The EU Vulnerability Database flags 1,752 vulnerabilities as actively exploited on 13 Oct 2026. 103 were first flagged in the past 90 days, and 29 of those were critical flaws that EPSS rated under 10% likely to be exploited.
vulnerabilities newly flagged as exploited in the past 90 days
29
of them rated critical, yet given under 10% odds by EPSS
1,752
exploited entries in the EUVD in total
14,964
new EUVD entries in September 2026
Key takeaways
The EU Vulnerability Database lists 1,752 actively exploited vulnerabilities on 13 Oct 2026.
29 of the 57 critical-severity vulnerabilities flagged as exploited in the past 90 days had an EPSS score below 10%.
73 of the 1,752 exploited entries appear on ENISA's EU KEV list. The other 1,679 appear only on the CISA KEV list.
The EUVD published 14,964 new entries in September 2026, against a twelve-month average of 6,364.
Section A · CISA KEV and EU KEV
Exploited now
Vulnerabilities that the EUVD marks as exploited, drawn from the CISA KEV list and ENISA's own EU KEV list. The dashed line on the timelines marks 11 Sep 2026, the day CRA Article 14 reporting began.
Risk grid · chart 1
Recently exploited vulnerabilities by severity and EPSS
103 EUVD entries first flagged as exploited in the past 90 days. Columns use the CVSS base score and rows use the EUVD epss value. Vendor and product names come from the CISA KEV catalogue, or from the EUVD entry when CISA has no record.
Low riskMediumHighCriticalCritical severity with EPSS below 10%
EPSS, chance of exploitation within 30 days
50% or more
10% to 50%
1% to 10%
Under 1%
LowCVSS 0 to 3.9
MediumCVSS 4 to 6.9
HighCVSS 7 to 8.9
CriticalCVSS 9 to 10
Rows show EPSS likelihood and columns show CVSS severity. Tap or click a dot for the vendor, product and scores.
How to read it
One dot per vulnerability. Colour shows combined risk, from green for low to red for critical. Red cells hold 34 entries, orange 29, yellow 39 and green 1. The dashed cells are the blind spot. 29 of the 57 critical-severity entries scored below 10% on EPSS and were exploited anyway.
Caveats
EPSS estimates the chance of exploitation in the next 30 days. For an entry that is already exploited, a low score is a forecast that missed, not a data error. Scores move every day, and this grid uses the latest one. CVD Portal set the band edges and risk colours. They are not an ENISA or FIRST scale.
Daily count · chart 2
Exploited-list additions in the past 9 weeks
The EUVD KEV feed (/api/kev/dump) per calendar day, 15 Aug 2026 to 13 Oct 2026.
81 vulnerabilities joined the exploited list, spread over 29 of the 60 days. Gaps mostly fall on weekends. Ticks on the axis mark Mondays.
Caveats
An empty day means nothing was added. It does not mean data is missing. With only a few entries per day, a single spike says little about a trend.
Monthly count · chart 3
Exploited-list additions per month since 2021
The same EUVD KEV feed, one row per CVE, dated by the first time either CISA KEV or the EU KEV listed it.
CISA KEV onlyOn both listsEU KEV only
How to read it
Grey is CISA only, navy is both lists and violet is the EU KEV alone. 1,679 of the 1,752 entries appear only on the CISA list, and 73 appear on the EU KEV. September 2026 brought 49 new entries. The high bars in late 2021 and 2022 show CISA loading its backlog after the catalogue launched.
Caveats
Each entry counts once, in the month of its earliest listing. The chart shows that a flaw is known to be exploited. It cannot show who reported it to ENISA, so it is not a measure of Single Reporting Platform traffic.
Section B · CISA catalogue fields
Patterns behind exploitation
What the CISA catalogue records about ransomware and about the type of flaw.
Context · chart 4
Ransomware links and the most common flaw types
CISA KEV catalogue, 1,739 entries. The left chart uses knownRansomwareCampaignUse, grouped by the year CISA added the entry. The right chart counts the cwes field.
Ransomware link, share by year added
Weakness classes, entry count
How to read it
The left chart shows the share of entries that CISA ties to a ransomware campaign, 27% for 2021 and 11% for 2026. The right chart ranks the weakness classes seen most often. Improper input validation, OS command injection and Out-of-bounds write lead.
Caveats
CISA marks ransomware use when it learns of it, often long after the listing, so the newest years will rise over time. One entry can carry several CWE codes, and many older entries carry none.
Section C · 404,107 entries
The database as a whole
Every EUVD entry, exploited or not. Counts come from the totals the EUVD search API returns for each filter.
Volume · chart 5
New EUVD entries per month by CVSS band
Totals from the EUVD search API (/api/search) per publication month, November 2024 to 13 Oct 2026, split with fromScore and toScore.
Critical, 9 to 10High, 7 to 8.9Medium, 4 to 6.9Low, 0 to 3.9No score
How to read it
Each bar stacks the CVSS bands, with critical at the base. The EUVD added 14,964 entries in September 2026, 1,559 critical, 6,210 high, 4,672 medium, 1,931 low and 592 with no score. The twelve months before averaged 6,364 a month, and no earlier month on the chart was larger.
Caveats
The month is when the EUVD published the entry, not when the flaw was found. A sudden rise can mean ENISA connected a new upstream source, and the search API does not say which. The final bar covers a month still in progress. CVD Portal counts the high, medium and low bands with the same API filters.
Section D · source project record
Daily snapshots
Two values the EUVD does not keep a history of. The open-source project behind most of this data records them once a day.
Daily record · chart 6
Exploited-list size and sensor traffic, day by day
The source project writes one line per day to euvd/history.jsonl. The EUVD itself keeps no history of these two values.
Size of the exploited list
Sensor connections per day, all entries
How to read it
7 daily readings so far, from 7 Oct 2026 to 13 Oct 2026. The exploited list went from 1,747 to 1,752 entries. Shadowserver sensors logged 95,708 connections a day at the first reading and 102,558 at the latest.
Caveats
The record begins on the first day the source project ran and cannot be filled in backwards. A missing day means the project did not run that day. It does not mean the values stayed the same.
Most figures come from the open-source EUVD statistics project in the single-reporting-platform repository (MIT licence). CVD Portal adds the CVSS band counts, the vendor names and the risk grid. This page refreshes every six hours. Latest data is from 13 Oct 2026.