Seraph CTI tracks the CISA Known Exploited Vulnerabilities catalogue and enriches it with exploitability, technology context and threat intelligence — to help security teams prioritise what requires attention first.
Thousands of vulnerabilities are disclosed every year. The challenge isn't identifying every vulnerability — it's understanding which ones attackers are actively using, and which of those are relevant to your environment.
CISA KEV answers the first question with authority: every entry is a vulnerability with confirmed, real-world exploitation. Seraph CTI carries that signal the rest of the way to a decision.
A weakness is disclosed.
How bad could this be, in theory.
How likely is exploitation, in practice.
Confirmed — this one is being exploited.
Which actors and campaigns are using it.
Does it touch what you actually run.
What to do, and by when.
CISA KEV is one intelligence signal — an authoritative one, but a single layer. Seraph CTI enriches it with CVSS and EPSS scoring, exploit availability, threat actor and campaign intelligence, technology relevance, and sector and regional context where evidence exists.
Seraph doesn't just answer “is this being exploited?” — it helps answer “does it matter to us?”
The public catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new KEV entry matches their stack — not the other 1,600 that don't.
Not every KEV entry carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to the technologies commonly used across identity, network/edge, server and cloud infrastructure in a given industry.
Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.
Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure, threat actor activity and reported campaigns specific to East Africa.
Threat intelligence is the layer that connects every other layer of defence. A single KEV entry flows across the Seraph platform, not just into a report.
Determine whether affected assets exist in the organization.
Safely validate relevant vulnerabilities where appropriate.
Correlate exploitation intelligence with security events.
Track remediation, risk and control obligations.
Determine whether affected technologies exist in your environment.
Review exploitation activity, threat context and asset importance.
Escalate vulnerabilities that represent material organisational risk.
Confirm remediation and continue monitoring.
Can't find what you need? Ask a security expert.
Monitor your technology stack, receive priority threat intelligence and understand what requires action before exposure becomes an incident.
1,685 vulnerabilities match your filters.
| CVE | Vendor / Product | EPSS | Date Added | Remediation Due | Ransomware Use | Action |
|---|---|---|---|---|---|---|
| CVE-2026-66384 | JFrog Artifactory | 0.6% | Aug 27, 2026 | Sep 10, 2026 Overdue | Unknown | View |
| CVE-2026-53362 | Linux Kernel | 0.5% | Aug 27, 2026 | Aug 30, 2026 Overdue | Unknown | View |
| CVE-2023-49105 | ownCloud ownCloud | 43.2% | Aug 27, 2026 | Aug 30, 2026 Overdue | Unknown | View |
| CVE-2019-1068 | Microsoft SQL Server | 52.8% | Aug 26, 2026 | Aug 29, 2026 Overdue | Unknown | View |
| CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway | 1.6% | Aug 26, 2026 | Aug 29, 2026 Overdue | Unknown | View |
| CVE-2022-0995 | Linux Kernel | 9.5% | Aug 26, 2026 | Sep 09, 2026 Overdue | Unknown | View |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool | 5.0% | Aug 26, 2026 | Sep 09, 2026 Overdue | Unknown | View |
| CVE-2015-3246 | Red Hat Libuser | 8.8% | Aug 26, 2026 | Sep 09, 2026 Overdue | Unknown | View |
| CVE-2021-23758 | Ajax.NET Professional Ajax.NET Professional | 83.6% | Aug 26, 2026 | Sep 09, 2026 Overdue | Unknown | View |
| CVE-2026-60004 | Gitea Gitea | 84.6% | Aug 25, 2026 | Aug 28, 2026 Overdue | Unknown | View |
| CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | 42.0% | Aug 24, 2026 | Aug 27, 2026 Overdue | Unknown | View |
| CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) | 20.5% | Aug 21, 2026 | Aug 24, 2026 Overdue | Unknown | View |
| CVE-2026-72529 | TrueConf Server | 1.6% | Aug 20, 2026 | Aug 23, 2026 Overdue | Unknown | View |
| CVE-2026-72530 | TrueConf Server | 1.8% | Aug 20, 2026 | Sep 03, 2026 Overdue | Unknown | View |
| CVE-2026-64849 | MLflow MLflow | 16.4% | Aug 19, 2026 | Sep 02, 2026 Overdue | Unknown | View |
| CVE-2026-65400 | Apple macOS | 9.9% | Aug 18, 2026 | Aug 21, 2026 Overdue | Unknown | View |
| CVE-2026-55040 | Microsoft SharePoint | 39.7% | Aug 18, 2026 | Aug 21, 2026 Overdue | Unknown | View |
| CVE-2026-59310 | Broadcom VMware vCenter | 45.9% | Aug 18, 2026 | Aug 21, 2026 Overdue | Unknown | View |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions | 72.7% | Aug 18, 2026 | Aug 21, 2026 Overdue | Unknown | View |
| CVE-2025-62593 | Ray-Project Ray | 16.9% | Aug 17, 2026 | Aug 20, 2026 Overdue | Unknown | View |
| CVE-2026-72898 | Metabase Metabase | 79.2% | Aug 11, 2026 | Aug 14, 2026 Overdue | Unknown | View |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | 6.2% | Aug 11, 2026 | Aug 25, 2026 Overdue | Unknown | View |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 2.2% | Aug 11, 2026 | Aug 14, 2026 Overdue | Unknown | View |
| CVE-2026-8037 | Progress LoadMaster | 99.6% | Aug 07, 2026 | Aug 10, 2026 Overdue | Unknown | View |
| CVE-2026-63077 | JetBrains TeamCity | 87.7% | Aug 05, 2026 | Aug 08, 2026 Overdue | Unknown | View |
Every KEV entry is a real vulnerability with a real deadline. Here's the most recently added one, shown exactly as Seraph CTI tracks it.
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
For CVE-2026-66384, added to the catalogue on Aug 27, 2026 with a remediation deadline of Sep 10, 2026.
Computed live from the full tracked catalogue — not a static snapshot.
Is exploitation activity accelerating?
Whose products need the most attention?
How exploitable is the average KEV entry?
Based on 1,685 entries with a published EPSS score.
How many KEVs are tied to known ransomware use?
How long between listing and deadline?