Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to CVEs and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse feed RSS feed JSON API

131
KEVs Observed: 45,986
Exploitation Events: —
Attacker IPs

Exploitation Attempts

90-day activity, grouped by observation date · 13 May–11 Aug 2026 UTC

Exploitation Attempts

90-day activity, grouped by observation date

365

126

536

232

370

341

176

168

366

303

682

130

170

183

284

721

526

939

361

10,798

581

439

437

443

582

693

661

805

571

759

763

1,163

796

596

562

1,012

640

920

731

700

482

925

680

1,278

793

537

1,034

809

777

634

839

728

860

583

1,089

621

474

401

440

13 May 1 Jun 20 Jun 9 Jul 11 Aug

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume CVEs in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

CVE-2026-10520 #1

Sentry

ivanti

Attempts: 8,074
Attackers: —
Sensors: —

CVE-2021-41773 #2

Apache HTTP Server

Apache Software Foundation

Attempts: 5,964
Attackers: —
Sensors: —

CVE-2022-47945 #3

ThinkPHP Framework

ThinkPHP

Attempts: 5,927
Attackers: —
Sensors: —

CVE-2018-20062 #4

NoneCms

Attempts: 3,139
Attackers: —
Sensors: —

CVE-2026-63030 #5

WordPress

Attempts: 2,029
Attackers: —
Sensors: —

CVE-2025-55182 #6

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE / Product	Attempts	Attacker IPs	First Seen	Last Seen
CVE-2026-10520 Sentry · ivanti	8,074	—	10 Jun · 09:03	10 Aug · 07:38
CVE-2021-41773 Apache HTTP Server · Apache Software Foundation	5,964	—	29 Jun · 11:05	11 Aug · 10:40
CVE-2022-47945 ThinkPHP Framework · ThinkPHP	5,927	—	08 Jun · 22:26	11 Aug · 10:40
CVE-2018-20062 NoneCms · NoneCms	3,139	—	05 Jul · 09:37	11 Aug · 10:40
CVE-2026-63030 WordPress · WordPress	2,029	—	19 Jul · 16:02	11 Aug · 08:30
CVE-2025-55182 react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel · Meta	2,022	—	09 Jun · 14:41	11 Aug · 10:35
CVE-2026-0770 Langflow · Langflow	1,962	—	27 Jun · 10:18	11 Aug · 10:35
CVE-2026-8037 LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF · Progress Software	1,497	—	30 Jun · 07:54	11 Aug · 05:20
CVE-2026-20230 Cisco Unified Communications Manager · Cisco	1,321	—	25 Jun · 02:30	30 Jul · 09:54
CVE-2026-20253 Splunk Enterprise · Splunk	1,243	—	12 Jun · 21:36	11 Aug · 09:42
CVE-2026-35273 PeopleSoft Enterprise PeopleTools · Oracle Corporation	1,062	—	14 Jun · 13:47	07 Aug · 16:53
CVE-2026-46817 Oracle Payments · Oracle Corporation	1,008	—	01 Jul · 01:33	09 Aug · 02:26
CVE-2026-9198 Langflow OSS · IBM	745	—	06 Jul · 14:26	11 Aug · 10:35
CVE-2026-39808 FortiSandbox, FortiSandbox PaaS · Fortinet	563	—	12 Jun · 13:59	08 Aug · 08:26
CVE-2022-41040 Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft	493	—	01 Jul · 03:59	10 Aug · 20:19
CVE-2026-15409 SMA1000 · SonicWall	474	—	17 Jul · 15:14	08 Aug · 21:19
CVE-2026-4020 Gravity SMTP · RocketGenius	466	—	12 Jun · 00:35	11 Aug · 10:09
CVE-2024-12847 DGN1000 · NETGEAR	459	—	09 Jun · 10:18	11 Aug · 07:13
CVE-2014-2383 dompdf · dompdf	450	—	27 Jun · 09:30	08 Aug · 04:43
CVE-2020-14882 WebLogic Server · Oracle Corporation	356	—	10 Jun · 21:20	07 Aug · 15:13
CVE-2017-18368 P660HN-T1A v1 TCLinux Fw · ZyXEL	353	—	09 Jun · 16:18	11 Aug · 05:02
CVE-2026-52813 gogs · gogs	340	—	26 Jun · 16:33	11 Aug · 10:09
CVE-2018-10562 GPON home routers · Dasan	316	—	09 Jun · 01:20	11 Aug · 06:30
CVE-2024-37014 Langflow · langflow-ai	298	—	13 Jul · 04:36	08 Aug · 07:17
CVE-2025-61882 Oracle Concurrent Processing · Oracle Corporation	276	—	01 Jul · 01:33	01 Jul · 03:19
CVE-2022-46169 cacti · Cacti	225	—	10 Jul · 03:21	08 Aug · 11:11
CVE-2020-5902 BIG-IP · F5	214	—	12 Jun · 00:32	11 Aug · 10:09
CVE-2026-48282 ColdFusion · Adobe	213	—	02 Jul · 16:52	07 Aug · 09:50
CVE-2023-1389 TP-Link Archer AX21 (AX1800) · TP-Link	203	—	11 Jun · 06:25	07 Aug · 09:49
CVE-2026-16723 Fastjson · Alibaba	192	—	27 Jul · 01:37	27 Jul · 02:05
CVE-2018-13379 Fortinet FortiOS, FortiProxy · Fortinet	181	—	29 Jun · 18:59	10 Aug · 22:03
CVE-2023-26801 BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300 · LB-LINK	171	—	25 Jun · 17:17	06 Aug · 08:11
CVE-2017-10271 WebLogic Server · Oracle Corporation	165	—	12 Jun · 00:32	31 Jul · 09:25
CVE-2017-9822 DotNetNuke CMS Fixed in 9.1.1 · DotNetNuke	162	—	12 Jun · 00:32	23 Jul · 09:26
CVE-2025-71334 Flowise · Flowise	158	—	03 Jul · 09:04	01 Aug · 19:56
CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) Software · Cisco	128	—	29 Jun · 18:59	08 Aug · 14:04
CVE-2025-34037 E4200, E3200, E3000, E2500 v1/v2, E2100L v1, E2000, E1550, E1500 v1, E1200 v1, E1000 v1, E900 v1 · Linksys	116	—	07 Jul · 16:17	07 Aug · 09:50
CVE-2020-17518 Apache Flink · Apache Software Foundation	113	—	12 Jun · 00:32	23 Jul · 11:21
CVE-2024-20767 ColdFusion · Adobe	110	—	12 Jun · 00:33	11 Aug · 07:32
CVE-2023-20198 Cisco IOS XE Software · Cisco	108	—	12 Jun · 00:33	07 Aug · 09:50
CVE-2021-41277 metabase · metabase	101	—	30 Jun · 18:33	09 Aug · 11:08
CVE-2020-14883 WebLogic Server · Oracle Corporation	93	—	12 Jun · 00:32	01 Aug · 14:43
CVE-2026-39813 FortiSandbox, FortiSandbox Cloud · Fortinet	90	—	15 Jun · 12:48	05 Aug · 03:48
CVE-2024-8181 Flowise · FlowiseAI	89	—	12 Jun · 00:34	24 Jul · 14:45
CVE-2021-24212 WooCommerce Help Scout · Unknown	89	—	12 Jun · 00:32	30 Jul · 19:52
CVE-2013-3821 PeopleSoft Products · Oracle	87	—	14 Jul · 03:14	08 Aug · 10:30
CVE-2013-2251 Struts · Apache	76	—	11 Jul · 16:18	08 Aug · 04:43
CVE-2014-3120 Elasticsearch · Elastic	69	—	27 Jun · 09:30	08 Aug · 04:43
CVE-2026-48313 ColdFusion · Adobe	67	—	08 Jul · 02:39	07 Aug · 09:50
CVE-2017-12637 NetWeaver Application Server Java · SAP	64	—	12 Jun · 00:36	19 Jul · 02:14

CVE-2026-10520

Sentry

ivanti

Attempts: 8,074
Attacker IPs: —

CVE-2021-41773

Apache HTTP Server

Apache Software Foundation

Attempts: 5,964
Attacker IPs: —

CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts: 5,927
Attacker IPs: —

CVE-2018-20062

NoneCms

Attempts: 3,139
Attacker IPs: —

CVE-2026-63030

WordPress

Attempts: 2,029
Attacker IPs: —

CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Get High-Impact KEV Alerts by Email

KEV Intelligence tracks known exploited vulnerabilities beyond CISA KEV. Subscribe for occasional, curator-picked alerts when exploitation warrants attention. For every update, use the RSS feed or API.