Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to CVEs and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse feed RSS feed JSON API

KEVs Observed: 90; Known exploited vulnerabilities seen in the selected window
Exploitation Events: 4,733; Attempts mapped to tracked CVEs across the sensor network
Attacker IPs: 759; Unique source addresses observed in the selected window

Exploitation Attempts

Seven-day activity, grouped by observation date · 08 Aug–15 Aug 2026 UTC

Exploitation Attempts

Seven-day activity, grouped by observation date

604

475

401

829

700

740

965

8 Aug 9 Aug 10 Aug 11 Aug 12 Aug 13 Aug 14 Aug 15 Aug

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume CVEs in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

CVE-2026-63030 #1

WordPress

Attempts: 911
Attackers: 43
Sensors: 2

CVE-2018-20062 #2

NoneCms

Attempts: 730
Attackers: 159
Sensors: 30

CVE-2022-47945 #3

ThinkPHP Framework

ThinkPHP

Attempts: 695
Attackers: 150
Sensors: 29

CVE-2021-41773 #4

Apache HTTP Server

Apache Software Foundation

Attempts: 634
Attackers: 211
Sensors: 30

CVE-2026-55040 #5

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Microsoft

Attempts: 366
Attackers: 22
Sensors: 1

CVE-2025-55182 #6

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE / Product	Attempts	Attacker IPs	Sensors	First Seen	Last Seen
CVE-2026-63030 WordPress · WordPress	911	43	2	19 Jul · 16:02	14 Aug · 21:19
CVE-2018-20062 NoneCms · NoneCms	730	159	30	05 Jul · 09:37	15 Aug · 01:05
CVE-2022-47945 ThinkPHP Framework · ThinkPHP	695	150	29	08 Jun · 22:26	15 Aug · 01:01
CVE-2021-41773 Apache HTTP Server · Apache Software Foundation	634	211	30	29 Jun · 11:05	15 Aug · 00:59
CVE-2026-55040 Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition · Microsoft	366	22	1	19 Jul · 02:09	14 Aug · 14:33
CVE-2025-55182 react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel · Meta	294	21	10	09 Jun · 14:41	14 Aug · 21:51
CVE-2026-9198 Langflow OSS · IBM	160	99	18	06 Jul · 14:26	14 Aug · 22:50
CVE-2026-8037 LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF · Progress Software	131	14	3	30 Jun · 07:54	14 Aug · 10:15
CVE-2026-0770 Langflow · Langflow	110	43	9	27 Jun · 10:18	14 Aug · 22:55
CVE-2022-41040 Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft	87	85	30	01 Jul · 03:59	14 Aug · 23:29
CVE-2026-10520 Sentry · ivanti	74	38	2	10 Jun · 09:03	13 Aug · 02:05
CVE-2018-10562 GPON home routers · Dasan	38	38	20	09 Jun · 01:20	14 Aug · 23:34
CVE-2024-12847 DGN1000 · NETGEAR	38	38	21	09 Jun · 10:18	15 Aug · 00:04
CVE-2024-20767 ColdFusion · Adobe	36	15	12	12 Jun · 00:33	14 Aug · 17:30
CVE-2026-4020 Gravity SMTP · RocketGenius	36	21	14	12 Jun · 00:35	14 Aug · 08:43
CVE-2018-13379 Fortinet FortiOS, FortiProxy · Fortinet	31	28	25	29 Jun · 18:59	14 Aug · 15:59
CVE-2017-18368 P660HN-T1A v1 TCLinux Fw · ZyXEL	30	13	1	09 Jun · 16:18	14 Aug · 09:30
CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) Software · Cisco	28	28	25	29 Jun · 18:59	14 Aug · 15:21
CVE-2026-52813 gogs · gogs	28	10	10	26 Jun · 16:33	14 Aug · 17:30
CVE-2020-5902 BIG-IP · F5	21	7	7	12 Jun · 00:32	12 Aug · 05:56
CVE-2026-20253 Splunk Enterprise · Splunk	19	3	1	12 Jun · 21:36	13 Aug · 14:33
CVE-2025-8943 Flowise · Flowise	18	10	2	10 Jul · 15:38	15 Aug · 00:27
CVE-2025-1302 jsonpath-plus · JSONPath-Plus	14	1	1	12 Jun · 00:34	12 Aug · 21:48
CVE-2014-2383 dompdf · dompdf	14	11	1	27 Jun · 09:30	12 Aug · 12:02
CVE-2013-2251 Struts · Apache	13	8	1	11 Jul · 16:18	12 Aug · 12:02
CVE-2022-46169 cacti · Cacti	12	12	1	10 Jul · 03:21	08 Aug · 11:11
CVE-2026-49049 Helix3 extension for Joomla · joomshaper.com	10	1	1	11 Aug · 07:17	11 Aug · 15:09
CVE-2017-10271 WebLogic Server · Oracle Corporation	8	4	2	12 Jun · 00:32	14 Aug · 20:39
CVE-2014-8361 SDK · Realtek	8	7	1	27 Jun · 01:44	14 Aug · 23:13
CVE-2026-48282 ColdFusion · Adobe	6	4	2	02 Jul · 16:52	12 Aug · 21:55
CVE-2025-20282 Cisco Identity Services Engine Software · Cisco	6	5	1	01 Aug · 10:35	13 Aug · 06:32
CVE-2026-34910 UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial · Ubiquiti Inc	5	2	2	11 Jun · 12:15	13 Aug · 09:15
CVE-2013-3821 PeopleSoft Products · Oracle	5	1	1	14 Jul · 03:14	08 Aug · 10:30
CVE-2025-31324 SAP NetWeaver (Visual Composer development server) · SAP_SE	5	2	2	11 Jul · 19:33	12 Aug · 21:49
CVE-2025-5777 ADC, Gateway · NetScaler	4	3	1	01 Jul · 07:49	09 Aug · 16:41
CVE-2024-24919 Check Point Quantum Gateway, Spark Gateway and CloudGuard Network · checkpoint	4	4	1	27 Jun · 10:06	13 Aug · 20:07
CVE-2022-21587 Web Applications Desktop Integrator · Oracle Corporation	4	1	1	19 Jul · 02:08	09 Aug · 02:37
CVE-2026-46442 Flowise · FlowiseAI	4	2	1	13 Jul · 04:05	13 Aug · 11:22
CVE-2020-14882 WebLogic Server · Oracle Corporation	4	1	1	10 Jun · 21:20	14 Aug · 20:39
CVE-2026-29059 windmill · windmill-labs	4	1	1	03 Jul · 04:25	12 Aug · 21:56
CVE-2026-55450 langflow · langflow-ai	4	3	2	08 Aug · 21:08	12 Aug · 21:54
CVE-2024-37014 Langflow · langflow-ai	4	3	1	13 Jul · 04:36	13 Aug · 06:36
CVE-2026-5027 langflow · langflow-ai	4	3	1	10 Jul · 15:10	13 Aug · 09:03
CVE-2023-4966 NetScaler ADC, NetScaler Gateway · Citrix	3	2	1	12 Jun · 00:33	14 Aug · 18:32
CVE-2025-2505 Age Gate · philsbury	3	2	2	08 Aug · 20:44	12 Aug · 21:45
CVE-2016-10372 D1000 modem · Eir	3	3	1	26 Jun · 01:16	14 Aug · 22:21
CVE-2025-20281 Cisco Identity Services Engine Software · Cisco	3	3	2	19 Jul · 02:11	13 Aug · 13:34
CVE-2020-14883 WebLogic Server · Oracle Corporation	3	1	1	12 Jun · 00:32	14 Aug · 20:39
CVE-2026-35273 PeopleSoft Enterprise PeopleTools · Oracle Corporation	2	2	2	14 Jun · 13:47	12 Aug · 21:53
CVE-2026-15409 SMA1000 · SonicWall	2	2	2	17 Jul · 15:14	12 Aug · 21:55

CVE-2026-63030

WordPress

Attempts: 911
Attacker IPs: 43
Sensors: 2

CVE-2018-20062

NoneCms

Attempts: 730
Attacker IPs: 159
Sensors: 30

CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts: 695
Attacker IPs: 150
Sensors: 29

CVE-2021-41773

Apache HTTP Server

Apache Software Foundation

Attempts: 634
Attacker IPs: 211
Sensors: 30

CVE-2026-55040

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Microsoft

Attempts: 366
Attacker IPs: 22
Sensors: 1

CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.