
      },
      {
        "label": "más de 1 año",
        "n": 50
      }
    ]
  },
  "epss": {
    "withScore": 280,
    "over05": 117,
    "over01": 180,
    "under001": 17,
    "median": 0.291585
  },
  "cvss": {
    "withScore": 280,
    "bands": {
      "alta": 124,
      "crítica": 127,
      "media": 28,
      "baja": 1
    },
    "bySource": {
      "CISA-ADP": 58,
      "CNA": 222
    },
    "byVersion": {
      "cvssV3_1": 223,
      "cvssV4_0": 51,
      "cvssV3_0": 6
    },
    "mediumOrLow": 29
  },
  "mediumExamples": [
    {
      "cve": "CVE-2025-31125",
      "vendor": "Vite",
      "product": "Vitejs",
      "cvss": 5.3,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "epss": 0.74939,
      "dateAdded": "2026-01-22"
    },
    {
      "cve": "CVE-2026-32202",
      "vendor": "Microsoft",
      "product": "Windows",
      "cvss": 4.3,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "epss": 0.70902,
      "dateAdded": "2026-04-28"
    },
    {
      "cve": "CVE-2026-48710",
      "vendor": "Kludex",
      "product": "Starlette",
      "cvss": 6.5,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "epss": 0.70288,
      "dateAdded": "2026-09-02"
    },
    {
      "cve": "CVE-2026-45498",
      "vendor": "Microsoft",
      "product": "Defender",
      "cvss": 4,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "epss": 0.63076,
      "dateAdded": "2026-05-20"
    },
    {
      "cve": "CVE-2025-47813",
      "vendor": "Wing FTP Server",
      "product": "Wing FTP Server",
      "cvss": 4.3,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "epss": 0.62512,
      "dateAdded": "2026-03-16"
    }
  ],
  "priorityCriteria": {
    "rule": "KEV con fecha de ingreso 2026-01-01..2026-10-29 · EPSS ≥ 0.1 · fabricante en la lista de uso común · orden por EPSS desc (desempate: ransomware conocido, luego ingreso más reciente) · máximo 2 por fabricante · máximo 8",
    "commonVendors": [
      "Microsoft",
      "Fortinet",
      "Cisco",
      "VMware / Broadcom",
      "Ivanti",
      "Citrix",
      "Apache",
      "WordPress",
      "SonicWall",
      "Palo Alto Networks",
      "Oracle",
      "SAP",
      "Atlassian"
    ],
    "candidates": 71
  },
  "priority": [
    {
      "cve": "CVE-2026-10520",
      "vendor": "Ivanti",
      "product": "Sentry",
      "vulnerabilityName": "Ivanti Sentry OS Command Injection Vulnerability",
      "dateAdded": "2026-06-11",
      "ransomware": false,
      "epss": 0.99915,
      "epssPercentile": 0.99968,
      "cvss": 10,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "published": "2026-06-09",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "notes": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-10520"
    },
    {
      "cve": "CVE-2026-21589",
      "vendor": "Atlassian",
      "product": "Multiple Products",
      "vulnerabilityName": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
      "dateAdded": "2026-10-15",
      "ransomware": false,
      "epss": 0.99477,
      "epssPercentile": 0.99943,
      "cvss": 9.3,
      "cvssVersion": "cvssV4_0",
      "cvssSource": "CNA",
      "published": "2026-10-05",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "notes": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589"
    },
    {
      "cve": "CVE-2008-4250",
      "vendor": "Microsoft",
      "product": "Windows",
      "vulnerabilityName": "Microsoft Windows Buffer Overflow Vulnerability",
      "dateAdded": "2026-05-20",
      "ransomware": false,
      "epss": 0.98751,
      "epssPercentile": 0.99926,
      "cvss": 9.8,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CISA-ADP",
      "published": "2008-10-23",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "notes": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250"
    },
    {
      "cve": "CVE-2026-1281",
      "vendor": "Ivanti",
      "product": "Endpoint Manager Mobile (EPMM)",
      "vulnerabilityName": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
      "dateAdded": "2026-01-29",
      "ransomware": false,
      "epss": 0.98688,
      "epssPercentile": 0.99925,
      "cvss": 9.8,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "published": "2026-01-29",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "notes": "Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please: see: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340 ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0S-5.noarch.rpm ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0L-5.noarch.rpm ; https://nvd.nist.gov/vuln/detail/CVE-2026-1281"
    },
    {
      "cve": "CVE-2026-34486",
      "vendor": "Apache",
      "product": "Tomcat",
      "vulnerabilityName": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
      "dateAdded": "2026-08-04",
      "ransomware": false,
      "epss": 0.98503,
      "epssPercentile": 0.9992,
      "cvss": 7.5,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CISA-ADP",
      "published": "2026-04-09",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "notes": "https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34486"
    },
    {
      "cve": "CVE-2026-34197",
      "vendor": "Apache",
      "product": "ActiveMQ",
      "vulnerabilityName": "Apache ActiveMQ Improper Input Validation Vulnerability",
      "dateAdded": "2026-04-16",
      "ransomware": false,
      "epss": 0.98256,
      "epssPercentile": 0.99916,
      "cvss": 8.8,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CISA-ADP",
      "published": "2026-04-07",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "notes": "https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197"
    },
    {
      "cve": "CVE-2026-21643",
      "vendor": "Fortinet",
      "product": "FortiClient EMS",
      "vulnerabilityName": "Fortinet FortiClient EMS SQL Injection Vulnerability",
      "dateAdded": "2026-04-13",
      "ransomware": false,
      "epss": 0.97735,
      "epssPercentile": 0.99904,
      "cvss": 9.1,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "published": "2026-02-06",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643"
    },
    {
      "cve": "CVE-2026-35273",
      "vendor": "Oracle",
      "product": "PeopleSoft Enterprise PeopleTools",
      "vulnerabilityName": "Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability",
      "dateAdded": "2026-06-12",
      "ransomware": true,
      "epss": 0.96678,
      "epssPercentile": 0.99884,
      "cvss": 9.8,
      "cvssVersion": "cvssV3_1",
      "cvssSource": "CNA",
      "published": "2026-06-11",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "notes": "https://www.oracle.com/security-alerts/alert-cve-2026-35273.html ; https://support.oracle.com/signin/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-35273"
    }
  ]
}