Known Exploited Vulnerabilities and counting....
A known exploited vulnerability (KEV) refers to a software vulnerability that is being actively exploited by cybercriminals or threat actors. When a vulnerability becomes known to be exploited in the wild, it signals that the vulnerability poses a significant and imminent risk to organizations.
Cybersecurity Brief – April 21, 2026
CISA added eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, establishing federal remediation deadlines between late April and early May 2026. The agency's action signals confirmed in-the-wild exploitation of these flaws, which represent significant attack vectors against federal networks. Federal agencies must patch affected systems by the specified deadlines under Binding Operational Directive 22-01.
Vercel customers are being targeted following a compromise of a third-party tool used by the cloud platform provider. The incident highlights supply chain risk in the developer tools ecosystem, though specific details about the compromised tool and the scope of customer impact remain limited. Separately, Huntress researchers report that Nightmare-Eclipse tooling has transitioned from proof-of-concept status to active use in real-world intrusions, marking another publicly disclosed exploit framework crossing into operational deployment.
Rhode Island hospitals face mounting cybersecurity threats, including Iran-linked targeting of U.S. healthcare organizations, while operating without enforceable security requirements or dedicated federal funding. The gap between threat activity and defensive mandates continues to expose healthcare infrastructure to elevated risk.
Sources: The Hacker News · Cybersecurity Dive · Huntress · CISA · Rhode Island Current
Common Vulnerability and Exposure
CVEs form a database of known security vulnerabilities that are actively tracked and managed by a group of organizations, such as the U.S. National Cyber Security Alliance. CVEs are an important tool for network security management because they not only provide an inventory of existing vulnerabilities, but also provide information about how the vulnerability can be exploited and instructions on how to protect against it.
Search Known Exploits
Search for CVEs by vendor to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 22-01
(BOD) 22-01 is a directive issued by the Cybersecurity and Infrastructure Security Agency (CISA) in the United States to federal agencies and federal contractors in order to improve their cybersecurity practices. It provides a set of guidelines and requirements that these agencies and contractors must follow to increase their defenses against cyber threats.
Loading...
Cyber Security News
You may have missed...
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Rhode Island Hospitals Face Cybersecurity Threats Without Federal Support and Iran-Linked Targeting
Rhode Island hospitals lack enforceable cybersecurity requirements while facing growing threats from Iran-linked cyber activity targeting U.S. healthc...
Vercel systems targeted after third-party tool compromised | Cybersecurity Dive
... Cybersecurity Dive. “That isn't about the inherent security flaws of AI applications, it's more about AI tools requiring permissions to be as ...
CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities ...
Microsoft Defender Zero-Day Exploits Weaponized in Real Attacks
Threat actors are actively exploiting three recently disclosed Windows security vulnerabilities (BlueHammer, RedSun, and UnDefend) in Microsoft Defend...
British Scattered Spider hacker pleads guilty to cryptocurrency theft - Computing UK
Prosecutors say 24-year-old Tyler Robert Buchanan was a central figure in the loosely organised hacking collective known as Scattered Spider ...
Crypto infrastructure company blames $290 million theft on North Korean hackers
A theft of nearly $300 million worth of cryptocurrency has been attributed to hackers from North Korea, as the industry grapples with the fallout ...
North Korea's crypto heist playbook is expanding and DeFi keeps getting hit
The Kelp exploit demonstrates North Korea's Lazarus Group evolving tactics from social engineering to exploiting structural weaknesses in crypto infra...
The Biggest Hack of 2026: What We Know About the $294M KelpDAO Exploit
Security company Cyvers detects nearly $300 million drained from Kelp DAO's liquid restaking protocol via compromised bridge contract.
Updated daily