Vulnerability Report - October 2026

Introduction

This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently sighted vulnerabilities for October 2026, based on data aggregated from Vulnerability-Lookup, the CISA Known Exploited Vulnerabilities catalog, the CIRCL KEV catalog, the ENISA EUVD / EU CSIRTs Network feed, honeypot observations from The Shadowserver Foundation, the Previdian catalog (formerly known as KEVIntel – same catalog, new name), and contributor comments and bundles. These five KEV catalogs are federated through the GCVE initiative: each one is identified by the UUID of the Global Naming Authority (GNA) that publishes it, and exchanged between instances following the GCVE-BCP-07 specification – which is what makes the catalog coverage comparison further down possible. Sightings come from MISP, Exploit-DB, Bluesky, Mastodon, Telegram, GitHub Gists, Nuclei, SPLOITUS, Metasploit, and more. For further details, please visit this page.

October was the month of PHP2Shell. Two memory-safety flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, leaked ahead of a coordinated release on 21 October. They drew 1,773 sightings between them, more than the next four vulnerabilities combined. Previdian and Shadowserver’s honeypots both registered exploitation on disclosure day, five days before CISA listed them. The second thread is the remote-access appliance: Ivanti Connect Secure had three CISA entries, the first of them confirmed by CIRCL four days before its CVE was even published. NetScaler, FortiMail, BeyondTrust, PAN-OS, Cisco ASA and Arista VeloCloud complete the picture. The CVE Program set another monthly record with more than 17,000 CVEs, and total sightings rose by a fifth. Exploitation-typed and proof-of-concept sightings, however, fell sharply: the noise grew while the exploit signal shrank.

The Month at a Glance

17,097 CVEs were published in October 2026 (from the CVE List v5 source alone), up from 14,959 in September. That is a 14.3% month-over-month increase, and for the third month in a row the highest monthly volume ever recorded. Vulnerability-Lookup also ingested 18,914 GitHub security advisories (14,128 in September) and 336 PySec advisories (194) over the same period.

Vulnerability-Lookup collected 52,234 sightings across 24,331 distinct vulnerabilities during October 2026, up from 43,408 in September (+20.3%). The breakdown:

The September figures used for comparison are those the API returns today. The September report quoted 43,109 sightings; late-arriving data has since raised that to 43,408.

The two halves of the table moved in opposite directions. “Seen” mentions rose from 33,094 to 45,166 (+36%), and the number of distinct vulnerabilities sighted jumped by 58%, roughly in step with the record CVE volume. Published proof-of-concept sightings, by contrast, fell from 6,653 to 4,106 (−38%), and the number of distinct vulnerabilities with a PoC sighting nearly halved (3,837 to 2,116). Exploitation-typed sightings fell from 3,604 to 2,891 (−20%), spread over 627 distinct vulnerabilities against 934 in September. A large part of what remains is a steady background: ten long-exploited vulnerabilities received an exploitation sighting on every single day of the month. They include the Huawei HG532 CVE-2017-17215, the Realtek SDK CVE-2014-8361, the GPON router CVE-2018-10562, PHPUnit CVE-2017-9841, Metabase CVE-2023-38646 and CitrixBleed 2 CVE-2025-5777. Confirmed sightings went the other way, from 57 to 68, each on a different vulnerability. Among them are the first Ivanti Connect Secure flaw, both AhsayCBS issues, PHP2Shell, the Collabora CODE server injection and the Brotli decoder overflow. Three patched sightings were also recorded, where September had none: two on CVE-2026-109618 on disclosure day, and one on a GitHub advisory.

The daily breakdown follows the disclosure calendar more closely than in September. 1 October (4,148 sightings, 3,548 distinct vulnerabilities) is a catch-up of the end-of-month publication backlog. Unlike September’s opening batch, 93% of it concerns 2026 CVEs, led by the Cisco SD-WAN Manager bypass and the Apple CoreGraphics zero-day. The busiest day is 14 October (4,751), the day after Patch Tuesday, carried by the Ivanti Connect Secure bypass, the Windows Shell command injection and the Cisco Secure Email Gateway file write. The PHP2Shell release on 21 October (3,537) produced the only break in the exploitation band: 245 exploitation-typed sightings, against at most 119 on any other day. They were spread across 223 vulnerabilities, so it was a busy reporting day rather than a single campaign. Proof-of-concept sightings rise noticeably in the second half of the month, from about 90 a day to between 135 and 214 from 19 to 30 October, as the PHP, Brotli and Linux kernel exploit code appeared. The quietest days all fall on weekends (3–4, 11, 17–18 and 24 October), each under 700.

In the exploitation-typed sightings, Log4Shell (CVE-2021-44228, 35 exploitation reports) shares the top with a newcomer of only ten days, PHP2Shell CVE-2026-109618 (35). Proof-of-concept activity concentrated on the same vulnerability (245), its companion CVE-2026-109619 (147) and the Brotli decoder overflow CVE-2026-111497 (90). Three Linux kernel flaws follow: the rtmutex issue CVE-2026-43499 (49, now in its third month near the top), the exec/POSIX timer use-after-free CVE-2026-98260 (42) and the IPv4 socket options use-after-free CVE-2026-98432 (33).

Across the month’s KEV additions, the dominant weakness patterns were path traversal and arbitrary file write (CWE-22/23: FortiMail, the Fortinet multi-product issue, the Cisco Secure Email Gateway, ONLYOFFICE, the Plex file write), authentication bypass by spoofing or missing authentication (CWE-290/287/306: Ivanti, BeyondTrust, AhsayCBS), OS command injection (CWE-77/78: SiteGuard, Collabora, AhsayCBS, Windows Shell, Struts) and memory safety (CWE-416 in PHP, CWE-787 in Brotli, CWE-119 in NetScaler).

Top 10 Vendors of the Month

Microsoft takes the top of the vendor ranking. Linux, which led for the previous two months with close to 40% of attributed CVEs, drops to third behind Oracle, whose quarterly Critical Patch Update fell in October. Google, the “unknown” slice (records without a usable vendor field), Apple, the Apache Software Foundation, IBM, Mozilla and Red Hat complete the list.

Top 10 Assigners of the Month

VulnCheck leads the assigners, ahead of GitHub’s CNA, Microsoft and Oracle. The kernel CNA, first in September, falls to sixth behind Patchstack, followed by VulDB, Chrome, Wordfence and WPScan. The WordPress ecosystem alone accounts for three of the ten assigners.

Top 10 Credits of the Month

WPScan stays first with around 565 credited vulnerabilities, again ahead of the VulDB CNA Team (about 505). Two individual entries follow: the researcher hieuPenguinnn with nearly 290 credits, and a researcher from the Post and Telecommunication Institute of Technology with about 230. Behind them are Swan Kalata (akalata), Mozilla, Greg Knaddison (greggles), Yaqi Chao, Juraj Nemec (poker10) and Wordfence PRISM, all between 130 and 160.

The complete list of credits is available on Vulnerability-Lookup.

Top 10 Vulnerabilities of the Month

PHP2Shell takes the first two places by a wide margin. The out-of-memory longjmp flaw CVE-2026-109618 has request memory left uninitialised; its companion CVE-2026-109619 has global state left pointing into freed request memory. Both lead to remote code execution in the interpreter, which makes nearly every PHP-based site a potential target. PHP pre-announced emergency patches a day early, details leaked before the 21 October embargo, and CISA listed both on 26 October. Previdian marks CVE-2026-109619 as used in malware, the only entry of the month with that flag. Third is the Google Brotli decoder buffer overflow CVE-2026-111497. A library flaw like this reaches every product that decompresses Brotli streams; CISA listed it on 27 October.

Two Linux kernel IPv4 issues that no catalog lists made the top ten on sighting volume alone: the socket-options use-after-free CVE-2026-98432, most discussed in the last three days of the month, and the checksum validation fix CVE-2026-99999.

The rest of the list is October’s CISA additions. Sharing fourth place are the GitLab CI/CD regular-expression code execution CVE-2026-97229, a third GitLab KEV entry in as many months, and the Atlassian Data Center file access issue CVE-2026-21589, which affects Confluence, Jira, Bitbucket, Bamboo and Crowd. Shadowserver’s honeypots logged 1,656 connections against CVE-2026-21589 on the day before CISA listed it. They are followed by the Ivanti Connect Secure spoofing bypass CVE-2026-104935, the NetScaler memory overflow CVE-2026-88779 (published a week after the eight-CVE bulletin of 27 September) and the unauthenticated FortiMail file write CVE-2026-104286. Just outside the top ten are September’s NetScaler RCE CVE-2026-88771 (124) and the SonicWall SMA1000 pre-authentication SSRF CVE-2026-102255 (110). Only Previdian lists the SonicWall flaw.

Known Exploited Vulnerabilities

New entries were added to the tracked Known Exploited Vulnerabilities catalogs during October. The five catalogs are complementary rather than redundant. CISA is the reference set. CIRCL and the ENISA / EU CSIRTs Network feed add European confirmations. Shadowserver’s honeypots show what is actually being attacked on the wire. Previdian aggregates public exploitation reports at higher volume and often earlier. Previdian, Shadowserver and, this month, ENISA each surface vulnerabilities no other catalog lists.

A total of 204 distinct vulnerabilities entered at least one tracked catalog this month: 36 were added by CISA, 4 by CIRCL, 12 were reported through the ENISA / EU CSIRTs Network feed, 54 were observed for the first time by Shadowserver’s honeypots and 160 were added by Previdian. The September report counted 166. Recomputed with today’s data, which includes Shadowserver’s back-fill and three ENISA entries missing at the time (see below), September comes to 208, so October is roughly level with it rather than up.

Shadowserver’s feed is back. The September report noted that no honeypot data had reached Vulnerability-Lookup after 7 September. The feed has since resumed and back-filled the gap, so the catalog now shows 108 first observations for September instead of the 16 reported at the time. Shadowserver’s October figure is complete. The CISA total is lower than September’s 43, and the ENISA feed went from 22 reports (19 counted at the time) to 12.

The month’s story is the remote-access appliance. Ivanti Connect Secure entered the CISA catalog three times. The authentication bypass CVE-2026-104935 was added on 13 October, the day its CVE was published. CIRCL had already confirmed it on 9 October, from its own incident response, four days ahead of CISA and of the CVE itself. The DSCache privilege escalation CVE-2026-111357 followed on 30 October, fifteen days after Previdian flagged it, together with the predictable-filename upload CVE-2026-118527, listed before its CVE record was published on 3 November. The rest of the edge list:

• Citrix NetScaler returned with the memory overflow CVE-2026-88779, reported through the ENISA feed on 2 October, two days before its bulletin and CISA’s listing.
• Fortinet had the FortiMail unauthenticated file write CVE-2026-104286, listed by CISA, ENISA and Previdian on 1 October, and a FortiOS/FortiProxy path traversal CVE-2025-61624.
• The BeyondTrust Remote Support origin-validation bypass CVE-2026-102764.
• The PAN-OS management-interface RCE CVE-2026-0322.
• The Cisco Secure Email Gateway AMP file write CVE-2026-76519, the second Cisco Secure Email entry in two months, and an ASA/FTD SSL VPN denial of service.
• The Arista VeloCloud Orchestrator SQL injection CVE-2026-114625.

Server-side software made up the rest of the month. The two PHP2Shell issues and the Brotli overflow are the headline. Plex Media Server had four entries on 20 October (two SSRFs, a URL injection and an arbitrary file write, a chain disclosed in September). The Collabora Online built-in CODE server for Nextcloud had an OS command injection CVE-2026-110447 that its CVE record says was exploited in September and October. Two AhsayCBS backup-server issues were listed, and their initial patch proved incomplete. The list also includes EG Secure Solutions' SiteGuard WAF, an Adobe Commerce file upload, GitLab, Atlassian, Zammad (the two NCSC-NL zero-days reported in September, which CISA listed on 2 October) and a Siemens Software Center DLL hijack.

One CISA batch stands apart. On 8 October, CISA added five vulnerabilities between three and eleven years old: Struts DMI CVE-2016-3081, ProFTPD mod_copy CVE-2015-3306, BIND TKEY CVE-2015-5477, ONLYOFFICE CVE-2021-3199 and Strapi CVE-2023-22894. All five come from the joint advisory AA26-281A on Chinese government-linked actors working with the Integrity Technology Group, which a contributor bundled four days later (see below).

Catalog coverage

204 distinct vulnerabilities entered at least one of the tracked KEV catalogs during October. The matrix below shows, for each of them, which catalogs cover it (as of publication). It was built with the KEV catalog coverage feature of Vulnerability-Lookup. Previdian is again the widest net with 178 of the 204, ahead of Shadowserver (54), CISA (46, including entries it had listed before October), ENISA (16) and CIRCL (4). The “First added” column gives the earliest date across all catalogs, so 19 rows predate October. These are entries one catalog picked up this month after another had already listed them, such as Shadowserver’s first honeypot hits on the SAP NetWeaver CVE-2016-3976 (in CISA since 2021) and the GeoVision CVE-2024-6047.

Six vulnerabilities of the month are present in four catalogs at once:

• In CISA, CIRCL, Previdian and Shadowserver: the Ivanti Connect Secure bypass CVE-2026-104935 and the GitLab path traversal CVE-2026-85706.
• In CISA, CIRCL, ENISA and Previdian: the SharePoint code injection CVE-2026-65660, which CIRCL added on 16 October after observing it from 26 September, and the Apple CoreGraphics zero-day CVE-2026-86950.
• In CISA, ENISA, Previdian and Shadowserver: the JFrog Artifactory bypass CVE-2026-82329 and the AhsayCBS authentication flaw CVE-2026-105133.

Seventeen more are in three catalogs. Among them are both PHP2Shell issues and the Atlassian file access (CISA, Previdian, Shadowserver), as well as FortiMail, NetScaler, the Siemens DLL hijack, the Windows Shell command injection and the two Zammad issues (CISA, ENISA, Previdian).

At the other end, 139 entries are visible through a single catalog: 113 only via Previdian, 22 only via Shadowserver and 4 only via ENISA. The ENISA-only entries are three Thymeleaf server-side template injection bypasses and the JBoss RichFaces expression language injection CVE-2015-0279, a cluster of Java expression-injection flaws that no other catalog lists. As in September, no entry is unique to CISA: every one of its 36 additions is also in Previdian.

CISA

The CISA KEV catalog added 36 entries in October, down from September’s 43 but still the second-busiest month of the year. Five are the legacy batch of 8 October tied to advisory AA26-281A. Three are Ivanti Connect Secure and four are Plex Media Server. As in September, none carries a known ransomware campaign use flag.

More KEV entries from the CISA Catalog.

CIRCL

The CIRCL KEV catalog added 4 entries during October, all marked as confirmed exploitation. The most significant is the Ivanti Connect Secure authentication bypass CVE-2026-104935, confirmed on 9 October and rated with maximum severity, unauthenticated and leading to remote code execution. CIRCL had it four days before CISA, Previdian and the CVE record itself. The other three corroborate existing CISA entries with European observations. These are the Apple CoreGraphics zero-day on 12 October, and on 16 October the GitLab commits-API path traversal and the SharePoint code injection, which CIRCL had first observed on 26 September.

More KEV entries from the CIRCL Catalog.

ENISA (EUVD)

Twelve entries were reported through the ENISA / EU CSIRTs Network (CNW) KEV feed during October, down from September’s record 22. Ten came through the CNW channel, one from ENISA itself (JFrog Artifactory) and one from CSIRT-IE (Apple CoreGraphics):

• Ahead of CISA:
  • The NetScaler memory overflow on 2 October, two days ahead of both CISA and the Citrix bulletin.
  • The Siemens Software Center DLL search-path flaw CVE-2026-110936 on 19 October, one day before CISA, based on Siemens ProductCERT’s own active-exploitation notice.
• Same day as CISA: the FortiMail file write on 1 October.
• European confirmations of entries CISA already lists:
  • The Windows Shell NTLM-leaking shortcut flaw CVE-2026-32202 (7 October), with European exploitation five months after CISA listed it in April.
  • JFrog Artifactory (1 October) and the Apple CoreGraphics zero-day (8 October), both listed by CISA in September.
  • The two AhsayCBS issues (23 October), nine days after CISA.
• Not in any other reference catalog:
  • Three Thymeleaf flaws reported on 10 October (CVE-2026-40477, CVE-2026-40478, CVE-2026-41901). All three bypass the Java template engine’s expression-injection protections and lead to server-side template injection when applications pass user input to templates. They were published in April and May, and are now reported exploited.
  • The decade-old JBoss RichFaces EL injection CVE-2015-0279, reported on 25 October.

The corrected September data adds a notable early report. CSIRT-IE flagged the Windows Shell command injection CVE-2026-96951 on 25 September, 18 days before Microsoft’s Patch Tuesday fix and the CISA listing on 13 October.

More KEV entries from the ENISA Catalog.

The Shadowserver Foundation

The Shadowserver KEV catalog is fed by honeypot-observed exploitation attempts. With the feed restored, 54 vulnerabilities were observed for the first time during October. Thirteen of them are in the CISA KEV catalog. In several cases the honeypots saw traffic before or alongside the official listing:

• PHP2Shell was hit on disclosure day: 870 connections against CVE-2026-109618 on 21 October and 202 against CVE-2026-109619 on the 22nd, five and four days before CISA.
• The Atlassian file access drew 1,656 connections on 14 October, the largest single-day count of the month, one day before CISA.
• The Ivanti bypass was seen on 16 October.

Outside the CISA set, the standout is the Circontrol CirCarLife EV-charger SCADA disclosure CVE-2018-16670, with 488 connections on 31 October. Others include the MajorDoMo command injection CVE-2023-50917 (76) and the unauthenticated Gotenberg RCE CVE-2026-42589 (22). Three entries fall in Shadowserver’s “ai-system” class: MLflow, the TEN Framework TMAN Designer and Dify. The remainder is a 5 October batch of Chinese enterprise software shared with Previdian (Yonyou, Inspur, iDocView, Fumasoft), WordPress plugins and the usual routers and cameras. Severity values are reproduced as published by Shadowserver (CVSS). The “In CISA KEV” column reflects the CISA catalog as of publication, not Shadowserver’s own flag at observation time.

More KEV entries from the Shadowserver Catalog.

Previdian (formerly KEVIntel)

The Previdian catalog aggregates public exploitation reports and added 160 entries in October, up from 156 in September and again by far the highest volume of the tracked feeds. It covers all 36 of CISA’s additions for the month, the second month in a row with full coverage.

Nineteen of those it flagged before CISA did, and none later; the other seventeen were listed on the same day. The earliest:

• The Struts DMI flaw CVE-2016-3081, 77 days ahead: Previdian listed it in July, long before the AA26-281A advisory brought it into the CISA catalog.
• The Ivanti DSCache privilege escalation CVE-2026-111357, 15 days ahead.
• The Atlassian file access CVE-2026-21589 and the Collabora CODE injection CVE-2026-110447, 9 days each.
• CVE-2026-109618, SiteGuard and both AhsayCBS issues, 5 days each, and CVE-2026-109619, 4 days.
• The Zammad pair, 2 days.
• Eight more by one day: all four Plex entries, the Cisco ASA denial of service, VeloCloud, the Fortinet path traversal and the Siemens flaw.

113 entries are unique to Previdian this month, 51 of them 2026 CVEs:

• WordPress plugins, the largest group (OttoKit privilege escalation, The Grid RCE, Zombify and Bricksforge file uploads, Ajax Search Pro, JetSearch and GamiPress SQL injections, and a WordPress core XSS).
• Back-catalog batches on 20 and 22 October with freshly assigned CVE numbers (2012–2022 IDs): path traversal and file inclusion in old WordPress plugins, and a long list of Chinese web applications (Weaver E-cology, FineReport, JeeWMS, DedeCMS, MetInfo, SeaCMS, PHPOK, YiShaAdmin).
• The AI stack, larger than in September: three MLflow issues, two Langflow code execution flaws (one over MCP stdio, CVSS 9.9), the unauthenticated Crawl4AI Docker API RCE CVE-2026-26216 (CVSS 10.0) and Gradio.
• The SonicWall SMA1000 pre-auth SSRF CVE-2026-102255 (CVSS 10.0, 110 sightings this month).
• Other notable single-catalog entries: two Gitea issues (CVE-2026-59774, 28.3% EPSS), a Redis RESTORE memory flaw, the Laravel TokenGuard authentication bypass, Oracle Application Object Library, FortiSIEM, three GFI KerioConnect issues, a MediaWiki ExternalData RCE, REDCap and Cacti.
• Older high-EPSS entries: the Barracuda ESG RCE CVE-2023-7102 (44.6% EPSS), the Apache Tika XXE CVE-2025-54988 (47.9%) and the MLflow path traversal CVE-2024-3848 (43.3%).

Vendor, product, CVSS and EPSS values below are reproduced as published by Previdian; very long product lists are shortened to their first item.

More KEV entries from the Previdian Catalog.

Top 10 Weaknesses of the Month

Memory safety holds the top three places for the fourth month running. Heap-based buffer overflow (CWE-122) climbs to about 13,000 occurrences, up from about 10,000 in September. Use-after-free (CWE-416) more than doubles to about 12,900, close behind and in line with the PHP2Shell and kernel issues of the month. Out-of-bounds read (CWE-125) follows at about 8,600. Far below come cross-site scripting (CWE-79) and missing authorization (CWE-862), each around 2,800, then integer overflow (CWE-190). Race conditions (CWE-362), incorrect authorization (CWE-863) and untrusted pointer dereference (CWE-822) enter the top ten.

Insights from Contributors

One community comment was published this month:

• Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway – an annotation on the NetScaler memory overflow CVE-2026-88779. The CVE record itself says almost nothing (“Vulnerability in NetScaler ADC and NetScaler Gateway”). The comment adds the vendor’s explanation: the flaw leads to denial of service under specific deployment conditions and only affects customer-managed deployments. That context matters when sorting it against September’s two NetScaler RCEs.

Contributors also curated advisories and research into three bundles during October:

• PHP2Shell (3 CVEs) – created on disclosure day. It groups CVE-2026-109618 and CVE-2026-109619 with a third CVE allocated in the same release, CVE-2026-115560. It records the timeline: PHP pre-announced emergency fixes for 21 October at 14:00 UTC, leaks claimed RCE on PHP 5 through 8, and the issues were rated CVSS v4 9.2. It links the php.net announcement and the Huntress write-up.
• Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (8 CVEs) – CISA advisory AA26-281A on actors enabled by the Integrity Technology Group, who combine large-scale scanning and botnets with hands-on exploitation. The bundle lists the eight CVEs the advisory names, which explain CISA’s 8 October batch of legacy entries. Three of them (Pulse Secure CVE-2019-11510, the GitLab ExifTool RCE CVE-2021-22205 and Shellshock CVE-2014-6278) were already in the catalog.
• Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (3 CVEs and a CERT-FR alert) – Claroty Team82’s research on the Danfoss AK-SM 800A refrigeration controllers used in supermarkets and cold storage. It covers a hidden “code-of-the-day” authentication bypass, a command injection leading to RCE and Nginx configuration injection (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452). Team82 found thousands of these management interfaces exposed to the internet.

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Funding

The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole.
Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL’s contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release

AIPITCH (AI-Powered Innovative Toolkit for Cybersecurity Hubs) is a co-funded EU project supported by the European Cybersecurity Competence Centre (ECCC) under the DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH program and CIRCL.
The VLAI severity levels used throughout this report are produced by models developed as part of AIPITCH.