Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.
Source: [Dev.to](https://dev.to/devaland/actively-exploited-this-week-9-new-cisa-kev-entries-12-october-to-18-october-2026-3dno)