Exploited vulnerabilities, weekly

Exploited vulnerabilities, mapped to the version that fixes them.

A small, human-reviewed feed of what attackers are actually using, for engineers on call and for the coding agents working next to them. Each record names the package, the affected versions and the first safe version.

Read this week Use the JSON API

Free, no account or key
Two sources per record
No exploit code, ever

$ curl -s ziro.sh/feed.json \
    | jq '.data[0] | {id, affects}'
{
  "id": "CVE-0000-0000",
  "affects": [{
    "ecosystem": "npm",
    "package": "examplelib",
    "ranges": ["<1.2.3"],
    "fixed": ["1.2.3"]
  }]
}
$

01 / Feed

This week

2026-44, Oct 26–Nov 1, 2026

Nothing published for week 2026-44 yet.

The feed goes live after a two-week private review run. Every record is checked by a person against at least two sources before it appears here, in feed.json and in RSS.

This is the shape each record will take: the vulnerable range, then the version that fixes it.

CVE-0000-0000Exploited, in CISA KEVSample, not a real advisory

Remote code execution in examplelib

npm/examplelib
<1.2.3
fixed in 1.2.3
>=2.0.0 <2.0.5
fixed in 2.0.5

CVSS: 9.8
EPSS: 94%
Exploited since: 2026-10-17

02 / Agents

For coding agents

API docs

Everything here is a static file. Point your agent at llms.txt, poll the JSON, or ask any page for Markdown with Accept: text/markdown.

/feed.json: Records from the last 30 days, newest first.
/records.json: Every published record.
/cve/{id}.json: One record by CVE or incident id.
/week/{yyyy-ww}.json: One ISO week of records.
/schema/record.v1.json: JSON Schema for a record.
/openapi.json: OpenAPI 3.1 description of these endpoints.
/rss.xml: RSS 2.0 feed of the last 30 days.
/llms.txt: Index of everything here, for language models.

curl -s https://ziro.sh/feed.json | jq '.data[] | {id, affects}'

03 / Rule

What gets in

A vulnerability enters the feed when any of these is true. Everything else, including most CVEs, stays out.

It is in the CISA Known Exploited Vulnerabilities catalog.
Its EPSS exploit probability is above 0.5.
A vendor advisory confirms exploitation in the wild.
It affects a common stack: Node, Python, PHP, Go, Rust, Postgres, Redis, nginx, Cloudflare, AWS, Vercel or Railway.

Sources: CISA KEV, OSV.dev, GitHub Security Advisories, NVD, FIRST EPSS and vendor advisories. How records are made.