SERAPH CTI tracks a continuously updated catalogue of vulnerabilities and enriches them with severity, exploitability, known exploitation, ransomware activity, affected technologies and threat intelligence — to help security teams prioritise what matters.
CVE-2026-XXXX
Vendor / Product
Technology match
Fortinet FortiOS
Key vulnerability intelligence metrics from across the threat landscape. Select a card to explore that slice of the catalogue.
Thousands of vulnerabilities can affect a modern technology environment. Treating every Critical CVE equally creates noise. Effective prioritisation requires severity, exploitability, active exploitation, technology relevance and business context — combined, not read in isolation.
A vulnerability is disclosed.
How severe could this be, in theory.
How likely is exploitation, in practice.
Is a working exploit public or observed?
17,028 vulnerabilities from NVD, enriched with EPSS and cross-referenced against the CISA KEV catalogue.
This is why Seraph doesn't prioritise by CVSS alone — a 9.8 with no exploitation evidence and a 7.2 being actively exploited by a ransomware group are not the same problem.
A theoretical worst-case severity score based on the vulnerability's technical characteristics — not whether anyone is actually exploiting it.
A probability, updated daily by FIRST.org, that a vulnerability will be exploited in the wild within the next 30 days.
Not a prediction — an authoritative record that real-world exploitation has already been observed.
Whether the affected technology is one you actually run, and what threat activity is documented against it.
No single score is the answer. Seraph's prioritisation engine weighs all five signals together, adds what is happening in your environment, and gives each vulnerability one priority your team can act on.
This catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new vulnerability matches their stack — not the other thousands that don't.
Of 32,503 tracked vulnerabilities, 1,768 have confirmed real-world exploitation (CISA KEV) and 361 are associated with known ransomware use. Where evidence exists, Seraph connects a vulnerability to the exploit, campaign and ransomware activity behind it.
Seraph does not infer exploit, campaign or threat-actor links that aren't independently sourced — an unverified relationship is worse than none.
Seraph tracks threat actor groups separately, sourced from MITRE ATT&CK's public dataset — real documented techniques, tools and campaigns for 176 groups. A specific vulnerability is only linked to an actor here when that connection is independently reported, not inferred from shared vendors or timing.
Most CVEs won't have a documented actor link — MITRE ATT&CK tracks behaviour and technique use, not CVE-level exploitation, and that gap is left visibly open rather than filled with a guess.
Explore Threat Actor IntelligenceNot every vulnerability carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to technologies commonly deployed within identity, network/edge, server and cloud infrastructure for a given industry.
Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.
Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure and reported campaigns specific to East Africa.
A single vulnerability record flows across the Seraph platform, not just into a report.
Understand what the vulnerability affects.
Combine severity, exploitability and threat context.
Apply the appropriate patch, mitigation or control.
Confirm remediation and continue monitoring.
Monitor technologies your organisation uses, receive threat-informed vulnerability intelligence and focus remediation on the risks most likely to matter.
Urgent
Patch / mitigate immediately
Confirmed — this one is being exploited.
Is it tied to known ransomware campaigns?
Which actors, if any, are documented using it.
Does it touch what you actually run.
Is that technology in your declared stack.
What to do, and by when.
| CVE | Vendor / Product | CVSS | EPSS | CISA KEV | Ransomware | Published | Action |
|---|---|---|---|---|---|---|---|
| CVE-2026-111949 | Unknown miniOrange 2FA | 7.5 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-111948 | Unknown User Profile Builder | 7.1 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-111947 | Unknown Pricing Table WordPress Plugin | 5.5 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-111596 | Unknown Kliken: Ads + Pixel for Meta | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-111574 | Unknown Redirection for Contact Form 7 | 7.5 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-110982 | Unknown AI Engine | 4.9 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-110651 | Unknown Swift Performance Lite | 6.8 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-110523 | Unknown WP User Manager | 8.1 | 0.4% | — | — | Oct 21, 2026 | View |
| CVE-2026-110514 | Unknown WPZOOM Portfolio Lite | 4.9 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-109926 | Unknown Productive Commerce | 4.3 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-109147 | Unknown WP Booking System | 7.1 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-108073 | Unknown SureCart | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-107790 | Unknown HireZoot | 6.8 | 0.4% | — | — | Oct 21, 2026 | View |
| CVE-2026-107789 | Unknown SmartyParcel | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-107788 | Unknown SmartyParcel | 4.3 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-107506 | Unknown Simple Banner | 7.5 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-107237 | Unknown Backup and Staging by WP Time Capsule | 8.2 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-107128 | Unknown Uncanny Toolkit for LearnDash | 5.0 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-107127 | Unknown Uncanny Toolkit for LearnDash | 7.5 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-106932 | Unknown Moloni | 6.5 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-105999 | Unknown Booking Package | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-105998 | Unknown Booking Package | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-105996 | Unknown Booking Package | 4.8 | 0.2% | — | — | Oct 21, 2026 | View |
| CVE-2026-105992 | Unknown Ettrick Escape Room Booking | 5.3 | 0.3% | — | — | Oct 21, 2026 | View |
| CVE-2026-105262 | Unknown Falang multilanguage for WordPress | 8.0 | 0.4% | — | — | Oct 21, 2026 | View |
CVSS shown reflects NVD's published base score; where a CVE predates this catalogue's sync window and hasn't yet been scored, it displays as “Not scored” rather than an invented value.
Is remediation tied to controls, risk obligations or evidence?
Does this vulnerability affect an asset or technology we use?
Can the vulnerability be safely validated?
Are there indicators of attempted or successful exploitation?
Is remediation tied to controls, risk obligations or evidence?
Can't find what you need? Ask a security expert.
Here's one of the highest-priority vulnerabilities in the current catalogue, shown exactly as Seraph CTI tracks it.
Metabase SQL Injection Vulnerability. Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them adm…
The vendors with the most tracked vulnerabilities in the current catalogue window — a starting point for understanding where exposure concentrates, not a ranking of vendor security quality.
Computed live from the full tracked catalogue.
Is disclosure volume accelerating?
■ Critical ■ Other severities
Where does exposure concentrate?
How severe is the tracked catalogue overall?
How exploitable is the average tracked CVE?
How many tracked CVEs are tied to ransomware?
How much of the catalogue is confirmed-exploited?
