Would you know if a tool in your stack is under active attack?
patchletter watches CISA's catalog of actively exploited vulnerabilities (KEV) and shows here which of the tracked tools are affected. Reading costs nothing and needs no account — the email the moment it hits you is part of Pro.
Actively exploited — right now in the catalog
| Tool | CVE | Vulnerability | In KEV since | |
|---|---|---|---|---|
| Apache Struts | CVE-2016-3081 | Apache Struts Command Injection Vulnerability8.1 high · over the network, without login · CISA deadline was 11 Oct | 8 Oct | → |
 Zammad | CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerability9.8 critical · over the network, without login · CISA deadline was 5 Oct | 2 Oct | → |
| Zammad | CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerability9.8 critical · over the network, without login · CISA deadline was 5 Oct | 2 Oct | → |
 MikroTik RouterOS | CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability6.5 medium · over the network, without login · CISA deadline was 28 Sept | 25 Sept | → |
 JFrog Artifactory | CVE-2026-42018 | JFrog Artifactory Improper Authentication Vulnerability7.5 high · over the network, without login · CISA deadline was 25 Sept | 11 Sept | → |
 JFrog Artifactory | CVE-2026-42018 | JFrog Artifactory Improper Authentication Vulnerability7.5 high · over the network, without login · CISA deadline was 25 Sept | 11 Sept | → |
| JFrog Artifactory | CVE-2026-42016 | JFrog Artifactory Incorrect Authorization Vulnerability8.8 high · over the network, with a basic account · CISA deadline was 25 Sept | 11 Sept | → |
| JFrog Artifactory | CVE-2026-42016 | JFrog Artifactory Incorrect Authorization Vulnerability8.8 high · over the network, with a basic account · CISA deadline was 25 Sept | 11 Sept | → |
 ConnectWise ScreenConnect | CVE-2026-84869 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability9.9 critical · over the network, with a basic account · CISA deadline was 14 Sept | 11 Sept | → |
| MikroTik RouterOS | CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability9.8 critical · over the network, without login · CISA deadline was 13 Sept | 10 Sept | → |
| MikroTik RouterOS | CVE-2026-67277 | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability8.2 high · over the network, without login · CISA deadline was 13 Sept | 10 Sept | → |
| JFrog Artifactory | CVE-2026-82329 | JFrog Artifactory Improper Authentication Vulnerability9.8 critical · over the network, without login · CISA deadline was 5 Sept | 2 Sept | → |
Source: CISA KEV · checked daily · 331 matches across 76 of 1286 tracked tools, 98 of them ransomware-linked (as of 14/10/2026)
Counted per pair of vulnerability and tool: a flaw affecting three tools counts three times. Included is only what is currently listed in the KEV catalog and unambiguously matched to a tool in this catalog. The public feed /api/v1/cves is deliberately broader — it also contains fuzzy matches and flaws CISA has since removed from the KEV catalog, which is why its numbers are higher.
Newest entry:
Also: BSI security advisories
The KEV catalog above lists only vulnerabilities proven to be under active exploitation. Germany's BSI (CERT-Bund) warns more broadly — here are the latest advisories for tools in this catalog.
- WID-SEC-W-2026-3629
- WID-SEC-W-2026-3867
- WID-SEC-W-2026-3319
- WID-SEC-W-2026-2526
ffmpeg: Mehrere Schwachstellen
FFmpeg, Red Hat Enterprise Linux, openSUSE Leap, Ubuntu Server
- WID-SEC-W-2026-1448
- WID-SEC-W-2026-3863
Red Hat Enterprise Linux (cjose): Schwachstelle ermöglicht Manipulation von Daten
- WID-SEC-W-2026-2649
- WID-SEC-W-2026-1570
An advisory does not tell you whether your version is affected. It names the product — the details are in the original advisory at the BSI.
BSI advisories and KEV hits by email are part of Pro; on the website they are free to read, no account needed. All BSI advisories
How CVE tracking works
We read CISA KEV every day
The KEV catalog lists only CVEs with proven exploitation. We match it against the tools in our catalog every day.
If it hits your tool, Pro wakes you
When a new KEV vulnerability affects a tool you subscribe to, Pro sends an email right away, and one click unsubscribes you. The hit itself is on this page, no account needed.
The tool page carries the context
There you see the actively exploited vulnerabilities, the ransomware flag and the link to the NVD entry.
Why KEV, not the CVE flood
We do not match the entire CVE set, only CISA's KEV catalog. It lists only what is proven to be under active attack. We tell you which of the tools you track appear in it. You check the installed version yourself.
Frequently asked questions
What is the CISA KEV catalog?
The US agency CISA's Known Exploited Vulnerabilities catalog: a curated list of vulnerabilities proven to be actively exploited in the wild. Far less noise than the full set of CVEs.
Do I get an email when a tool is affected?
With Pro, yes: subscribe to a tool and an email goes out as soon as a new actively exploited vulnerability (KEV) affects it. Unsubscribing costs one click. Without Pro the hit is on this page and on the tool page.
Do you scan my systems?
Scanning would need access to your systems, and there is none. We compare product names against the KEV catalog; whether your installed version is affected is in the linked CVE entry.
Why only KEV and not every CVE?
KEV is low-noise and shows real, present danger. We match the KEV catalog, not the entire CVE set; where the source names them, each hit carries its CVSS score, attack vector and CISA deadline in the table above.
What does it cost?
This page costs nothing and needs no account: the KEV radar, the BSI advisories and the tool pages are free to read, and so is the update email that tells you a new version is out. What you pay for is the security delivery — the KEV alert by email is part of Pro.
Keep an eye on your tools
Pick your software in the catalogue — the update email then tells you about every new version. The alert for an actively exploited vulnerability comes with Pro.