Day 214 of the Vulnpocalypse
AI finds bugs faster than anyone can fix them. Here is what to patch.
Since Claude Mythos Preview on 7 April 2026, CVE volume has more than doubled. Vulnpocalypse tracks every major exploited bug, supply-chain attack and breach, scores them live, and tells developers what to do.
Vulnerability pressure
All dataNew bugs
CVEs published, last three months against the same months a year earlier.
362%
OF LAST YEAR DOUBLE
44,249 CVEs in Aug to Oct 2026, against 12,222 a year earlier.
Exploitation
Bugs added to CISA’s exploited list, last three months against the same months a year earlier.
177%
OF LAST YEAR UP
110 bugs in Aug to Oct 2026, against 62 a year earlier.
Zero-day exploitation
Exploited bugs listed on or before the day their CVE was published, last three months against the same months a year earlier.
220%
OF LAST YEAR DOUBLE
22 bugs in Aug to Oct 2026, against 10 a year earlier.
The score that sees attacks coming
How we tested itVEDAS
90%
of the bugs attackers went on to use were already in the top 35% of CVEs by VEDAS, before CISA confirmed the attacks.
EPSS
53%
for the top 35% by EPSS, the industry’s standard exploit forecast. Same patching effort, 37 points fewer attacks covered.
Latest advisories
All 1326- Vexy ransomware group claims ZipAI on its leak site, RansomLook reports
- SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, CISA says in KEV listing
- Scry Analytics claimed by n0n ransomware group on its leak site, per RansomLook
- Rapid7 reports new Metasploit modules for Citrix NetScaler, Flowise, SPIP
- Qilin ransomware group claims Rotstein & Shiffman on its leak site
- Palo Alto Networks CEO says AI finds flaws faster than firms can patch
Getting more dangerous right now
All moversBiggest rises in attack forecast since the last update (2026-11-04).
| CVE | Rise | Chance of attack (EPSS) | On CISA KEV | Detection rule |
|---|---|---|---|---|
| CVE-2026-102764 | +0.59 | 0.78 | Yes | No public rule yet |
| CVE-2026-97229 | +0.38 | 0.65 | Yes | No public rule yet |
| CVE-2025-23200 | +0.18 | 0.49 | No | No public rule yet |
| CVE-2026-96652 | +0.10 | 0.12 | Yes | No public rule yet |
| CVE-2019-6446 | +0.10 | 0.27 | No | No public rule yet |