Cyber Threat Monitor — critical CVEs
Live tracking of critical software vulnerabilities. The engine watches new CVE publications from the NIST National Vulnerability Database and opens a situation whenever a CVSS 9.0+ critical lands.
Active now
Recent
Critical vulnerability — CVE-2026-114575
● resolved · 3d ago · NIST NVD
Critical vulnerability — CVE-2026-114382
● resolved · 3d ago · NIST NVD
Critical vulnerability — CVE-2026-113744
● resolved · 4d ago · NIST NVD
Critical vulnerability — CVE-2026-81212
● resolved · 4d ago · NIST NVD
Critical vulnerability — CVE-2026-101809
● resolved · 4d ago · NIST NVD
Critical vulnerability — CVE-2026-112370
● resolved · 5d ago · NIST NVD
Critical vulnerability — CVE-2026-111862
● resolved · 5d ago · NIST NVD
Critical vulnerability — CVE-2026-111998
● resolved · 7d ago · NIST NVD
Critical vulnerability — CVE-2026-111643
● resolved · 8d ago · NIST NVD
Critical vulnerability — CVE-2026-111281
● resolved · 9d ago · NIST NVD
Critical vulnerability — CVE-2026-102764
● resolved · 9d ago · NIST NVD
Critical vulnerability — CVE-2026-110957
● resolved · 9d ago · NIST NVD
Critical vulnerability — CVE-2026-109110
● resolved · 12d ago · NIST NVD
Critical vulnerability — CVE-2026-108892
● resolved · 12d ago · NIST NVD
Critical vulnerability — CVE-2026-108804
● resolved · 13d ago · NIST NVD
Critical vulnerability — CVE-2026-108576
● resolved · 14d ago · NIST NVD
Critical vulnerability — CVE-2026-108540
● resolved · 14d ago · NIST NVD
Critical vulnerability — CVE-2026-96207
● resolved · 16d ago · NIST NVD
Critical vulnerability — CVE-2026-107699
● resolved · 16d ago · NIST NVD
Background
What a “critical” CVE means
Every vulnerability the engine surfaces here scores 9.0 or higher on CVSS — the Common Vulnerability Scoring System published by FIRST.org, which rates severity from 0.0 to 10.0. A 9.0–10.0 “critical” typically means an attacker can compromise a system remotely with little or no effort: no authentication, no user interaction, and full impact on confidentiality, integrity, or availability. The National Vulnerability Database (NVD), run by NIST, is the authoritative record for each CVE's official description and CVSS metrics (source: FIRST.org CVSS v3.1 specification; NIST NVD).
Score is not the same as urgency
A high CVSS score signals theoretical severity, not active risk. CISA's Known Exploited Vulnerabilities (KEV) catalog tracks which flaws are actually being exploited in the wild — and a CVSS 7.5 that is KEV-listed is more urgent to patch than a CVSS 9.8 with no known exploitation. Sound prioritisation combines the CVSS score with real-world exploitation data (source: CISA Known Exploited Vulnerabilities Catalog).
Featured advisory — CVE-2026-48276 (Adobe ColdFusion)
CVE-2026-48276 is a critical remote-code-execution flaw in Adobe ColdFusion (affecting ColdFusion 2025.9, 2023.20 and earlier) caused by unrestricted upload of a file with a dangerous type. A remote, unauthenticated attacker can upload a server-executable file and run arbitrary code in the context of the ColdFusion service account, with no user interaction required. Adobe published fixed builds in security bulletin APSB26-68; recommended mitigations include applying the update, restricting ColdFusion Administrator and file-upload endpoints to trusted management networks, and auditing web-accessible directories for unauthorised .cfm/.cfc/.jsp files (source: NIST NVD, CVE-2026-48276; Adobe security bulletin APSB26-68). This is factual security-advisory information, not a scan of your systems — confirm your own exposure against the vendor advisory.
References
Call what happens next
- Will GitHub report a major or critical incident between 26 October 2026 – 1 November 2026?No calls yet — be first · as of 13:38 UTC
- Will Coinbase report a major or critical incident between 1–30 November 2026?No calls yet — be first · as of 13:38 UTC
- Will Kraken report a major or critical incident between 1–30 November 2026?No calls yet — be first · as of 13:38 UTC
Other categories
Data: NIST NVD · severity by Monitoring · 5-min refresh