Exposure Signal Digest · Archive

What moved
that week

Week of July 7, 2026

By Jonathan Risto

This is an archived issue. See the latest digest or all issues.

Why this digest exists

Most CVEs never move.
We watch the ones that do.

Exploitation probability spikes overnight. Public exploits land. CVEs cross into confirmed in-the-wild use. That movement, the change, is what ESIP scores and surfaces.

Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.

4
Escalating this week
1
New KEV addition
6
Newly weaponized
What moved

The movers.

Mover #1 · EUVD-confirmed exploitation
CVE-2026-45659
Microsoft Office SharePoint
CriticalConfirmedVerified
Weakness: CWE-502 Deserialization of Untrusted Data
What changed
ENISA EUVD confirmed exploitation on July 2.
Why it matters

Government-confirmed exploitation, corroborated by ENISA EUVD. This is the combination that says act now, not wait for more evidence.

Mover #2 · Newly weaponized
CVE-2026-41264
Flowise LLM builder
HighActiveHigh
Weakness: CWE-184 Incomplete List of Disallowed Inputs
What changed
A public Metasploit module landed (flowise_auth_rce).
Why it matters

Active exploitation at high severity, now with a public weaponized module. Escalating, so check it against your asset inventory.

Mover #3 · Newly weaponized
CVE-2024-27822
macOS PackageKit privilege escalation
HighActiveHigh
Weakness: CWE-277 Insecure Inherited Permissions
What changed
A public Metasploit module landed (packagekit_zshenv_privesc) one day ago.
Why it matters

A weaponized exploit appeared just a day ago, so the threat picture is actively changing.

Mover #4 · Newly weaponized
CVE-2026-44225
Pulpy app packager
HighActiveHigh
Weakness: CWE-22 Path Traversal; CWE-284 Improper Access Control
What changed
A weaponized exploit landed on ExploitDB (entry 52616).
Why it matters

Active at high severity with a public exploit now available. Escalating, so check it against your asset inventory.

New confirmed exploitation

Newly confirmed exploited.

CVE-2026-45659
Microsoft Office SharePoint (deserialization)
Jul 1
Newly weaponized

New public exploits.

CVE-2026-44225
Pulpy desktop packager (ExploitDB)
Jul 7
CVE-2026-48909
JoomShaper SP LMS below 4.1.4 (ExploitDB)
Jul 7
CVE-2026-49069
WPZOOM Portfolio reflected XSS (ExploitDB)
Jul 7
CVE-2026-9271
KeepInMind Dashboard Notes (ExploitDB)
Jul 7
CVE-2024-27822
macOS PackageKit privesc (Metasploit)
Jul 6
CVE-2026-41264
Flowise LLM builder (Metasploit)
Jul 2
The week in numbers

Stop patching by static score.

1,636
Active Critical signals
120
Active High signals
4
Escalating this week
1
New KEV addition
6
New weaponized exploits

Browse every issue, or read the latest.

Look up any CVE Get a free API key →