Every week, thousands of new CVEs get published. Almost none of them matter to you. Two lists do: the vulnerabilities attackers are already exploiting, and the fresh criticals affecting the software you actually run. So I built a monitor that watches both — and it is now live on this site.
What CVE Watch shows
The tool pulls two free, authoritative feeds and merges them into one sortable, filterable table, updated several times a day:
- KEV — CISA’s Known Exploited Vulnerabilities catalog. This is the “patch first” list: every entry is confirmed to be exploited in the wild. The catalog currently holds 1,710 vulnerabilities and the latest additions are dominated by Microsoft (7), Cisco (4), JFrog (4) and N-able (3). Two of the recent additions are flagged as used in ransomware campaigns.
- NVD — the National Vulnerability Database feed. Raw CVE volume is huge, so the monitor filters new publications to stacks worth watching — server OS, web servers, PHP/WordPress, Python/Node/Java runtimes, containers, databases and network appliances — and ranks them by CVSS.
Why the KEV filter matters more than CVSS
A CVSS 9.8 in a product nobody exploits is a lower priority than a CVSS 7.5 that ransomware crews are actively using. That is the entire logic behind the split view:
- The KEV view answers “what do I need to patch now“. Every item there has a CISA due date for federal agencies — a good proxy for urgency even outside government.
- The NVD view answers “what just became public” — things to watch before they reach the exploitation stage.
What the current snapshot says
A few things stand out in the data the monitor collected this cycle:
- CVE-2026-81648 — CVSS 10.0: the CryptoPayment Gateway WordPress plugin fails to apply authentication on a critical function. A perfect score, and it sits in the exact ecosystem this site runs on.
- Apache Syncope cluster: nine separate incorrect-authorization / improper-privilege issues at 9.1–9.8 in the same product, published together — a classic vendor “batch fix” pattern.
- froxlor 9.9 (CVE-2026-90937): a web-hosting control panel failing to validate newline characters in subdomain records — hosting panels are exactly the kind of soft target attackers love.
- Cisco Secure Email Gateway: five fresh 9.8s in the AsyncOS email-parsing path — internet-facing by design, which is what makes these dangerous.
Honest limits
- NVD CVSS scores are initial triage scores — some get revised down later. The table shows what was published.
- “Relevant” is a filter, not a guarantee: if you run an exotic stack, check the full NVD feed yourself.
- KEV membership is a lagging indicator — a CVE lands there after exploitation is confirmed, not before.
The monitor keeps its own history, so over time it will also answer the more interesting questions: which vendors dominate the exploited list, how fast new CVEs move from published to exploited, and which product categories attract ransomware crews. Those numbers will become posts on their own.
