🔓
Exploit Intelligence Centre

Track actively exploited vulnerabilities, emerging threats, and real-world attacker behavior – powered by Rootshell’s Velma platform.

This report is generated using Velma (Vulnerability Enhanced Learning Machine AI) – Rootshell’s exploit intelligence engine.

Velma focuses on one thing: understanding when vulnerabilities actually become a problem.

There’s no shortage of vulnerability data out there, and most of it is driven by static scores. But risk isn’t static. A vulnerability can sit there for months with little real-world relevance, then overnight become critical when exploit code is released or it starts being used in the wild.

Velma tracks that shift.

By analysing exploit availability, attacker activity, and how vulnerabilities are being used in real-world scenarios, Velma highlights what’s genuinely worth paying attention to – not just what’s highly scored, but what’s actually exploitable.

This report provides a current view of the threat landscape, prioritizing vulnerabilities that are actively being weaponised or realistically used in attack paths.

For most organizations, the challenge isn’t a lack of vulnerabilities – it’s knowing which ones actually matter.

Velma Threat Prioritisation Matrix

Continuously updated list of vulnerabilities actively exploited in the wild, helping security teams prioritize what actually matters.

Priority	Vulnerability / Product	CVE	Exploit Status	Risk
1 – Critical	Ivanti Connect Secure	CVE-2026-104935	Active exploitation reported	9.9
2 – Critical	Fortinet FortiMail	CVE-2026-104286	Active exploitation reported	9.9
3 – Critical	F5 BIG-IP APM	CVE-2026-94127	Active exploitation reported	9.8
4 – Critical	Citrix NetScaler	CVE-2026-88772	Active exploitation reported	9.8
5 – Critical	VeloCloud Orchestrator	CVE-2026-93952	Active exploitation reported	9.8
6 – Critical	SonicWall SMA1000	CVE-2026-102255	Honeypot activity reported	9.7
7 – Critical	Bricksforge WordPress	CVE-2026-85097	Active exploitation reported	9.7
8 – Critical	MikroTik RouterOS	CVE-2026-67279	Active exploitation reported	9.7
9 – Critical	Atlassian Data Center	CVE-2026-21589	Active exploitation reported	9.6
10 – Critical	Cisco Secure Email	CVE-2026-76519	Exploitation unconfirmed	9.5
11 – Critical	Check Point	CVE-2026-91843	No exploitation indicated	9.5
12 – Critical	Next.js	CVE-2026-94545	Exploitation unconfirmed	9.4
13 – High	AhsayCBS	CVE-2026-105133	Exploitation unconfirmed	9.2
14 – High	Veeam Agent	CVE-2026-32996	Active exploitation reported	9.2
15 – High	Roundcube Webmail	CVE-2026-48842	Exploitation unconfirmed	9.1
16 – High	Adobe Commerce	CVE-2026-71362	Exploitation unconfirmed	9.0
17 – High	Microsoft SharePoint	CVE-2026-65660	Exploitation unconfirmed	8.9
18 – High	Microsoft Windows Shell	CVE-2026-96951	Exploitation unconfirmed	8.8
19 – High	Palo Alto PAN-OS	CVE-2026-0322	Exploitation unconfirmed	8.7
20 – High	WordPress Core	CVE-2026-93485	No known exploitation	8.4
21 – High	CardDAV / cPanel	CVE-2026-87899	Exploitation unconfirmed	8.2