Heldnote / Board

Snapshot · 9 Nov 2026 · catalog 2026.11.06

What is being used, and what we will print.

Heldnote keeps the note and leaves the method out: class, impact, and the patch check, for vulnerabilities that are already being used. The numbers below are a cut of the public CISA KEV catalog, not a live feed and not a score.

01 Catalog

1,769

Entries in KEV catalog 2026.11.06, as published by the Zero Hunt mirror. We did not recount the full catalog. 35 added in 30 days, 107 in 90.

03 What this desk prints

  • Class, impact, patch check
  • What to look for afterwards
  • Reproduction steps
  • Samples and PoCs

The switches are a legend. They are not settings.

04 Federal window, one dot per row

6still inside the window, of 38 rows

  • In window on 9 Nov
  • Past the federal due date
  • Ransomware use known

Clockwise from twelve by due date. Hover a dot for the CVE, click to open it in the working set. 32 rows are past due. Past due is not the same as over.

06 Where the rows land

One square per row. Orange means the class line names no precondition: no account, no foothold. 7 of the 13 perimeter rows are orange. Why the edge goes first.

07 Additions by week

Weeks start on Monday. Amber dots carry the forensic triage flag: CISA wants a compromise check, not only a patch. The working set holds every October and November 2026 addition we logged plus seven earlier ones.

Latest notes

All eleven
09 Nov KEV Thirteen of thirty-eight rows are boxes at the edge Patch order 09 Nov Vuln Patched is not the same as clean After the fix 09 Nov Detect A web server should not start a shell Process tree 09 Nov Vuln The WordPress fix is unpacked by the old code CVE-2026-119977 09 Nov Malware Signed binary, unsigned intent Behavior

Heldnote · public desk · snapshot, not a sensor