Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse KEV feedStart 14-day Pro trial

Also available as an RSS feed or JSON API.

KEVs Observed
67
Known exploited vulnerabilities seen in the selected window
Exploitation Events
9,779
Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs
333
Unique source addresses observed in the selected window

Exploitation Attempts

24-hour activity, grouped by observation date · 08 Oct–09 Oct 2026 UTC

Exploitation Attempts

24-hour activity, grouped by observation date

8,342
1,437
8 Oct 9 Oct

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record
CVE-2017-9841 #1

PHPUnit

PHPUnit

Attempts
5,446
Attackers
75
Sensors
63
CVE-2026-39364 #2

vite, vite-plus

Vitejs

Attempts
1,019
Attackers
34
Sensors
8
CVE-2024-4577 #3

PHP

PHP Group

Attempts
1,008
Attackers
112
Sensors
61
CVE-2018-20062 #5

NoneCms

NoneCms

Attempts
285
Attackers
62
Sensors
58
CVE-2022-47945 #6

ThinkPHP Framework

ThinkPHP

Attempts
272
Attackers
60
Sensors
57

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique attacker IPs indicate breadth. Last seen shows how recently the activity was observed. Use the linked CVE record for evidence and remediation context.

CVE-2017-9841

PHPUnit

PHPUnit

Attempts
5,446
Change
↓ 20 attempts
Attackers
75
Last Seen
09 Oct · 04:09
CVE-2026-39364

vite, vite-plus

Vitejs

Attempts
1,019
Change
↑ 950 attempts
Attackers
34
Last Seen
08 Oct · 21:58
CVE-2024-4577

PHP

PHP Group

Attempts
1,008
Change
↑ 238 attempts
Attackers
112
Last Seen
09 Oct · 04:08
CVE-2026-104286

FortiMail

Fortinet

Attempts
478
Change
New
Attackers
1
Last Seen
08 Oct · 07:53
CVE-2018-20062

NoneCms

NoneCms

Attempts
285
Change
↑ 2 attempts
Attackers
62
Last Seen
09 Oct · 04:09
CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts
272
Change
↓ 2 attempts
Attackers
60
Last Seen
09 Oct · 04:09
CVE-2021-41773

Apache HTTP Server

Apache

Attempts
230
Change
↑ 49 attempts
Attackers
120
Last Seen
09 Oct · 04:08
CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
164
Change
↑ 18 attempts
Attackers
33
Last Seen
09 Oct · 03:54
CVE-2026-21589

Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center

Atlassian

Attempts
110
Change
↓ 1 attempts
Attackers
20
Last Seen
09 Oct · 04:09
CVE-2026-48313

ColdFusion 2025, ColdFusion 2023

Adobe

Attempts
105
Change
↑ 103 attempts
Attackers
1
Last Seen
08 Oct · 11:28
CVE-2026-63030

WordPress

WordPress

Attempts
80
Change
↓ 132 attempts
Attackers
14
Last Seen
09 Oct · 04:03
CVE-2026-52813

gogs

Gogs

Attempts
72
Change
↓ 21 attempts
Attackers
6
Last Seen
09 Oct · 03:03
CVE-2023-2825

GitLab

GitLab

Attempts
61
Change
↑ 53 attempts
Attackers
13
Last Seen
08 Oct · 19:06
CVE-2026-87902

WordPress

WordPress

Attempts
48
Change
↓ 1,704 attempts
Attackers
2
Last Seen
08 Oct · 22:47
CVE-2026-0257

Cloud NGFW, PAN-OS, Prisma Access

Palo Alto Networks

Attempts
33
Change
↓ 135 attempts
Attackers
3
Last Seen
08 Oct · 17:41
CVE-2026-9198

Langflow OSS

IBM

Attempts
32
Change
↑ 3 attempts
Attackers
22
Last Seen
09 Oct · 04:09
CVE-2026-15409

SMA1000

SonicWall

Attempts
30
Change
New
Attackers
1
Last Seen
09 Oct · 02:44
CVE-2025-8943

Flowise

Flowise

Attempts
27
Change
↓ 1 attempts
Attackers
3
Last Seen
09 Oct · 04:00
CVE-2018-10562

GPON home routers

Dasan

Attempts
22
Change
↑ 7 attempts
Attackers
22
Last Seen
09 Oct · 03:06
CVE-2026-75650

Adobe Commerce, Adobe Commerce B2B, Magento Open Source

Adobe

Attempts
22
Change
↓ 195 attempts
Attackers
2
Last Seen
08 Oct · 20:57
CVE-2024-12847

DGN1000

NETGEAR

Attempts
21
Change
↑ 4 attempts
Attackers
21
Last Seen
09 Oct · 02:17
CVE-2026-0768

Langflow

Langflow

Attempts
20
Change
↑ 14 attempts
Attackers
13
Last Seen
09 Oct · 03:38
CVE-2021-44228

Apache Log4j2

Apache

Attempts
18
Change
↑ 2 attempts
Attackers
5
Last Seen
08 Oct · 14:30
CVE-2026-23536

Red Hat OpenShift AI (RHOAI)

Red Hat

Attempts
12
Change
↑ 11 attempts
Attackers
4
Last Seen
08 Oct · 21:58
CVE-2026-89013

Dolibarr

Dolibarr

Attempts
11
Change
↑ 10 attempts
Attackers
11
Last Seen
08 Oct · 16:32

Showing 25 of 25 highest-volume records · 08 Oct–09 Oct 2026 UTC · Change versus the previous 24 hours