Weekly bulletin · 1 November 2026 to 8 November 2026
32,841 new indicators this week
Indicators that appeared over the last 7 days and were cited most by research sources. Domains and IPs are defanged (example[.]com) so they cannot be clicked. The full real-time feed, with scores, is available through the API.
Forecast: vulnerabilities at risk of exploitation
CVEs not yet exploited according to CISA that the CTI Forecast model ranks among the most likely to be within 30 days. See how reliable the model is.
| CVE | Score | EPSS | 7-day mentions | Main factor | Source |
|---|---|---|---|---|---|
| CVE-2024-3094 | 100 | 90.9% | 49 | EPSS probability | www.proofpoint.com |
| CVE-2025-53771 | 100 | 99.9% | 22 | EPSS probability | www.rapid7.com |
| CVE-2023-35708 | 100 | 96.7% | 16 | EPSS probability | www.rapid7.com |
| CVE-2024-6387 | 100 | 99.5% | 12 | EPSS probability | ubuntu.com |
| CVE-2025-49844 | 100 | 82.6% | 15 | EPSS probability | www.trendaisecurity.com |
| CVE-2026-43284 | 100 | 94.2% | 7 | EPSS probability | www.rapid7.com |
| CVE-2026-43500 | 100 | 94.1% | 7 | EPSS probability | www.rapid7.com |
| CVE-2022-39952 | 100 | 99.8% | 8 | EPSS probability | www.trendmicro.com |
| CVE-2025-40947 | 100 | 0.5% | 111 | 7-day mention volume | unit42.paloaltonetworks.com |
| CVE-2025-40948 | 100 | 0.4% | 111 | 7-day mention volume | unit42.paloaltonetworks.com |
Added to KEV in the last 14 days
Vulnerabilities whose exploitation CISA has just confirmed, and since when CTI Forecast had been tracking them.
| CVE | Product | Added by CISA | Tracked by CTI Forecast since |
|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 2026-11-06 | after · 2026-11-07 |
| CVE-2024-27834 | Apple Multiple Products | 2026-11-04 | BEFORE 2026-08-08 |
| CVE-2026-119977 | WordPress WordPress Core | 2026-11-03 | after · 2026-11-07 |
| CVE-2026-118527 | Ivanti Connect Secure | 2026-10-30 | after · 2026-11-07 |
| CVE-2026-111357 | Ivanti Connect Secure | 2026-10-30 | BEFORE 2026-10-16 |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | 2026-10-29 | BEFORE 2026-10-14 |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | 2026-10-29 | after · 2026-11-07 |
| CVE-2026-41709 | Broadcom VMware ESX | 2026-10-28 | BEFORE 2026-08-07 |
| CVE-2026-46300 | Linux Kernel | 2026-10-28 | BEFORE 2026-08-07 |
| CVE-2026-48356 | Adobe Commerce and Magento | 2026-10-27 | BEFORE 2026-08-07 |
BEFORE: CTI Forecast was already tracking the vulnerability when CISA added it.
Accelerating
Indicators whose mentions are growing fastest: the last 7 days compared with the 7 days before. Acceleration often signals an ongoing campaign or exploitation.
| Indicator | Type | Mentions 7d | Previous 7d | Trend | Published by |
|---|---|---|---|---|---|
| CVE-2026-111497 | cve | 370 | 2 | × 123.67 | www.rapid7.com |
| CVE-2018-13379 | cve | 302 | 32 | × 9.18 | www.rapid7.com |
| CVE-2026-83844 | cve | 1713 | 0 | NEW | securityonline.info |
| CVE-2026-123158 | cve | 649 | 0 | NEW | www.ox.security |
| CVE-2026-76461 | cve | 620 | 0 | NEW | www.rapid7.com |
| CVE-2026-85102 | cve | 615 | 0 | NEW | blog.checkpoint.com |
| CVE-2026-85103 | cve | 611 | 0 | NEW | threatvector.cylance.com |
| CVE-2026-84869 | cve | 609 | 0 | NEW | threatvector.cylance.com |
| CVE-2026-98432 | cve | 330 | 1 | × 165.5 | www.akamai.com |
| CVE-2021-34473 | cve | 236 | 31 | × 7.41 | www.trendaisecurity.com |
Most cited vulnerabilities
| Indicator | Mentions | Confidence | Published by |
|---|---|---|---|
| CVE-2026-83844 | 1713 | 93 | securityonline.info |
| CVE-2026-123158 | 649 | 88 | www.ox.security |
| CVE-2026-107441 | 303 | 84 | www.csoonline.com |
| CVE-2026-102895 | 283 | 83 | securityonline.info |
| CVE-2026-19868 | 279 | 83 | securityonline.info |
| CVE-2019-25779 | 277 | 83 | securityonline.info |
| CVE-2026-120422 | 275 | 83 | securityonline.info |
| CVE-2026-115732 | 268 | 83 | securityonline.info |
| CVE-2026-123958 | 268 | 83 | securityonline.info |
| CVE-2026-18836 | 267 | 83 | securityonline.info |
Malicious files (hashes)
| Indicator | Mentions | Confidence | Published by |
|---|---|---|---|
| 08869246386344953972969146034087 | 35 | 73 | malwaretips.com |
| fc0d749c75ccd5bd8811b98dd055f9fa287286f7 | 19 | 70 | www.trendaisecurity.com |
| b8ff09abead5baf707b40c84caf58a3a46f1e05a | 19 | 70 | www.trendaisecurity.com |
| 2e02a6858b4e8dd8b4bb1691b87bc7d5545297bc | 19 | 70 | www.trendaisecurity.com |
| f25c9b5f42b19898b2e3df9723bce95cf412a8ff | 19 | 70 | www.trendaisecurity.com |
| 027889533afe809b68c0955a7fc3cb8f3ae33c08 | 19 | 70 | www.trendaisecurity.com |
| 3ffc87d9b429b64c09fcc26f1561993c3fb698f4 | 19 | 70 | www.trendaisecurity.com |
| 1b67e4672b2734eb1f00967a0d6dd8b8acc9091e | 19 | 70 | www.trendaisecurity.com |
| 9cb059d2c74266b8a42017df8544ea76daae1e87 | 19 | 70 | www.trendaisecurity.com |
| 97822c165acd1c0fd4ff79bbad146f93f367e18c | 19 | 70 | www.trendaisecurity.com |
Malicious infrastructure (domains, IPs, URLs)
| Indicator | Mentions | Confidence | Published by |
|---|---|---|---|
| fishmail[.]top | 126 | 85 | malwaretips.com |
| newssage6[.]xyz | 120 | 61 | malwaretips.com |
| club-news[.]xyz | 104 | 60 | malwaretips.com |
| first-tl-119-b[.]buzz | 104 | 60 | malwaretips.com |
| otheacontail[.]xyz | 104 | 60 | malwaretips.com |
| clean-2-clean[.]club | 103 | 60 | malwaretips.com |
| arrowhurt[.]xyz | 102 | 60 | malwaretips.com |
| winsafe[.]xyz | 97 | 60 | malwaretips.com |
| shafirewall[.]xyz | 92 | 60 | malwaretips.com |
| teensyhub[.]club | 92 | 60 | malwaretips.com |
Most productive sources
| Source | New indicators |
|---|---|
| ESET malware-ioc | 17,092 |
| malwaretips.com | 2,040 |
| any.run | 1,682 |
| www.microsoft.com | 877 |
| blog.talosintelligence.com | 816 |
| unit42.paloaltonetworks.com | 731 |
| securelist.ru | 720 |
| www.proofpoint.com | 541 |
These indicators in your firewall or SIEM, updated every 5 minutes.
Try Pro for free
