CVE/KEV Cards

CVE cards use SOCRadar CVE Radar's current Top CVE Trend baseline, then add supplemental NVD, CISA KEV, vendor, telemetry, campaign, and actor-card context where retained.

Definition

CVE / KEV: KEVs are the operational priority in this library because CISA has determined there is reliable evidence they are actively exploited in the wild. CVE cards provide the broader vulnerability record; KEV cards elevate CISA catalog status, required actions, remediation deadlines, ransomware use, affected products, linked actors and campaigns, and response context so teams can scope and act faster.

Search CVEs

Presets

Search Results / Output

CVE/KEV Cards

CVE/KEV card results start with SOCRadar CVE Radar's current Top CVE Trend view, then add IntelliOS supplemental NVD, CISA KEV, vendor, and telemetry watch cards for SMB, MSP, hosting, edge, AI-infrastructure, and business-app exposure.

156 CVE/KEV cards

CVE-2026-15409^[3]

CISA KEV

SonicWall SMA1000 Unauthenticated SSRF and WebSocket Proxy Vulnerability

CVE profile updated PANDA / CARDS campaign enrichment

Critical · CVSS 10.0

CISA KEV

KEV addedJul 14, 2026

Remediate byJul 17, 2026

Ransomware useUnknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Status / Exploit Watch^[3]

Active Exploitation · CISA KEV · Exploited as a zero day; chained with CVE-2026-15410 in observed intrusions.

Affected Products^[3]

SonicWall SMA1000 6210 · SonicWall SMA1000 7210 · SonicWall SMA1000 8200v

Target Sectors^[3]

Cross-industry · Enterprise remote access · Managed service providers

Target Countries / Exposure^[3]

Global

Industry Size

Small · Medium · Large · Enterprise

Actor / Campaign Correlation^[3]

INC Ransom · UTA0533 · SonicWall SMA1000 Zero-Day Exploitation Campaign

Summary^[3]

Unauthenticated SSRF in SMA1000 can establish a WebSocket proxy tunnel to appliance-local or appliance-reachable services, providing the foothold used in a two-CVE chain that can culminate in root compromise. Dark Reading separately reports that one Rapid7-observed case progressed to ransomware.

SonicWall PSIRT >

CVE-2026-15410^[3]

CISA KEV

SonicWall SMA1000 Code Injection and Path Traversal Vulnerability

CVE profile updated PANDA / CARDS campaign enrichment

High · CVSS 7.2

CISA KEV

KEV addedJul 14, 2026

Remediate byJul 17, 2026

Ransomware useUnknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Status / Exploit Watch^[3]

Active Exploitation · CISA KEV · Exploited as a zero day after access obtained through CVE-2026-15409; enables root-level command execution.

Affected Products^[3]

SonicWall SMA1000 6210 · SonicWall SMA1000 7210 · SonicWall SMA1000 8200v

Target Sectors^[3]

Cross-industry · Enterprise remote access · Managed service providers

Target Countries / Exposure^[3]

Global

Industry Size

Small · Medium · Large · Enterprise

Actor / Campaign Correlation^[3]

INC Ransom · UTA0533 · SonicWall SMA1000 Zero-Day Exploitation Campaign

Summary^[3]

Authenticated code injection/path traversal in SMA1000 can be chained after CVE-2026-15409 to execute commands as root, modify appliance configuration, deploy tooling, access credentials, and enable lateral movement. Dark Reading separately reports that one Rapid7-observed case progressed to ransomware.

SonicWall PSIRT >

CVE-2026-10523^[2][4][6]

Ivanti Sentry Companion Critical Vulnerability

CVE profile updated Canonical CVE record reviewed 2026-07-21

CVSS 9.9 CRITICAL

Status / Exploit Watch^[2][4][6]

Supplemental PANDA CVE Watch · Companion critical CVE in Ivanti Sentry remediation set

Affected Products^[2][4][6]

ivanti Sentry

Target Sectors^[2][4][6]

Healthcare · Professional Services · Education · Government · Technology · Managed Service Provider

Target Countries / Exposure^[2][4][6]

United States · Global

Industry Size

SMB · Mid-Market · Enterprise · Managed Service Provider · Public Sector

Actor / Campaign Correlation^[2][4][6]

Unknown exploitation activity · Ivanti Sentry critical remediation completeness watch

Summary^[2][4][6]

This companion Ivanti Sentry card keeps the broader vendor fix set visible so teams do not remediate only the SOCRadar-trending CVE-2026-10520 headline.

IntelliOS Emerging CVE Tracker >

Rows per page(3 cards)

1-3 of 156

Source of Trust / Citations

CVE Data Sources

CVE mode uses SOCRadar CVE Radar as the current trend baseline, then adds supplemental NVD, CISA KEV, vendor advisories, exploit telemetry, and IntelliOS static CVE watches for operational context.

Baseline Retained Sources

#	Tier	Publisher	Published	Why Used	Source
1	Tier 1	SOCRadar	Live CVE Radar trend view	Primary retained source for the current CVE-card corpus, including the Top CVE Trend last-30-days list, CVSS score, SOCRadar SVRS score, audience/social/news/repository signals, affected-product summaries, and exploitation context.	CVE Radar https://socradar.io/free-tools/cve-radar
2	Tier 0	NVD / NIST	Reference database	Canonical CVE detail source for descriptions, CVSS scoring where available, CPE/product context, references, and change history.	National Vulnerability Database https://nvd.nist.gov/vuln
3	Tier 0	CISA	Operational catalog	Authoritative operational priority source for known exploitation, due dates, and remediation pressure when a CVE appears in KEV.	Known Exploited Vulnerabilities Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Expansion / Consensus Sources

#	Tier	Publisher	Published	Why Used	Source
4	Tier 1	Vendor Advisories	Vendor security bulletins	Supplemental source class for affected versions, fixed versions, mitigations, compensating controls, and product-specific scope.	Vendor Security Advisories https://www.cisa.gov/news-events/cybersecurity-advisories
5	Tier 1	Security Research / Telemetry	Public threat research	Supplemental source class for exploitation telemetry, PoC status, scanning, ransomware linkage, campaign linkage, and defensive hunting context.	Exploit and Telemetry Sources https://www.vulncheck.com/
6	Tier 1	IntelliOS PANDA	Published static trackers	Supplemental PANDA tracker used to extend the public SOCRadar Top 20 trend set with NVD, CISA KEV, vendor, and public-telemetry CVEs relevant to US SMB, MSP, hosting, edge, AI-infrastructure, and business-application exposure.	New and Emerging CVEs for US SMBs /vault/new-and-emerging-cves-us-smbs-tracker

Change Log

CVE/KEV Cards

v0.6 / last updated Jul 17, 2026

AI agents maintain these card systems by checking source updates, correlating records, preserving source boundaries, and writing visible audit notes when the database or presentation changes.

KEV Top 10 audience presets and selection state added

Jul 17, 2026

Added newest-first KEV Top 10, KEV Top 10 + US, and KEV Top 10 + US + SMBs presets. Selected presets now stay highlighted and rename the card album and results headings until a manual search, filter change, or reset clears them.

KEV-first card support and newest-first catalog expansion

Jul 15, 2026

Added explicit CISA KEV fields, visible KEV baseball-card markings, remediation dates, a KEV-only newest-first preset, and 50 recent KEV records. Dev and production now carry 120 CVE/KEV cards, including 107 current CISA KEVs.

CVE library expanded to 70 active cards

Jul 10, 2026

Added 30 CISA KEV-backed supplemental cards for enterprise, edge, endpoint, collaboration, SD-WAN, MDM, Linux, and business-application exposure, bringing the active CVE deck to 70 cards.

Page 1 / 3

CARDS

Loading CVE/KEV Cards

CVE/KEV Cards

v0.6Last updated Jul 17, 2026Last AI Agent update: CVE Cards Scout / Jul 15, 2026

CVE-2026-3909

CISA KEV

KEV

CISA KEV / CVSS pending

CISA KEV added Mar 13, 2026 / known exploited

Added Mar 13, 2026 / Due Mar 27, 2026

Google Skia +2

Exploited as a zero day; chained with CVE-2026-15410 in observed intrusions.

Added Jul 14, 2026 / Due Jul 17, 2026

SonicWall SMA1000 6210 · SonicWall SMA1000 7210 · SonicWall SMA1000 8200v +3

Exploited as a zero day after access obtained through CVE-2026-15409; enables root-level command execution.

Added Jul 14, 2026 / Due Jul 17, 2026

SonicWall SMA1000 6210 +5

CVE cards use SOCRadar CVE Radar's current Top CVE Trend baseline, then add supplemental NVD, CISA KEV, vendor, telemetry, campaign, and actor-card context where retained.

Definition

Search CVEs

Presets

Search Results / Output

CVE/KEV Cards

156 CVE/KEV cards

CVE-2026-15409^[3]

CISA KEV

SonicWall SMA1000 Unauthenticated SSRF and WebSocket Proxy Vulnerability

CVE profile updated PANDA / CARDS campaign enrichment

Critical · CVSS 10.0

CISA KEV

KEV addedJul 14, 2026

Remediate byJul 17, 2026

Ransomware useUnknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Status / Exploit Watch^[3]

Active Exploitation · CISA KEV · Exploited as a zero day; chained with CVE-2026-15410 in observed intrusions.

Affected Products^[3]

SonicWall SMA1000 6210 · SonicWall SMA1000 7210 · SonicWall SMA1000 8200v

Target Sectors^[3]

Cross-industry · Enterprise remote access · Managed service providers

Target Countries / Exposure^[3]

Global

Industry Size

Small · Medium · Large · Enterprise

Actor / Campaign Correlation^[3]

INC Ransom · UTA0533 · SonicWall SMA1000 Zero-Day Exploitation Campaign

Summary^[3]

SonicWall PSIRT >

CVE-2026-15410^[3]

CISA KEV

SonicWall SMA1000 Code Injection and Path Traversal Vulnerability

CVE profile updated PANDA / CARDS campaign enrichment

High · CVSS 7.2

CISA KEV

KEV addedJul 14, 2026

Remediate byJul 17, 2026

Ransomware useUnknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Status / Exploit Watch^[3]

Active Exploitation · CISA KEV · Exploited as a zero day after access obtained through CVE-2026-15409; enables root-level command execution.

Affected Products^[3]

SonicWall SMA1000 6210 · SonicWall SMA1000 7210 · SonicWall SMA1000 8200v

Target Sectors^[3]

Cross-industry · Enterprise remote access · Managed service providers

Target Countries / Exposure^[3]

Global

Industry Size

Small · Medium · Large · Enterprise

Actor / Campaign Correlation^[3]

INC Ransom · UTA0533 · SonicWall SMA1000 Zero-Day Exploitation Campaign

Summary^[3]

SonicWall PSIRT >

CVE-2026-10523^[2][4][6]

Ivanti Sentry Companion Critical Vulnerability

CVE profile updated Canonical CVE record reviewed 2026-07-21

CVSS 9.9 CRITICAL

Status / Exploit Watch^[2][4][6]

Supplemental PANDA CVE Watch · Companion critical CVE in Ivanti Sentry remediation set

Affected Products^[2][4][6]

ivanti Sentry

Target Sectors^[2][4][6]

Healthcare · Professional Services · Education · Government · Technology · Managed Service Provider

Target Countries / Exposure^[2][4][6]

United States · Global

Industry Size

SMB · Mid-Market · Enterprise · Managed Service Provider · Public Sector

Actor / Campaign Correlation^[2][4][6]

Unknown exploitation activity · Ivanti Sentry critical remediation completeness watch

Summary^[2][4][6]

This companion Ivanti Sentry card keeps the broader vendor fix set visible so teams do not remediate only the SOCRadar-trending CVE-2026-10520 headline.

IntelliOS Emerging CVE Tracker >

Rows per page(3 cards)

1-3 of 156

Source of Trust / Citations

CVE Data Sources

CVE mode uses SOCRadar CVE Radar as the current trend baseline, then adds supplemental NVD, CISA KEV, vendor advisories, exploit telemetry, and IntelliOS static CVE watches for operational context.

Baseline Retained Sources

#	Tier	Publisher	Published	Why Used	Source
1	Tier 1	SOCRadar	Live CVE Radar trend view	Primary retained source for the current CVE-card corpus, including the Top CVE Trend last-30-days list, CVSS score, SOCRadar SVRS score, audience/social/news/repository signals, affected-product summaries, and exploitation context.	CVE Radar https://socradar.io/free-tools/cve-radar
2	Tier 0	NVD / NIST	Reference database	Canonical CVE detail source for descriptions, CVSS scoring where available, CPE/product context, references, and change history.	National Vulnerability Database https://nvd.nist.gov/vuln
3	Tier 0	CISA	Operational catalog	Authoritative operational priority source for known exploitation, due dates, and remediation pressure when a CVE appears in KEV.	Known Exploited Vulnerabilities Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Expansion / Consensus Sources

#	Tier	Publisher	Published	Why Used	Source
4	Tier 1	Vendor Advisories	Vendor security bulletins	Supplemental source class for affected versions, fixed versions, mitigations, compensating controls, and product-specific scope.	Vendor Security Advisories https://www.cisa.gov/news-events/cybersecurity-advisories
5	Tier 1	Security Research / Telemetry	Public threat research	Supplemental source class for exploitation telemetry, PoC status, scanning, ransomware linkage, campaign linkage, and defensive hunting context.	Exploit and Telemetry Sources https://www.vulncheck.com/
6	Tier 1	IntelliOS PANDA	Published static trackers	Supplemental PANDA tracker used to extend the public SOCRadar Top 20 trend set with NVD, CISA KEV, vendor, and public-telemetry CVEs relevant to US SMB, MSP, hosting, edge, AI-infrastructure, and business-application exposure.	New and Emerging CVEs for US SMBs /vault/new-and-emerging-cves-us-smbs-tracker

Change Log

CVE/KEV Cards

v0.6 / last updated Jul 17, 2026

AI agents maintain these card systems by checking source updates, correlating records, preserving source boundaries, and writing visible audit notes when the database or presentation changes.

KEV Top 10 audience presets and selection state added

Jul 17, 2026

KEV-first card support and newest-first catalog expansion

Jul 15, 2026

CVE library expanded to 70 active cards

Jul 10, 2026

Added 30 CISA KEV-backed supplemental cards for enterprise, edge, endpoint, collaboration, SD-WAN, MDM, Linux, and business-application exposure, bringing the active CVE deck to 70 cards.

Page 1 / 3