Skip to content
skopnix
Section D · Exploit Watch
Public exploits · trending this week

Exploit Watch.

The CVEs with the most new public exploit activity this week, one entry per CVE: whether it is actively exploited, who can use it, where the exploits are, which attackers are on record using it, and how fast it went from disclosure to attack.

Trending this week

ranked by new exploit activity

The exploit watch has not published a snapshot yet, so there is nothing to rank.

How to read it

  • KEV is an observation, EPSS a forecast. KEV means CISA has seen it exploited; EPSS estimates the chance in the next 30 days. When they disagree, act on KEV.
  • Read a PoC before you run it. Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author. Each CVE page lists every repository once, with its verdict and flags, and folds the suspicious ones away. We link to the source page and offer no clone or download.
  • Attackers are printed only with a citation. Every name links to the report that ties it to the CVE. Absence means no source we hold says so, not that nobody uses it.
  • As data. /api/v1/exploits/trending and /api/v1/exploits?cve=, keyless.