Cross-source corroborated CVEs

ThreatFilter ingests 52 public threat-intelligence feeds. A CVE gets a page here only once at least 3 distinct sources have reported it, which is a fraction of a percent of everything seen. Each page is the raw record of who published first and how long every other source took to follow, which is a confidence signal no single advisory can give you.

8 corroborated
8 in CISA KEV
6 reported as exploited

CVE-2026-58644

4 sources INFO 9.8 CISA KEV EXPLOITED microsoft

First reported 2026-07-14 by microsoft-msrc , then cisa-kev, thehackernews, rapid7-blog
CVE-2026-63030

4 sources HIGH 7.5 CISA KEV EXPLOITED wordpress

First reported 2026-07-17 by rapid7-blog , then tenable-advisories, sans-isc, cisa-kev
CVE-2026-15409

3 sources MEDIUM 10.0 CISA KEV EXPLOITED sonicwall

First reported 2026-07-14 by cisa-kev , then rapid7-blog, tenable-advisories
CVE-2026-15410

3 sources MEDIUM 10.0 CISA KEV EXPLOITED sonicwall

First reported 2026-07-14 by cisa-kev , then rapid7-blog, tenable-advisories
CVE-2026-45659

3 sources MEDIUM 8.8 CISA KEV EXPLOITED microsoft

First reported 2026-07-01 by cisa-kev , then thehackernews, tenable-advisories
CVE-2026-50522

3 sources MEDIUM 9.8 CISA KEV EXPLOITED microsoft

First reported 2026-07-14 by microsoft-msrc , then thehackernews, cisa-kev
CVE-2026-56155

3 sources MEDIUM CISA KEV microsoft

First reported 2026-07-14 by cisa-kev , then microsoft-msrc, tenable-advisories
CVE-2026-56164

3 sources MEDIUM CISA KEV microsoft

First reported 2026-07-14 by cisa-kev , then microsoft-msrc, tenable-advisories

Where this comes from

Nothing on these pages is hand-written. The corroboration set is recomputed from the live feed on every build, so a CVE appears here the moment a third independent source reports it and the timeline extends itself as more do.

Live advisory feed · Every source we track · Analyst tools · API