Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse KEV feedStart 14-day Pro trial

Also available as an RSS feed or JSON API.

KEVs Observed
230
Known exploited vulnerabilities seen in the selected window
Exploitation Events
260,842
Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs
5,031
Unique source addresses observed in the selected window

Exploitation Attempts

30-day activity, grouped by observation date · 09 Sep–09 Oct 2026 UTC

Exploitation Attempts

30-day activity, grouped by observation date

6,712
6,909
6,076
5,068
4,228
4,960
5,698
4,254
8,656
6,811
7,061
7,449
6,549
7,259
7,207
11,209
9,768
10,901
8,967
16,988
11,389
12,991
10,254
10,405
9,634
9,064
12,793
9,554
11,341
9,250
1,437
9 Sep 16 Sep 23 Sep 30 Sep 9 Oct

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record
CVE-2017-9841 #1

PHPUnit

PHPUnit

Attempts
136,169
Attackers
718
Sensors
76
CVE-2025-55182 #2

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
23,522
Attackers
534
Sensors
76
CVE-2024-4577 #3

PHP

PHP Group

Attempts
20,824
Attackers
858
Sensors
74
CVE-2026-39364 #4

vite, vite-plus

Vitejs

Attempts
13,074
Attackers
446
Sensors
46
CVE-2021-36260 #5

IP Camera

Hikvision

Attempts
11,709
Attackers
27
Sensors
29
CVE-2018-20062 #6

NoneCms

NoneCms

Attempts
6,893
Attackers
588
Sensors
74

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique attacker IPs indicate breadth. Last seen shows how recently the activity was observed. Use the linked CVE record for evidence and remediation context.

CVE-2017-9841

PHPUnit

PHPUnit

Attempts
136,169
Change
↑ 77,216 attempts
Attackers
718
Last Seen
09 Oct · 04:09
CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
23,522
Change
↓ 719 attempts
Attackers
534
Last Seen
09 Oct · 03:54
CVE-2024-4577

PHP

PHP Group

Attempts
20,824
Change
↑ 9,865 attempts
Attackers
858
Last Seen
09 Oct · 04:08
CVE-2026-39364

vite, vite-plus

Vitejs

Attempts
13,074
Change
New
Attackers
446
Last Seen
08 Oct · 21:58
CVE-2021-36260

IP Camera

Hikvision

Attempts
11,709
Change
↑ 11,695 attempts
Attackers
27
Last Seen
08 Oct · 20:10
CVE-2018-20062

NoneCms

NoneCms

Attempts
6,893
Change
↑ 2,675 attempts
Attackers
588
Last Seen
09 Oct · 04:09
CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts
6,422
Change
↑ 2,614 attempts
Attackers
519
Last Seen
09 Oct · 04:09
CVE-2026-75650

Adobe Commerce, Adobe Commerce B2B, Magento Open Source

Adobe

Attempts
5,596
Change
↑ 5,578 attempts
Attackers
97
Last Seen
08 Oct · 20:57
CVE-2021-41773

Apache HTTP Server

Apache

Attempts
5,199
Change
↑ 1,862 attempts
Attackers
837
Last Seen
09 Oct · 04:08
CVE-2026-87902

WordPress

WordPress

Attempts
5,038
Change
New
Attackers
25
Last Seen
08 Oct · 22:47
CVE-2026-63030

WordPress

WordPress

Attempts
3,812
Change
↓ 611 attempts
Attackers
248
Last Seen
09 Oct · 04:03
CVE-2023-2825

GitLab

GitLab

Attempts
1,972
Change
↑ 1,926 attempts
Attackers
322
Last Seen
08 Oct · 19:06
CVE-2026-0768

Langflow

Langflow

Attempts
1,795
Change
↑ 1,007 attempts
Attackers
507
Last Seen
09 Oct · 03:38
CVE-2026-104286

FortiMail

Fortinet

Attempts
957
Change
New
Attackers
3
Last Seen
08 Oct · 07:53
CVE-2026-85706

GitLab

GitLab

Attempts
921
Change
New
Attackers
18
Last Seen
08 Oct · 02:04
CVE-2026-8037

LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF

Progress Software

Attempts
896
Change
↓ 1,164 attempts
Attackers
43
Last Seen
07 Oct · 13:04
CVE-2026-23536

Red Hat OpenShift AI (RHOAI)

Red Hat

Attempts
792
Change
↑ 790 attempts
Attackers
290
Last Seen
08 Oct · 21:58
CVE-2022-41040

Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft

Attempts
790
Change
↑ 435 attempts
Attackers
627
Last Seen
07 Oct · 14:26
CVE-2026-0769

Langflow

Langflow

Attempts
735
Change
↑ 731 attempts
Attackers
49
Last Seen
09 Oct · 00:14
CVE-2026-9198

Langflow OSS

IBM

Attempts
718
Change
↑ 200 attempts
Attackers
404
Last Seen
09 Oct · 04:09
CVE-2024-37014

Langflow

Langflow-ai

Attempts
679
Change
↑ 666 attempts
Attackers
37
Last Seen
07 Oct · 09:11
CVE-2021-44228

Apache Log4j2

Apache

Attempts
637
Change
↓ 99 attempts
Attackers
57
Last Seen
08 Oct · 14:30
CVE-2026-86538

knowns

Knowns-dev

Attempts
632
Change
New
Attackers
267
Last Seen
08 Oct · 21:58
CVE-2026-52813

gogs

Gogs

Attempts
588
Change
↑ 373 attempts
Attackers
26
Last Seen
09 Oct · 03:03
CVE-2026-82078

PaperCut MF/NG

PaperCut

Attempts
526
Change
↑ 493 attempts
Attackers
34
Last Seen
08 Oct · 08:23

Showing 25 of 25 highest-volume records · 09 Sep–09 Oct 2026 UTC · Change versus the previous 30 days