llms.txt
+200 −200
− > Source-reviewed editorial records covering exploited vulnerabilities, notable disclosed breaches, and AI security research.− CISA Known Exploited Vulnerabilities: cached; 1758 retained records. Last success: 2026-10-27T18:26:00.481Z. The full successfully validated KEV catalog, without a newest-record slice. Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.− GitHub Public Security Advisories: cached; 502 retained records. Last success: 2026-10-27T18:11:03.300Z. GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication. Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverag− JPCERT/CC Japan Advisories: cached; 32 retained records. Last success: 2026-10-27T18:26:00.481Z. Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor. RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented.− Google Project Zero Research: live; 11 retained records. Last success: 2026-10-27T17:51:02.522Z. Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling. The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.− Google Security Research: live; 47 retained records. Last success: 2026-10-27T17:51:02.124Z. At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications. Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.− NVD Recently Published CVEs: live; 6000 retained records. Last success: 2026-10-27T18:00:59.751Z. Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval. Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own − The Hacker News: cached; 34 retained records. Last success: 2026-10-27T18:26:02.239Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 da− SecurityWeek: cached; 11 retained records. Last success: 2026-10-27T18:26:00.481Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.− Help Net Security: cached; 3 retained records. Last success: 2026-10-27T12:55:57.841Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 d− The Record (Recorded Future News): cached; 3 retained records. Last success: 2026-10-27T18:26:02.239Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. R− Axios: cached; 3 retained records. Last success: 2026-10-27T18:26:00.481Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retain− TechCrunch Security: cached; 4 retained records. Last success: 2026-10-27T18:26:00.468Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attri− WIRED Security: cached; 5 retained records. Last success: 2026-10-27T18:26:00.481Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attributio− The Verge (AI): cached; 0 retained records. Last success: 2026-10-27T18:26:00.481Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attributio− 404 Media: cached; 0 retained records. Last success: 2026-10-27T18:26:00.481Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Re− Have I Been Pwned: live; 120 retained records. Last success: 2026-10-27T18:26:00.481Z. Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one. HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, re− DataBreaches.net: cached; 5 retained records. Last success: 2026-10-27T18:26:00.481Z. Breach and incident reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.− The HIPAA Journal: live; 11 retained records. Last success: 2026-10-27T18:00:58.430Z. Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.− Anthropic: live; 1 retained records. Last success: 2026-10-27T18:26:03.602Z. Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.− OpenAI: live; 62 retained records. Last success: 2026-10-27T18:00:56.758Z. OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.− Google DeepMind: live; 1 retained records. Last success: 2026-10-27T18:26:02.286Z. Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.− Microsoft Security blog: live; 6 retained records. Last success: 2026-10-27T18:00:59.531Z. Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed. The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.− AI Incident Database: live; 49 retained records. Last success: 2026-10-27T18:01:01.607Z. Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English. − FIRST EPSS: live; 9530 retained records. Last success: 2026-10-27T13:46:48.961Z. Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters. Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.− CVE Program CVSS Enrichment: cached; 745 retained records. Last success: 2026-10-27T17:21:07.647Z. At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling. Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-inges− NVD CVSS for Known Exploited CVEs: live; 1758 retained records. Last success: 2026-10-27T17:37:22.088Z. Once a day, the NVD CVSS score for every CVE in CISA's Known Exploited Vulnerabilities catalog (NVD API hasKev, about 4 pages), so older exploited CVEs are scored even when the CVE record itself has no CVSS. Used only when a record has no CNA or ADP score. The CNA's own score in NVD is preferred over NVD's, and CVSS 4.0/3.x over 2.0. A score describes severity, not exploitation or exposure.− ### PHP Memory Corruption Vulnerability− https://kevwire.com/record/CVE-2026-109618− PHP Memory Corruption Vulnerability (Oct 21, 2026).− PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).− CVSS 9.2 (version 4.0; evidence as of Oct 27, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109618).− EPSS >99.9% for the following 30 days, scored Oct 26, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-26).− NVD CVE-2026-109618: https://nvd.nist.gov/vuln/detail/CVE-2026-109618− Vendor advisory (via NVD references): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w− NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-27T13:21:05.502Z&lastModEndDate=2026-10-27T14:50:55.803Z&resultsPerPage=500&startIndex=0− NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-27T12:50:58.617Z&lastModEndDate=2026-10-27T14:20:56.426Z&resultsPerPage=500&startIndex=0− NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-27T12:21:00.901Z&lastModEndDate=2026-10-27T13:50:56.135Z&resultsPerPage=500&startIndex=0− NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-27T11:51:11.314Z&lastModEndDate=2026-10-27T13:20:57.536Z&resultsPerPage=500&startIndex=0− NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000+ > A free, evidence-first tracker of exploited vulnerabilities (CISA KEV), critical CVEs, breaches and AI security incidents, ranked by exploitation and recency, with every record linked to its primary sources.+ For security engineers, sysadmins, MSPs, CISOs, reporters and AI agents. Free, with no key and no sign-up. Published by Blake Elliot, Inc.+ ## Start here+ - https://kevwire.com/mcp: MCP server for AI agents (Streamable HTTP, no auth) and its setup guide+ - https://kevwire.com/free-cisa-kev-api: free KEV API guide (JSON, CSV, RSS) with examples+ - https://kevwire.com/exploited-this-week: vulnerabilities added to CISA KEV in the last 7 days+ - https://kevwire.com/kev: known exploited vulnerabilities by vendor+ - https://kevwire.com/learn/kev-vs-epss-vs-cvss: what KEV, EPSS and CVSS each tell you+ - https://kevwire.com/openapi.json: OpenAPI description of the read API+ - https://kevwire.com/record/<CVE-ID>: one record with sources, CVSS, EPSS and CISA due date (any published CVE)+ ## Coverage+ CISA Known Exploited Vulnerabilities: cached; 1768 retained records. Last success: 2026-11-06T07:00:58.633Z. The full successfully validated KEV catalog, without a newest-record slice. Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.+ GitHub Public Security Advisories: cached; 908 retained records. Last success: 2026-11-06T06:55:59.702Z. GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication. Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverag+ JPCERT/CC Japan Advisories: live; 60 retained records. Last success: 2026-11-06T07:01:02.332Z. Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor. RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. J+ Google Project Zero Research: live; 11 retained records. Last success: 2026-11-06T06:55:57.108Z. Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling. The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.+ Google Security Research: live; 47 retained records. Last success: 2026-11-06T06:55:57.108Z. At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications. Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.+ NVD Recently Published CVEs: live; 6000 retained records. Last success: 2026-11-06T07:01:00.307Z. Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval. Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own + The Hacker News: cached; 84 retained records. Last success: 2026-11-06T07:01:00.282Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 da+ SecurityWeek: live; 43 retained records. Last success: 2026-11-06T07:00:58.633Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.+ Help Net Security: cached; 29 retained records. Last success: 2026-11-06T05:26:00.078Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 + The Record (Recorded Future News): cached; 5 retained records. Last success: 2026-11-02T14:35:59.611Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. R+ Axios: live; 4 retained records. Last success: 2026-11-06T07:00:58.633Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained+ TechCrunch Security: live; 4 retained records. Last success: 2026-11-06T07:00:58.629Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribu+ WIRED Security: live; 7 retained records. Last success: 2026-11-06T07:00:58.633Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution.+ The Verge (AI): live; 0 retained records. Last success: 2026-11-06T07:00:58.633Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution.+ 404 Media: live; 0 retained records. Last success: 2026-11-06T07:00:58.633Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Reta+ Have I Been Pwned: live; 121 retained records. Last success: 2026-11-06T06:55:57.108Z. Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one. HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, re+ DataBreaches.net: live; 58 retained records. Last success: 2026-11-06T07:00:58.633Z. Breach and incident reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.+ The HIPAA Journal: live; 24 retained records. Last success: 2026-11-06T07:01:01.506Z. Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.+ Anthropic: live; 1 retained records. Last success: 2026-11-06T06:55:58.303Z. Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.+ OpenAI: live; 67 retained records. Last success: 2026-11-06T07:00:58.633Z. OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.+ Google DeepMind: live; 1 retained records. Last success: 2026-11-06T06:55:57.108Z. Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.+ Microsoft Security blog: live; 9 retained records. Last success: 2026-11-06T06:51:00.231Z. Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed. The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.+ AI Incident Database: live; 59 retained records. Last success: 2026-11-06T06:56:02.897Z. Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English. + FIRST EPSS: cached; 15043 retained records. Last success: 2026-11-06T01:16:16.670Z. Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters. Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.+ CVE Program CVSS Enrichment: cached; 756 retained records. Last success: 2026-11-05T23:31:05.096Z. At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling. Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-inges+ NVD CVSS for Known Exploited CVEs: live; 1768 retained records. Last success: 2026-11-05T19:57:19.304Z. Once a day, the NVD CVSS score for every CVE in CISA's Known Exploited Vulnerabilities catalog (NVD API hasKev, about 4 pages), so older exploited CVEs are scored even when the CVE record itself has no CVSS. Used only when a record has no CNA or ADP score. The CNA's own score in NVD is preferred over NVD's, and CVSS 4.0/3.x over 2.0. A score describes severity, not exploitation or exposure.+ ### Broadcom VMWare ESX Insufficient Logging Vulnerability+ https://kevwire.com/record/CVE-2026-41709+ Broadcom VMWare ESX Insufficient Logging Vulnerability (Oct 28, 2026).
Showing the first 40 of each.