basicsecurity.net
Proof, not just disclosure.

What’s newly known-exploited, and what to do about it.

Every vulnerability here is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog — known-exploited, on CISA’s evidence. We lead with what was just listed, then how fast bugs get there and how far they carry an attacker. Every number traces to a named public source you can open yourself.

CISA KEV snapshot 14 Nov 2026 · 1,783 entries · rebuilt daily · Sources

Type to search the full corpus — CVE, product, vendor, CWE, or a flare.

Breaking

newly known-exploited, and fastKEV snapshot 2026-11-14
How this list is chosen

Added to CISA KEV in the last 14 days, within 60 days of public disclosure, and carrying at least one signal: EPSS ≥ 0.50, CISA SSVC “automatable,” two or more KEV additions on the same product, or membership of a curated, two-person-approved cluster. Old bugs newly added to KEV are left out here — they stay in the catalog.

For every row: Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.

Days to KEVProductCVEKEV listedEPSSQualified by
5days
UnrealIRCd
UnrealIRCd
CVE-2026-1147132026-11-13<0.01CISA SSVC: automatable
8days
Barracuda Networks Email Security Gateway (ESG)
Authentication · Barracuda Networks
CVE-2026-1166062026-11-100.11CISA SSVC: automatable
4days
SignalWire FreeSwitch
Injection · SignalWire
CVE-2026-1167792026-11-090.02CISA SSVC: automatable
2days
IBM Aspera Faspex
Authorization / access control · IBM
CVE-2026-1232182026-11-090.01CISA SSVC: automatable
5days
GPUStack
Authentication · GPUStack
CVE-2026-1028952026-11-090.01CISA SSVC: automatable

Basis · CISA KEV (date added) · CVE.org publication date (lag) · FIRST EPSS · CISA SSVC (ADP). Every value is cited on the record it links to.

How long until it’s known-exploited

days from public disclosure to the CISA KEV listing

In 2026, 130 of 297 KEV additions were listed within a week of public disclosure (median 12 days). 34 had been public for more than three years — old doesn’t mean safe.

not ransomware-flaggedransomware-flagged (CISA)on the Breaking stripquarterly medianwithin a week
same day1 week1 month1 year5 years10 years2023202420252026within a weekmedian 5 daysBreaking now (5)

Source: CISA KEV (date added), CVE.org (publication date) · snapshot 14 Nov 2026

Table view — by quarter
QuarterKEV additionsMedian lagWithin a weekPublic > 3 years
2026-Q4515 days275
2026-Q31008 days496
2026-Q27515 days2811
2026-Q17133 days2612
2025-Q46245.5 days2215
2025-Q35114 days2010
2025-Q25914 days263
2025-Q17329 days2911
2024-Q45536 days246
2024-Q35834.5 days2013
2024-Q2336 days194
2024-Q14021 days153
2023-Q4466.5 days241
2023-Q3434 days274
2023-Q26096 days2015
2023-Q13773 days144

One dot per CVE added to CISA KEV since 2023-01-01 (914 CVEs). Known-exploited means listed in KEV; the date is when CISA listed it, not when exploitation began. Lag = KEV date added minus the CVE.org publication date. Basis · CISA KEV · CVE.org. Hover or tap a dot for the CVE; each links to its cited record.

Where the attack path ends

the five attacker outcomes

Most known-exploited bugs end at Lateral reach (77%). 209 carry an attacker on to data-at-risk or lights-out — the tail that turns “patch this” into “fund this.”

1 Front door2 Keys to the kingdom3 Lateral reach4 Data at risk5 Lights out
Table view
Furthest outcomeRecordsShareRansomware-flagged
1 · Front door30%0
2 · Keys to the kingdom15410%6
3 · Lateral reach1,24877%251
4 · Data at risk17811%77
5 · Lights out312%18

Furthest outcome each record’s attack path reaches, over the 1,614 of 1,783 records that carry the five-narrative framing (audited triage; facts and citations untouched). The five outcomes →

Analysis

cited cuts across the corpus · all 15 views →
Fund the fix here
46
known-exploited Microsoft bugs reach data-at-risk or lights-out — the most of any vendor.
See the analysis →
What’s being targeted
34%
of Server / web platform records are ransomware-flagged (49 of 143) — the highest share of any attack surface with 50+ records.
See the analysis →
Who finds the exploited bugs
44
known-exploited bugs credit Zero Day Initiative as finder, reporter or analyst in their CVE.org records.
See the analysis →

The catalogue

1,783 known-exploited records, every one cited

Also added to KEV in the last 30 days

  • 2026-11-13 CVE-2026-123039 Check Point Multiple Products listed 1 day after disclosure
  • 2026-11-10 CVE-2026-125350 Google Chromium listed same day after disclosure
  • 2026-11-10 CVE-2026-124194 Microsoft Office listed same day after disclosure
  • 2026-11-10 CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder listed 25 days after disclosure
  • 2026-11-10 CVE-2026-111560 Barracuda Networks Multiple Products listed 8 days after disclosure
  • 2026-11-09 CVE-2026-123158 OpenBSD OpenSSH listed 4 days after disclosure
  • 2026-11-06 CVE-2026-19868 SonicWall SonicOS SSLVPN listed same day after disclosure
  • 2026-11-03 CVE-2026-119977 WordPress Core listed 3 days after disclosure
  • 2026-10-30 CVE-2026-118527 Ivanti Connect Secure listed same day after disclosure
  • 2026-10-30 CVE-2026-111357 Ivanti Connect Secure listed 15 days after disclosure
  • 2026-10-29 CVE-2026-97229 GitLab Community Edition and Enterprise listed 16 days after disclosure
  • 2026-10-29 CVE-2026-76418 Cisco Secure Firewall ASA Software and FTD listed 1 day after disclosure

13 more in the window · 6 older bugs (disclosed more than 60 days before listing) also added — all searchable above.

AnalysisAttacker outcomesFlaresContributorsCorrectionsAtom feed

Every one of the 1,783 records is cited to named public sources: CISA KEV · FIRST EPSS · CVE.org · NVD · MITRE CWE · MITRE ATT&CK.