When the US Cybersecurity and Infrastructure Security Agency adds a software flaw to its Known Exploited Vulnerabilities catalogue, it's saying one thing clearly: attackers are already using this bug. As of 1 October 2026, the catalogue lists 1,731 vulnerabilities.

Image: CISA / Wikimedia Commons (public domain)