SERAPH CTI tracks a continuously updated catalogue of vulnerabilities and enriches them with severity, exploitability, known exploitation, ransomware activity, affected technologies and threat intelligence — to help security teams prioritise what matters.
CVE-2026-XXXX
Vendor / Product
Technology match
Fortinet FortiOS
Key vulnerability intelligence metrics from across the threat landscape. Select a card to explore that slice of the catalogue.
Thousands of vulnerabilities can affect a modern technology environment. Treating every Critical CVE equally creates noise. Effective prioritisation requires severity, exploitability, active exploitation, technology relevance and business context — combined, not read in isolation.
A vulnerability is disclosed.
How severe could this be, in theory.
How likely is exploitation, in practice.
Is a working exploit public or observed?
17,403 vulnerabilities from NVD, enriched with EPSS and cross-referenced against the CISA KEV catalogue.
This is why Seraph doesn't prioritise by CVSS alone — a 9.8 with no exploitation evidence and a 7.2 being actively exploited by a ransomware group are not the same problem.
A theoretical worst-case severity score based on the vulnerability's technical characteristics — not whether anyone is actually exploiting it.
A probability, updated daily by FIRST.org, that a vulnerability will be exploited in the wild within the next 30 days.
Not a prediction — an authoritative record that real-world exploitation has already been observed.
Whether the affected technology is one you actually run, and what threat activity is documented against it.
No single score is the answer. Seraph's prioritisation engine weighs all five signals together, adds what is happening in your environment, and gives each vulnerability one priority your team can act on.
This catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new vulnerability matches their stack — not the other thousands that don't.
Of 33,175 tracked vulnerabilities, 1,768 have confirmed real-world exploitation (CISA KEV) and 361 are associated with known ransomware use. Where evidence exists, Seraph connects a vulnerability to the exploit, campaign and ransomware activity behind it.
Seraph does not infer exploit, campaign or threat-actor links that aren't independently sourced — an unverified relationship is worse than none.
Seraph tracks threat actor groups separately, sourced from MITRE ATT&CK's public dataset — real documented techniques, tools and campaigns for 176 groups. A specific vulnerability is only linked to an actor here when that connection is independently reported, not inferred from shared vendors or timing.
Most CVEs won't have a documented actor link — MITRE ATT&CK tracks behaviour and technique use, not CVE-level exploitation, and that gap is left visibly open rather than filled with a guess.
Explore Threat Actor IntelligenceNot every vulnerability carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to technologies commonly deployed within identity, network/edge, server and cloud infrastructure for a given industry.
Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.
Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure and reported campaigns specific to East Africa.
A single vulnerability record flows across the Seraph platform, not just into a report.
Understand what the vulnerability affects.
Combine severity, exploitability and threat context.
Apply the appropriate patch, mitigation or control.
Confirm remediation and continue monitoring.
Monitor technologies your organisation uses, receive threat-informed vulnerability intelligence and focus remediation on the risks most likely to matter.
Urgent
Patch / mitigate immediately
Confirmed — this one is being exploited.
Is it tied to known ransomware campaigns?
Which actors, if any, are documented using it.
Does it touch what you actually run.
Is that technology in your declared stack.
What to do, and by when.
| CVE | Vendor / Product | CVSS | EPSS | CISA KEV | Ransomware | Published | Action |
|---|---|---|---|---|---|---|---|
| CVE-2026-107646 | realmag777 HUSKY – Products Filter for WooCommerce Professional | 5.3 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-105974 | Unknown Visual Form Builder | 4.3 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-105973 | Unknown Visual Form Builder | 4.3 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-104755 | aresit WP Compress – Instant Performance & Speed Optimization | 4.8 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-104730 | sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | 9.8 | 0.5% | — | — | Oct 16, 2026 | View |
| CVE-2026-104715 | Red Hat Red Hat Enterprise Linux 10 | 7.8 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-103696 | Unknown Mobile builder | 6.8 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-96570 | magazine3 Schema & Structured Data for WP & AMP | 7.2 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-95809 | optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-95686 | optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | 7.2 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-93767 | tainacan Tainacan | 6.5 | 0.6% | — | — | Oct 16, 2026 | View |
| CVE-2026-89079 | jfarthing84 Theme My Login | 9.8 | 1.6% | — | — | Oct 16, 2026 | View |
| CVE-2026-89051 | johndarrel Hide My WP Ghost – Security & Firewall | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-88963 | themeum Tutor LMS – eLearning and online course solution | 6.1 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-85659 | ontraport PilotPress | 8.8 | 0.4% | — | — | Oct 16, 2026 | View |
| CVE-2026-12272 | daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent | 5.3 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-111458 | adulau ssldump | 6.8 | 0.1% | — | — | Oct 16, 2026 | View |
| CVE-2026-111122 | gpriday SiteOrigin CSS | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-110017 | fullworks Quick PayPal Payments: Payment Button & Form | 6.4 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-109513 | wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-109447 | cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 8.1 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-109414 | appsbd Vitepos – Point of Sale (POS) for WooCommerce | 6.5 | 0.3% | — | — | Oct 16, 2026 | View |
| CVE-2026-109232 | wordpresschef Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-107764 | gpriday SiteOrigin CSS | 7.2 | 0.2% | — | — | Oct 16, 2026 | View |
| CVE-2026-107748 | cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 6.4 | 0.2% | — | — | Oct 16, 2026 | View |
CVSS shown reflects NVD's published base score; where a CVE predates this catalogue's sync window and hasn't yet been scored, it displays as “Not scored” rather than an invented value.
Is remediation tied to controls, risk obligations or evidence?
Does this vulnerability affect an asset or technology we use?
Can the vulnerability be safely validated?
Are there indicators of attempted or successful exploitation?
Is remediation tied to controls, risk obligations or evidence?
Can't find what you need? Ask a security expert.
Here's one of the highest-priority vulnerabilities in the current catalogue, shown exactly as Seraph CTI tracks it.
Metabase SQL Injection Vulnerability. Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them adm…
The vendors with the most tracked vulnerabilities in the current catalogue window — a starting point for understanding where exposure concentrates, not a ranking of vendor security quality.
Computed live from the full tracked catalogue.
Is disclosure volume accelerating?
■ Critical ■ Other severities
Where does exposure concentrate?
How severe is the tracked catalogue overall?
How exploitable is the average tracked CVE?
How many tracked CVEs are tied to ransomware?
How much of the catalogue is confirmed-exploited?
