Exposure Signal Digest · Archive

What moved
that week

Week of June 30, 2026

By Jonathan Risto

This is an archived issue. See the latest digest or all issues.

Why this digest exists

Most CVEs never move.
We watch the ones that do.

Exploitation probability spikes overnight. Public exploits land. CVEs cross into confirmed in-the-wild use. That movement, the change, is what ESIP scores and surfaces.

Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.

4
Escalating this week
6
New KEV additions
1
Newly weaponized
What moved

The movers.

Mover #1 · EUVD-confirmed exploitation
CVE-2026-34908
Improper access control
CriticalConfirmedVerified
What changed
ENISA EUVD confirmed exploitation on June 24.
Why it matters

Government-confirmed exploitation, corroborated by ENISA EUVD. This is the combination that says act now, not wait for more evidence.

Mover #2 · EUVD-confirmed exploitation
CVE-2026-34909
Path traversal
CriticalConfirmedVerified
What changed
ENISA EUVD confirmed exploitation on June 24.
Why it matters

Government-confirmed exploitation of a path-traversal weakness, corroborated by ENISA EUVD. Confirmed in-the-wild use is the trigger to prioritize.

Mover #3 · Confirmed + EPSS surge
CVE-2026-34910
Improper input validation
CriticalConfirmedVerified
What changed
EPSS jumped 0.336 to 0.818 (+0.482) this week, on a CVE already confirmed exploited.
Why it matters

Already government-confirmed, and now accelerating: a near 0.5 EPSS jump in a week. It is moving fast, so prioritize it.

Mover #4 · Newly weaponized
CVE-2026-45087
Dalfox XSS scanner
HighActiveHigh
What changed
A public Metasploit module landed on June 25 (dalfox_server_rce).
Why it matters

Active exploitation at high severity, now with a public weaponized module. Escalating. Check it against your asset inventory.

New confirmed exploitation

Newly confirmed exploited.

CVE-2026-20230
Cisco Unified Communications Manager
Jun 25
CVE-2026-12569
Critical remote code execution
Jun 25
CVE-2026-34908
Improper access control
Jun 23
CVE-2026-34909
Path traversal
Jun 23
CVE-2026-34910
Improper input validation
Jun 23
CVE-2025-67038
Lantronix EDS5000
Jun 23
Newly weaponized

New public exploits.

CVE-2026-45087
Dalfox XSS scanner (new Metasploit module)
Jun 25
The week in numbers

Stop patching by static score.

1,634
Active Critical signals
131
Active High signals
4
Escalating this week
6
New KEV additions
1
New weaponized exploits

Browse every issue, or read the latest.

Look up any CVE Get a free API key →