Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse KEV feedStart 14-day Pro trial

Also available as an RSS feed or JSON API.

KEVs Observed
177
Known exploited vulnerabilities seen in the selected window
Exploitation Events
73,056
Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs
1,839
Unique source addresses observed in the selected window

Exploitation Attempts

Seven-day activity, grouped by observation date · 02 Oct–09 Oct 2026 UTC

Exploitation Attempts

Seven-day activity, grouped by observation date

10,405
9,634
9,064
12,793
9,554
11,341
9,250
1,015
2 Oct 3 Oct 4 Oct 5 Oct 6 Oct 7 Oct 8 Oct 9 Oct

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record
CVE-2017-9841 #1

PHPUnit

PHPUnit

Attempts
44,769
Attackers
311
Sensors
75
CVE-2024-4577 #2

PHP

PHP Group

Attempts
6,895
Attackers
371
Sensors
73
CVE-2026-87902 #3

WordPress

WordPress

Attempts
3,608
Attackers
12
Sensors
4
CVE-2026-39364 #4

vite, vite-plus

Vitejs

Attempts
2,639
Attackers
118
Sensors
20
CVE-2018-20062 #5

NoneCms

NoneCms

Attempts
2,221
Attackers
215
Sensors
72
CVE-2022-47945 #6

ThinkPHP Framework

ThinkPHP

Attempts
2,133
Attackers
205
Sensors
71

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique attacker IPs indicate breadth. Last seen shows how recently the activity was observed. Use the linked CVE record for evidence and remediation context.

CVE-2017-9841

PHPUnit

PHPUnit

Attempts
44,769
Change
↑ 4,747 attempts
Attackers
311
Last Seen
09 Oct · 03:39
CVE-2024-4577

PHP

PHP Group

Attempts
6,895
Change
↑ 431 attempts
Attackers
371
Last Seen
09 Oct · 03:26
CVE-2026-87902

WordPress

WordPress

Attempts
3,608
Change
↑ 2,316 attempts
Attackers
12
Last Seen
08 Oct · 22:47
CVE-2026-39364

vite, vite-plus

Vitejs

Attempts
2,639
Change
↓ 1,796 attempts
Attackers
118
Last Seen
08 Oct · 21:58
CVE-2018-20062

NoneCms

NoneCms

Attempts
2,221
Change
↑ 129 attempts
Attackers
215
Last Seen
09 Oct · 03:27
CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts
2,133
Change
↑ 221 attempts
Attackers
205
Last Seen
09 Oct · 03:27
CVE-2021-41773

Apache HTTP Server

Apache

Attempts
1,603
Change
↑ 108 attempts
Attackers
385
Last Seen
09 Oct · 03:26
CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
1,299
Change
↓ 11,936 attempts
Attackers
199
Last Seen
09 Oct · 03:39
CVE-2026-63030

WordPress

WordPress

Attempts
1,186
Change
↑ 110 attempts
Attackers
68
Last Seen
09 Oct · 01:25
CVE-2026-104286

FortiMail

Fortinet

Attempts
957
Change
New
Attackers
3
Last Seen
08 Oct · 07:53
CVE-2026-0257

Cloud NGFW, PAN-OS, Prisma Access

Palo Alto Networks

Attempts
477
Change
↑ 458 attempts
Attackers
137
Last Seen
08 Oct · 17:41
CVE-2026-52813

gogs

Gogs

Attempts
330
Change
↑ 293 attempts
Attackers
13
Last Seen
09 Oct · 03:03
CVE-2023-2825

GitLab

GitLab

Attempts
329
Change
↓ 288 attempts
Attackers
62
Last Seen
08 Oct · 19:06
CVE-2026-75650

Adobe Commerce, Adobe Commerce B2B, Magento Open Source

Adobe

Attempts
297
Change
↓ 3,576 attempts
Attackers
10
Last Seen
08 Oct · 20:57
CVE-2026-0768

Langflow

Langflow

Attempts
296
Change
↓ 411 attempts
Attackers
88
Last Seen
09 Oct · 03:38
CVE-2022-41040

Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft

Attempts
266
Change
↑ 67 attempts
Attackers
241
Last Seen
07 Oct · 14:26
CVE-2026-88772

ADC, Gateway

Citrix NetScaler

Attempts
240
Change
New
Attackers
1
Last Seen
07 Oct · 18:24
CVE-2026-21589

Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center

Atlassian

Attempts
233
Change
New
Attackers
40
Last Seen
09 Oct · 02:07
CVE-2026-88771

ADC, Gateway

Citrix NetScaler

Attempts
222
Change
↑ 217 attempts
Attackers
12
Last Seen
09 Oct · 03:08
CVE-2025-8943

Flowise

Flowise

Attempts
206
Change
↑ 137 attempts
Attackers
14
Last Seen
09 Oct · 03:01
CVE-2026-9198

Langflow OSS

IBM

Attempts
179
Change
↑ 47 attempts
Attackers
116
Last Seen
09 Oct · 03:25
CVE-2026-55450

langflow

Langflow-ai

Attempts
171
Change
↑ 159 attempts
Attackers
6
Last Seen
07 Oct · 16:55
CVE-2018-10562

GPON home routers

Dasan

Attempts
129
Change
↑ 17 attempts
Attackers
117
Last Seen
09 Oct · 03:06
CVE-2021-44228

Apache Log4j2

Apache

Attempts
111
Change
↓ 26 attempts
Attackers
25
Last Seen
08 Oct · 14:30
CVE-2024-12847

DGN1000

NETGEAR

Attempts
110
Change
↓ 7 attempts
Attackers
106
Last Seen
09 Oct · 02:17

Showing 25 of 25 highest-volume records · 02 Oct–09 Oct 2026 UTC · Change versus the previous seven days