Official sources
FACTUAL CISA SOURCE BRIEFING

Seven-day KEV watchlist

An automatically refreshed list of newly cataloged vulnerabilities, paired with an evergreen response checklist. It does not assess your environment.

Window: 2026-10-06 – 2026-10-12 (UTC) · CISA catalog edition: 2026.10.08 · Feed release: 2026-10-08T20:09:18.9833Z

5 KEV catalog entries were added during this seven-day window.

The catalog addition date is not the date exploitation began. A KEV listing is not proof a particular device is affected, nor a substitute for vendor instructions.

Newly added records

  1. CVE-2023-22894 — Strapi / Strapi (catalog addition 2026-10-08)
    Strapi Cleartext Storage of Sensitive Information Vulnerability
  2. CVE-2021-3199 — ONLYOFFICE / Docs (catalog addition 2026-10-08)
    ONLYOFFICE Docs Server Path Traversal Vulnerability
  3. CVE-2016-3081 — Apache / Struts (catalog addition 2026-10-08)
    Apache Struts Command Injection Vulnerability
  4. CVE-2015-5477 — ISC / BIND (catalog addition 2026-10-08)
    ISC BIND Data Processing Errors Vulnerability
  5. CVE-2015-3306 — ProFTPD / ProFTPD (catalog addition 2026-10-08)
    ProFTPD Improper Access Control Vulnerability

Showing at most 25 additions. Search the latest 200 KEV records or consult the authoritative CISA catalog.

What your team should do with this list

  1. Confirm affected product, supported fix, and vulnerable versions in the vendor advisory.
  2. Match the affected component against your asset inventory and actual exposure.
  3. Assign an accountable owner, an authorized remediation path, and a target date.
  4. Verify the change and preserve evidence before marking any finding resolved.

Use the free KEV triage checklist and CSV worksheet to document your decisions.

CISA is the primary data source; this page is a deterministic summary, not new independent intelligence. Source downloads may lag. Verify any urgent decision directly with CISA and the responsible vendor.

CALCULATEDIT RMF ACCELERATOR · PROFESSIONAL SERVICES

Ready to turn findings into an RMF evidence package?

Convert customer-provided Nessus / ACAS scan findings into structured draft POA&M materials, remediation recommendations, and review-ready RMF outputs with expert quality assurance. Every output requires human validation.

Explore RMF Accelerator ↗ See the $2,500 pilot details →

Optional paid service by Calculated Ventures, LLC. The free security feed and tools remain available without a purchase.