{"title":"Vulnerability data advisories","description":"Changes to the vulnerability data developers depend on: CVE, NVD, OSV, GHSA, CISA KEV and EPSS.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/akamai-says-ai-found-bugs-mean-rethinking-exposure-response/","title":"Akamai says AI-found bugs mean rethinking exposure response","url":"https://vulnpocalypse.dev/advisories/akamai-says-ai-found-bugs-mean-rethinking-exposure-response/","date":"2026-11-12","summary":"Akamai published a blog post on AI finding vulnerabilities and rethinking exposure; only the headline was reviewed, so no action is confirmed.","tags":["ai-tools","ai-tools","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/blue-initiative-launches-maritime-vulnerability-database-infosecurity-reports/","title":"Blue Initiative launches maritime vulnerability database, Infosecurity reports","url":"https://vulnpocalypse.dev/advisories/blue-initiative-launches-maritime-vulnerability-database-infosecurity-reports/","date":"2026-11-11","summary":"Infosecurity Magazine reports an industry group launched a maritime CVE repository, so maritime IT and OT teams can evaluate it as an extra feed.","tags":["ecosystem","vuln-data","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/","title":"Mythos-era exploitation statistics: 14 of 1,061 AI-found vulnerabilities exploited, and what Firefox 150's","url":"https://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/","date":"2026-11-11","summary":"VulnCheck found 1.3% of AI-found vulnerabilities exploited in 1H 2026, the same as all bugs. Patch AI-found CVEs by exposure, not by how they were found.","tags":["ai-tools","ai-tools","vuln-data","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/","title":"NVD stops enriching most CVEs: your scanner's severity data now has gaps","url":"https://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/","date":"2026-11-11","summary":"Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.","tags":["ecosystem","vuln-data","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/","title":"VulnCheck says Anthropic Glasswing CVEs are few, fixes lag","url":"https://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/","date":"2026-11-10","summary":"VulnCheck says 442 CVEs trace to Anthropic's Glasswing, 2 exploited; check those two CVEs and treat scanner reports as unverified.","tags":["ai-tools","ai-tools","open-source","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/","title":"ReversingLabs reports AI-linked malware signals rising, no clear attack surge","url":"https://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/","date":"2026-11-10","summary":"ReversingLabs says LLM API references in malicious files are rising but no AI attack surge is shown; review exposure to PHP2Shell CVEs.","tags":["ai-tools","ai-tools","php","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/mckinsey-report-critical-flaws-exploited-within-hours-of-disclosure/","title":"McKinsey report: critical flaws exploited within hours of disclosure","url":"https://vulnpocalypse.dev/advisories/mckinsey-report-critical-flaws-exploited-within-hours-of-disclosure/","date":"2026-11-09","summary":"A McKinsey report says critical flaws are now exploited within hours of disclosure; measure and shorten how long you take to fix them on critical systems.","tags":["ai-tools","ai-tools","enterprise","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-finds-flaws-faster-than-firms-can-patch/","title":"Palo Alto Networks CEO says AI finds flaws faster than firms can patch","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-finds-flaws-faster-than-firms-can-patch/","date":"2026-11-06","summary":"Palo Alto Networks CEO Nikesh Arora says AI finds software flaws faster than firms can fix them, so review triage capacity and interim virtual patching.","tags":["ai-tools","ai-tools","vuln-data","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/","title":"Nikkei reports Japan to seek vulnerability data from US AI firms","url":"https://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/","date":"2026-11-06","summary":"Nikkei reports Japan wants early access to undisclosed vulnerability data from US AI firms; PHP CVE details are not confirmed, so check PHP patches.","tags":["ai-tools","php","ai-tools","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/crowdstrike-reports-fast-exploitation-of-public-pocs-cites-cpanel-flaw/","title":"CrowdStrike reports fast exploitation of public PoCs, cites cPanel flaw","url":"https://vulnpocalypse.dev/advisories/crowdstrike-reports-fast-exploitation-of-public-pocs-cites-cpanel-flaw/","date":"2026-11-05","summary":"CrowdStrike reports a median under one day from public PoC to exploitation, citing cPanel CVE-2026-41940; review exposed cPanel and WHM servers.","tags":["exploited","web","open-source","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/","title":"Cloudflare launches Zero Wire, a public hub for triaging critical Internet vulnerabilities","url":"https://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/","date":"2026-11-04","summary":"Cloudflare launched Zero Wire on Radar, a public feed of briefings on critical vulnerabilities, with exploitation evidence kept separate from severity.","tags":["ecosystem","vuln-data","web","php","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/","title":"Microsoft analysis: 78% of exploited vulnerabilities are system takeover flaws, and patching lags","url":"https://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/","date":"2026-11-03","summary":"Microsoft found that about 0.5% of disclosed CVEs are exploited, 78% of those enable system takeover, and patching on servers and appliances lags far behind","tags":["exploited","enterprise","endpoint","network-edge","cloud","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/cisa-bod-26-04-three-day-kev-deadlines/","title":"CISA BOD 26-04 replaces BOD 22-01: three-day deadlines and forensic triage for the riskiest KEV entries","url":"https://vulnpocalypse.dev/advisories/cisa-bod-26-04-three-day-kev-deadlines/","date":"2026-11-02","summary":"CISA's BOD 26-04 sets patch deadlines by exposure, KEV status, automation and impact; the riskiest get 3 days. Track KEV dueDate and forensicTriage.","tags":["ecosystem","vuln-data","enterprise"]}]}