Vulnerability Tracker
Live coverage of every CVE that matters: which ones are being exploited right now, which need patching this week, and which are noise. Filtered by working analysts so your SOC patches what attackers are actually using.
Latest vulnerability coverage
All CVE coverage →No CVE posts yet. Add posts in the "Vulnerabilities" category to populate this section.
Latest additions to the CISA KEV catalog
| CVE | Vendor | Product | Vulnerability | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-28318 | SolarWinds | Serv-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | June 5, 2026 | — |
| CVE-2026-45247 | Mirasvit | Mirasvit Full Page Cache Warmer | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | June 3, 2026 | — |
| CVE-2022-0492 | Linux | Kernel | Linux Kernel Improper Authentication Vulnerability | June 2, 2026 | — |
| CVE-2025-48595 | Android | Framework | Android Framework Integer Overflow Vulnerability | June 2, 2026 | — |
| CVE-2024-21182 | Oracle | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | June 1, 2026 | — |
| CVE-2026-0257 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | May 29, 2026 | — |
| CVE-2026-48027 | Nx | Nx Console | Nx Console Embedded Malicious Code Vulnerability | May 27, 2026 | Known |
| CVE-2026-45321 | TanStack | TanStack | TanStack Unspecified Vulnerability | May 27, 2026 | Known |
| CVE-2026-8398 | Daemon | Daemon Tools Lite | Daemon Tools Lite Embedded Malicious Code Vulnerability | May 27, 2026 | — |
| CVE-2026-48172 | LiteSpeed | cPanel Plugin | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | May 26, 2026 | — |
| CVE-2026-9082 | Drupal | Core | Drupal Core SQL Injection Vulnerability | May 22, 2026 | — |
| CVE-2025-34291 | Langflow | Langflow | Langflow Origin Validation Error Vulnerability | May 21, 2026 | — |
Source: CISA Known Exploited Vulnerabilities catalog. U.S. Government work, public domain. Refreshed hourly via WP-cron.
How TCN prioritises CVE response
70% of breaches involve a CVE that had been public for over a year. The fix is not "patch everything" — it is "patch what attackers are actually using". Here is the rubric we use to triage.
See top vulnerability-management platforms →- Patch any CVE on the CISA KEV catalog within 7 days.
- CVSS 9.0+ with public exploit code: 14-day SLA.
- Internet-facing assets first, internal second, air-gapped last.
- Track ransomware-affiliate-favourite CVEs separately — they move from KEV-add to mass exploitation in under 72 hours.
- Use compensating controls (WAF rules, IDS signatures) when patch windows are blocked.
- Validate exposure with internal scans before assuming a vendor advisory describes your environment.
Get a vulnerability-management shortlist
Tell us your environment, asset count and compliance needs. We will send three vetted platforms that match — within 24 hours. Free.