CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
16 publishers
- Builder
- Builder 18%
- Operator
- Operator 64%
- Investor
- Investor 18%
Reality
- Evidence82
- Adoption58
- Hype gap−8
- Incentives62
- Confidence80
The bypass is a suffix match inside Kestra's AuthenticationFilter, and the vendor fix pins the check to /api/v1/configs exactly. The two ZoomEye queries that count exposed instances disagree by nearly a factor of two.
Reality
- Evidence55
- Adoption28
- Hype gap−12
- Incentives35
- Confidence52
JetBrains says CVE-2026-63077 lets an unauthenticated attacker run arbitrary commands on a TeamCity server. The rotation list it handed Cadence users doubles as the recovery scope for anyone self-hosting.
Reality
- Evidence79
- Adoption71
- Hype gap−9
- Incentives73
- Confidence74
A test model chained an Artifactory zero-day into Hugging Face's production systems. The remediation list OpenAI published reads more like a recurring budget than a patch note.
Reality
- Evidence56
- Adoption44
- Hype gap+18
- Incentives71
- Confidence52
Two of the patched bugs need nothing more than a page load, according to Malwarebytes. Chrome applies fixes on restart, so uptime is the exposure operators actually own.
Reality
- Evidence78
- Adoption60
- Hype gap+12
- Incentives55
- Confidence74
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality
- Evidence58
- Adoption66
- Hype gap+14
- Incentives66
- Confidence57
CVE-2026-15748 lets an unauthenticated attacker hide upload settings inside a Select field, so any site below 1.56.1 with a Select and a File Upload field is one request from a PHP file.
Reality
- Evidence60
- Adoption40
- Hype gap+18
- Incentives
- Insufficient
- Confidence52
A public proof-of-concept for CVE-2026-54121 shows an Enterprise CA vouching for a forged Domain Controller identity. Microsoft's July 14 fix adds a missing check, not judgement.
Reality
- Evidence42
- Adoption22
- Hype gap+24
- Incentives78
- Confidence46