Skip to main content

Emerging Threats Release Notes

Release date: October 29, 2026

Emerging Threats tells you which CVEs got worse recently enough to deserve your attention today. This release changes how the trending list decides what belongs on it.

Major attack campaigns now reach the top of the list​

The most important change in this release: widely reported, actively exploited attack campaigns now surface at the top of the trending list and stay there while attacks continue.

The list now ranks on evidence: attackers starting to use a CVE, a CISA KEV listing, weaponized exploits, and how many independent organizations are reporting on it. A campaign that many organizations are tracking ranks above a CVE that a single source mentioned once, and it stays listed for weeks while reporting continues.

Everything that is new​

ChangeWhat it means for you
Open to more usersAnyone who can read the graph can use Emerging Threats. A Vulnerability Management license is not required
Evidence-based rankingThe trending list ranks CVEs on evidence that their threat picture changed and on how widely that is being reported, not mainly on how recent the last change was
Events stay listedA major event stays on the list for weeks and slides down gradually as it ages
New events listed the same dayA CVE added to CISA KEV, weaponized, or first reported in use by an attacker in the last two days is always on the list
Related CVEs share a rowCVEs in the same product that were added to KEV within three days of each other appear as one row
A longer listThe list shows up to 25 CVEs, under the heading Top emerging threats
More specific reasonsEach row says exactly what changed: which kind of attacker was reported, or which KEV catalog added it
Search suggestionsThe search box suggests CVEs as you type, matching on product names as well as CVE identifiers
Current exploitation activityA threat brief says whether exploitation is happening now

The list ranks a CVE on:

  • A change in how it is being used: it was added to CISA KEV, a threat actor, ransomware group, or botnet was reported using it for the first time, or a weaponized exploit appeared.
  • First confirmed exploitation.
  • Independent reporting: how many separate organizations reported on it in the last 30 days.
  • New exploit code, weighted so that copies of one proof of concept do not inflate the rank.
  • Recency of the latest evidence, as a small factor.

What you will notice:

  • Fewer single-source rows. A CVE that only one source is talking about ranks lower than one that several organizations are reporting.
  • Major events stay visible. A change earns full credit for 14 days, then fades out by day 30, or by day 45 if VulnCheck's canaries or honeypots are still seeing exploitation attempts. The list changes by a few rows a day.
  • New events still appear immediately. Anything added to CISA KEV, weaponized, or first reported in use by an attacker in the last two days is always listed, even when older events outrank it.

For the full description, see How trending is ranked.

When an attack campaign uses several CVEs in one product, they tend to be added to KEV together. CVEs in the same product that were added to KEV within three days of each other appear as one row, under the highest-ranked CVE. The row shows a +N related CVEs badge.

When you open the threat brief for any of those CVEs, including one you reached by search or a shared link, the brief's header has a Related CVEs menu that links to the others.

More specific reasons on each row​

Each row's Why it ranked line now names exactly what changed:

  • For exploitation, the kind of attacker that was reported: First threat actor report, First ransomware report, First botnet report, or First canary detection.
  • For KEV, the catalog that added it: Added to CISA KEV or Added to VulnCheck KEV. A CVE added to both shows a line for each.

Escalation chips that were reached in the last seven days are marked, so you can tell what is new this week from what a CVE has carried for years. Other recent changes are listed under the reason line.

The search box suggests CVEs as you type, drawn from the wider pool the trending list is ranked from. Suggestions match the affected product as well as the identifier, so typing a product name finds a CVE whose number you do not remember. You can still search for any CVE identifier, whether or not it is suggested.

Threat brief improvements​

  • Current exploitation activity. The verdict now shows whether exploitation is Newly exploited, Ongoing, or has had No recent sensor activity, based on recent sightings. No recent sensor activity is never a sign that a CVE is safe: sensors see only part of the internet.
  • Who is using it is split into Attributed exploitation (threat actors, ransomware, botnets, and exploit repositories) and Sensor feeds (VulnCheck's canaries and honeypots).
  • Threat actor profiles. Select a threat actor to see its profile: attribution country, when it was first observed, other CVEs it has exploited, the vendors and products it targets, and its ATT&CK techniques.
  • Affected components. Remediation guidance has a new Affected components panel listing the affected product, CPEs, package URLs, and advisory identifiers (GHSA, EUVD, JVNDB). Each can be copied, and Download all fingerprints exports them as JSON for your own scanner, SBOM, or advisory search.
  • KEV catalog named. The KEV metric and the exploitation timeline say which catalog listed the CVE: CISA, VulnCheck, or both.

Contents