This page tracks every vulnerability we have covered that CISA added to its Known Exploited Vulnerabilities (KEV) catalog. Each row links to our full write-up with affected versions and fixes. Federal agencies must fix KEV entries by the due date shown, and many other organisations use that date as a priority deadline.
| Our post date | Vendor | CVE | Severity | CVSS | EPSS (30-day) | CISA due date |
|---|---|---|---|---|---|---|
| 2026-10-16 | Fortinet | CVE-2025-61624 | HIGH | 6.0 | 0.6% | 2026-10-19 |
| 2026-10-15 | Ahsay | CVE-2026-105133 | HIGH | 5.5 | 0.4% | 2026-10-17 |
| 2026-10-15 | Cisco | CVE-2026-76519 | CRITICAL | n/a | n/a | 2026-10-17 |
| 2026-10-14 | Ahsay | CVE-2026-105134 | CRITICAL | 9.3 | 1.8% | 2026-10-17 |
| 2026-10-14 | Microsoft | CVE-2026-96951 | CRITICAL | 8.8 | n/a | 2026-10-16 |
| 2026-10-13 | Ivanti | CVE-2026-104935 | CRITICAL | n/a | n/a | 2026-10-16 |
| 2026-10-08 | Strapi | CVE-2023-22894 | HIGH | 4.9 | 1.7% | 2026-10-11 |
| 2026-10-08 | ONLYOFFICE | CVE-2021-3199 | CRITICAL | 9.8 | 8.2% | 2026-10-11 |
| 2026-10-04 | Citrix | CVE-2026-88779 | HIGH | 8.7 | 0.3% | 2026-10-07 |
| 2026-10-03 | Zammad GmbH | CVE-2026-102489 | CRITICAL | 9.4 | 1.4% | 2026-10-05 |
| 2026-10-03 | Zammad GmbH | CVE-2026-102490 | CRITICAL | 9.4 | 0.6% | 2026-10-05 |
“n/a” means the figure was not available when we published the write-up. Severity, CVSS and EPSS come from the sources linked in each post. New entries are added as we cover them. To rank these, see Patch prioritization with CVSS, EPSS and KEV and What is CISA KEV.