Monthly, counts only

How the exploited list moved this month

Once a month: how many vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalogue, and how many of them sit in components that appear in inventories watched here. Two numbers and a sentence. It is not a list of vulnerabilities, it names no product, and nothing else is ever sent to the address.

Why a count: the reporting duty turns on exploitation of your product, and a catalogue entry is a reason to assess, not a reportable event.Art. 14⁠(1)⁠ What the monthly number tells you is how often the reason arises, which is the fact that decides whether anyone needs to be watching on the day it does.

The monthly digest is not configured on this deployment yet.

Past issues

The first issue is published on the first day of the month after the first full month of counting. Each one is kept here permanently.

Also on this

Article 14
What Article 14 of the Cyber Resilience Act requires: who reports, when the 24-hour, 72-hour and final clocks start, and which authority receives each filing.
Filing on the platform
Every field the ENISA platform asks for at each of the three stages, who may submit, what its validation does not gate, and what its own counter gets wrong.
Deadlines
Every date that matters in the Cyber Resilience Act, from entry into force to the reporting duty on 11 September 2026 and full obligations on 11 December 2027.
Where to report
The coordinating CSIRT in all 27 member states, the Article 14(7) rule for working out which one is yours, and why choosing wrong can void a notification.
Fines
Up to €15 million or 2.5% of turnover for the reporting duty, and what the other two bands cover. What the authority weighs, and where small companies stand.
Non-EU manufacturers
If your company is outside the EU but you sell into it, the Cyber Resilience Act applies. Here is how to work out which national authority receives your report.
Readiness
The Article 13 duties as a questionnaire, which eight of them block a filing, and the five documents a manufacturer needs by December 2027.
Product classes
Every important and critical product category in the Cyber Resilience Act, what each class means for conformity assessment, and why none changes a deadline.
Document outlines
The vulnerability handling process, disclosure policy, SBOM policy, Annex VII documentation and Annex V declaration, as outlines citing the article for each.

This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.