Exploitation watch

Two short lists for a daily look: what CISA has just confirmed as exploited, and which CVEs have crossed the EPSS threshold without anything about the vulnerability itself changing. Both carry an available flag that goes false when the underlying data could not be read, so an empty list is never mistaken for a quiet day.

GET /api/v1/kev/recent
GET /api/v1/newly-actionable

For the full EPSS and KEV picture over every tracked CVE, see exploitability; for the signals behind one CVE, see /cve/:id/exploit-signals on the CVE lookup page.

Recent KEV additions

GET /api/v1/kev/recent?limit=5

The newest entries in CISA's Known Exploited Vulnerabilities catalogue, with the remediation deadline CISA set and whether the entry is known to be used in ransomware campaigns.

Parameter	Type	Required	Description
limit	integer	No	1 to 20; default 5

{
  "success": true,
  "data": {
    "items": [
      {
        "cve": "CVE-2026-88772",
        "dateAdded": "2026-09-27",
        "dueDate": "2026-09-30",
        "vendorProject": "Citrix",
        "product": "NetScaler",
        "name": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
        "ransomware": false,
        "ransomwareStatus": "unknown"
      }
    ],
    "available": true,
    "catalogVersion": "2026.09.27",
    "fromArchive": false,
    "archivedAt": null
  },
  "timestamp": "2026-09-28T01:04:48.266Z"
}

ransomware is true only for CISA's own "Known"; it is false both for CISA's "Unknown" (CISA has not established use in ransomware campaigns -- not the same claim as confirmed non-use) and for an entry with no ransomware field reported at all. ransomwareStatus names which of the three it actually was: known, unknown or not_reported.

available: false means the live copy's two-day backing TTL has expired with nothing able to refresh it -- a live read failing by itself does not immediately flip this, since the archived copy answers in the meantime (fromArchive: true, archivedAt set to when that copy was fetched); items is empty only once that archive has also expired, and nothing was checked. Cached for fifteen minutes.

Newly actionable by EPSS

GET /api/v1/newly-actionable

CVEs whose EPSS score has recently risen past the threshold. The set worth re-triaging even though nothing about each vulnerability changed: the estimate of whether it will be exploited did.

{
  "success": true,
  "data": {
    "items": [
      {
        "cve": "CVE-2026-71362",
        "epss": 0.89616,
        "seenAt": "2026-09-25T13:32:13.908Z",
        "title": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation."
      }
    ],
    "count": 41,
    "threshold": 0.088,
    "updatedAt": "2026-09-27T13:30:04.112Z",
    "available": true
  },
  "timestamp": "2026-09-28T01:04:52.101Z"
}

seenAt is when this service first observed the score above the threshold, not when FIRST published it. epss is refreshed on every sync while the CVE stays above the threshold, so it is today's score, not the one it crossed at; a CVE whose score later falls back under the threshold is dropped from the list entirely, rather than staying for the rest of its two-week window with a stale score shown as current. available: false means the scores have not been computed yet, which is a statement about this API's data and not about the CVEs.