{"preview":true,"lane":"cisa_kev_exploited_vulnerabilities","note":"Free teaser: the newest entries in CISA's Known Exploited Vulnerabilities catalog (a CVE lands here only because it is being exploited in the wild), each with vendor, product, a ransomware-campaign flag, the federal remediation due date, mapped CWEs — and the moat: first_seen_observed is OUR archive receipt time, so you get \"which exploited CVEs are NEW since my last call\" on ground truth, not a raw 1,700-entry re-dump you diff yourself. The paid /records/exploits returns up to 100 entries, writes back to keep the archive warm, computes is_new-since-cursor, and supports vendor= / ransomware=true / cve= / maxAgeDays= filters.","source":"cisa_kev","error":null,"vendor_filter":null,"ransomware_only":false,"count":5,"kev":{"vendors":{"Apple":1,"WordPress":1,"Ivanti":2,"GitLab":1},"ransomware_linked":0},"archive":{"kv":true,"observed":5},"records":[{"source":"cisa_kev","id":"kev:CVE-2024-27834","group_key":"kev:CVE-2024-27834","entity":"Apple","record_type":"known_exploited_vulnerability","record_date":"2026-11-04","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27834","amended_source":false,"title":"Apple Multiple Products Improper Authentication Vulnerability","cve_id":"CVE-2024-27834","vendor":"Apple","product":"Multiple Products","vulnerability_name":"Apple Multiple Products Improper Authentication Vulnerability","short_description":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","due_date":"2026-11-18","ransomware_use":"Unknown","ransomware_known":false,"cwes":["CWE-287"],"content_hash":"sha256:89445b9bffe517dfac58973afe9443c0792d66597a0d5c287e03c5a956fd450c","first_seen_observed":"2026-11-05T02:46:11.029Z","is_new":false,"amended":false,"age_observed_days":0,"age_source":"observed","change_confidence":{"level":"none","score":0,"signals":[],"age_source":"observed"}},{"source":"cisa_kev","id":"kev:CVE-2026-119977","group_key":"kev:CVE-2026-119977","entity":"WordPress","record_type":"known_exploited_vulnerability","record_date":"2026-11-03","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","amended_source":false,"title":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","cve_id":"CVE-2026-119977","vendor":"WordPress","product":"WordPress Core","vulnerability_name":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","short_description":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","due_date":"2026-11-06","ransomware_use":"Unknown","ransomware_known":false,"cwes":["CWE-367"],"content_hash":"sha256:6bdea9cbb6636844020d6d32aa10e4c5a634d28152dd14cde2d138f633a2f0ca","first_seen_observed":"2026-11-05T02:46:11.029Z","is_new":false,"amended":false,"age_observed_days":0,"age_source":"observed","change_confidence":{"level":"none","score":0,"signals":[],"age_source":"observed"}},{"source":"cisa_kev","id":"kev:CVE-2026-118527","group_key":"kev:CVE-2026-118527","entity":"Ivanti","record_type":"known_exploited_vulnerability","record_date":"2026-10-30","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118527","amended_source":false,"title":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","cve_id":"CVE-2026-118527","vendor":"Ivanti","product":"Connect Secure","vulnerability_name":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","short_description":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","due_date":"2026-11-13","ransomware_use":"Unknown","ransomware_known":false,"cwes":["CWE-340"],"content_hash":"sha256:f7e66e49e6dc68104dc74e2b716f0e5fd56727f754bee6e1108f410c52ece263","first_seen_observed":"2026-11-05T02:46:11.029Z","is_new":false,"amended":false,"age_observed_days":0,"age_source":"observed","change_confidence":{"level":"none","score":0,"signals":[],"age_source":"observed"}},{"source":"cisa_kev","id":"kev:CVE-2026-111357","group_key":"kev:CVE-2026-111357","entity":"Ivanti","record_type":"known_exploited_vulnerability","record_date":"2026-10-30","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111357","amended_source":false,"title":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","cve_id":"CVE-2026-111357","vendor":"Ivanti","product":"Connect Secure","vulnerability_name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","short_description":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","due_date":"2026-11-02","ransomware_use":"Unknown","ransomware_known":false,"cwes":["CWE-306","CWE-862","CWE-345"],"content_hash":"sha256:593d54d1bc254fa04945c0259216978f45c0093431553b653d58ed09e58fcb88","first_seen_observed":"2026-11-05T02:46:11.029Z","is_new":false,"amended":false,"age_observed_days":0,"age_source":"observed","change_confidence":{"level":"none","score":0,"signals":[],"age_source":"observed"}},{"source":"cisa_kev","id":"kev:CVE-2026-97229","group_key":"kev:CVE-2026-97229","entity":"GitLab","record_type":"known_exploited_vulnerability","record_date":"2026-10-29","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","amended_source":false,"title":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","cve_id":"CVE-2026-97229","vendor":"GitLab","product":"Community Edition and Enterprise Edition","vulnerability_name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","short_description":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","due_date":"2026-11-01","ransomware_use":"Unknown","ransomware_known":false,"cwes":["CWE-190"],"content_hash":"sha256:a0e8066354cce039ad27dd6ab178f9e52c92e72f2435bb936cb684ed9b54f988","first_seen_observed":"2026-11-05T02:46:11.029Z","is_new":false,"amended":false,"age_observed_days":0,"age_source":"observed","change_confidence":{"level":"none","score":0,"signals":[],"age_source":"observed"}}],"upgrade":{"path":"/records/exploits","price":"$0.02","example":"/records/exploits?ransomware=true&since=2026-10-01T00:00:00Z&limit=50","pay_with":"x402 (HTTP 402) — USDC on Base, no API key. See /.well-known/x402."},"generated_at":"2026-11-05T04:13:25.554Z"}