Dashboard / Catalog 2026.09.23
Known exploited vulnerabilities, by the numbers
A live read of CISA's KEV catalog, the SMS OTP regulation board and the latest intel briefings. Every figure is computed from source data.
Now As of catalog 2026.09.23 (released 2026-09-23), CISA's Known Exploited Vulnerabilities catalog lists 1,721 entries. 8 were added in the 7 days to 2026-09-23, 46 in 30 days and 92 in 90 days.
- KEV entries
- 1,721since 2021-11-03
- Last 7 days
- +8added
- Last 30 days
- +46added
- Last 90 days
- +92added
- Ransomware: known
- 21%361 entries
- Median days to due
- 21added to due date
- Open deadlines
- 8federal
01KEV flow
Weeks end on the catalog date. Table and download.
02Readout: last 7 days
- CVE-2026-94127F5BIG-IP APM
- CVE-2026-93952AristaVeloCloud Orchestrator
- CVE-2026-93616Check PointMultiple Products
- CVE-2026-85102Check PointMultiple Products
- CVE-2026-7273ZyxelGS1900 Series Switches
- CVE-2026-53266LinuxKernel
- CVE-2025-39964LinuxKernel
- CVE-2025-39682LinuxKernel
03Top vendors
04Top weaknesses
| Weakness | Entries | CWE |
|---|---|---|
| Improper input validation | 119 | CWE-20 |
| OS command injection | 110 | CWE-78 |
| Out-of-bounds write | 104 | CWE-787 |
| Use after free | 93 | CWE-416 |
| Memory buffer bounds error | 85 | CWE-119 |
| Path traversal | 79 | CWE-22 |
| Unsafe deserialization | 71 | CWE-502 |
| Code injection | 70 | CWE-94 |
05Due soon
| CVE | Vendor | Due | Left |
|---|---|---|---|
| CVE-2026-87491 | 0d | ||
| CVE-2026-7273 | Zyxel | 1d | |
| CVE-2026-94127 | F5 | 2d | |
| CVE-2026-93952 | Arista | 2d | |
| CVE-2026-93616 | Check Point | 2d | |
| CVE-2026-85102 | Check Point | 2d | |
| CVE-2026-42018 | JFrog | 2d | |
| CVE-2026-42016 | JFrog | 2d |
06SMS OTP regulation board
| Market | Status | Timing |
|---|---|---|
| UAE | Complete | Jul 2025 – Mar 2026 |
| Philippines | In force | From Jun 25, 2026 |
| India | In force | From Apr 1, 2026 |
| Singapore | In force | From Jul 2024 |
| Malaysia | In force | 2022 – 2024 |
| European Union | Pending | Deal Nov 27, 2025 |
| United States | Guidance | Final 2025 |
Full board with sources · verified 2026-09-24
07Latest briefings
Glide Identity's three-carrier beta: what the data does and doesn't show
The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizon on Aug 3, 2026, and that trade and general press covered it. They do not show which devices, operating systems and plans work, how often fallback triggers, what it costs, or how it holds up under independent security review.
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
The UAE’s SMS OTP phase-out is done. What US banks can take from it
The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.
Carrier-native authentication, explained: how a SIM can sign a login
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.
08Data endpoints
Static JSON and CSV, regenerated on every build. API documentation.
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.