128 CVEs Got Public Exploit Code Yesterday. Only 19 Are in CISA's Catalogue. Here Are the Four Worth Your Afternoon — and the 73% Error Rate We Found in Our Own Tooling While Checking.

Our exploit harvester collected 679 artefacts across 128 distinct CVEs in a single day. We cross-referenced every one against CISA's Known Exploited Vulnerabilities catalogue.

Nineteen are listed. One hundred and nine are not.

That is not a criticism of KEV. The catalogue's evidentiary bar is exactly why it is worth reading, and most CVEs never enter it because most CVEs are never exploited. But it is worth being precise about what the catalogue is: KEV records what already happened to somebody else. Public exploit code is what happens next, and if your patching priority waits for a KEV entry, the gap between those two things is the size of your blind spot.

The four worth an afternoon

Ranked by exploit-code activity, not by CVSS. A 9.8 nobody has written code for is less urgent than a 7.5 with four working proof-of-concepts.

CVE-2026-21962 — Oracle HTTP Server, WebLogic Proxy Plug-in

Three-plus independent proof-of-concept repositories. Our extractor pulled real target paths straight out of the exploit source, which means you can hunt for this today without buying anything.

Grep your access logs for requests to /weblogic/, /wl_proxy/, /bea_wls_internal/, /_proxy/ and /proxy/. If your load balancer or web tier is not meant to serve those paths, a request for one is a probe, and probes precede exploitation.

WebLogic pre-authentication flaws have a long history of going from published code to internet-wide scanning within days. This one is not in KEV.

CVE-2026-23744 — remote code execution

Thirty-two separate repositories processed by our harvester, published by unrelated authors — InzegoSec, H1sok444, suljov, w3nch and others, none of whom appear to be coordinating.

That pattern is worth understanding on its own. Multiple independent authors racing to publish is the signature of a field forming, not of a single actor. The last time we measured what happens next, a Kemp LoadMaster flaw went from public exploit to 792 attempts from 65 distinct source addresses in six weeks. Not one attacker with a tool — everybody with a scanner.

CVE-2026-64638 — WordPress, cross-site scripting to shell

The repositories are named literally XSS2Shell. The escalation path ends at code execution rather than a popup, and WordPress is the most-scanned software on the internet.

Watch /wp-json/, /wp-login.php and /wp-admin/admin-ajax.php. We observed WordPress path enumeration against our own properties the same week, from unrelated infrastructure — that surface is permanently live regardless of this particular CVE.

CVE-2026-1529 — Keycloak, unauthorised registration

Improper invitation-token validation permitting account registration that should not be possible.

Quieter than the other three and strategically the worst of them, because Keycloak is the identity provider. An account created illegitimately here is a legitimate account everywhere downstream. Audit your registrations against valid invitations. This is the one that does not look like an incident until much later.

What this is not

We are not reporting exploitation. We checked our own edge telemetry for every one of these — WebLogic paths, XSS2Shell, Keycloak — across 2.9 million block events and 8.6 million auto-blocker decisions. Zero verified hits.

Published exploit code is a leading indicator. It tells you the weapon exists and is downloadable. It does not tell you anyone has fired it.

And a caveat that cuts against us, because it should: our edge is one small site. Nobody points a WebLogic exploit at a threat-intelligence blog. Absence of probes here is the right check to run and completely the wrong thing to conclude from. If you run WebLogic in anger, your logs are a far better sensor than ours.

The part where we tell on ourselves

We were going to publish a list of callback IP addresses extracted from these proof-of-concepts. Hardcoded command-and-control infrastructure in exploit code is usually the cheapest early attribution signal available.

So we pulled ours, and it was garbage.

132 of 182 extracted addresses were not addresses at all. They were Oracle WebLogic release numbers — 12.2.1.4, 14.1.1.0, 14.1.2.0 — sitting in the affected-versions line of the PoC. Chrome version strings scraped out of User-Agent literals, which is where 119.0.0.0 through 146.0.0.0 came from. Placeholders like 1.2.3.4 and 8.8.8.8. And an SNMP OID prefix, 1.3.6.1, which is not an IP address in any sense at all.

A 73% error rate, every one filed as "hardcoded C2 callback IP in PoC."

The cause was simple and stupid: the extractor matched anything shaped like a dotted quad and excluded only private ranges. It has no way to know that a number on a line about affected versions is a version.

What contained it is the part worth copying. Every one of those records landed at confidence 70. Our gate into the blocking artefacts — ips.csv, domains.csv, the edge shield — is 80. Not one piece of that garbage reached an enforcement path or a customer. A 73% error rate was absorbed entirely by a threshold, which is the single best argument for confidence gating we have encountered, and we found it by accident while looking for something else.

The extractor now requires network context on the same line as the address — a scheme, a connect call, an LHOST, a port. Requiring evidence of network intent beats trying to enumerate every way a number can resemble an address. Tested: eight dotted quads in a sample PoC reduce to the two that are genuinely callbacks. The 177 bad records are purged and the purge is verified by read-back.

We are telling you this instead of quietly deleting them because a vendor's error rate is exactly the thing you cannot see from outside, and we would rather you knew ours.

What to actually do on Monday

Grep for the WebLogic paths. Audit your Keycloak registrations. Patch WordPress. None of that requires a subscription to anything.

More generally: stop treating catalogue listing as the trigger to act. KEV is an excellent audit backstop and a lagging alert. The signal that changes your risk is public exploit availability, and that changes in an afternoon.

Was this useful? We would genuinely like to know

We publish because it helps defenders who cannot buy a threat feed. That is the entire point, and we have been running on the assumption that it works.

We would rather measure it than assume it. If this was worth your time — or if you came here for something and did not find it — tell us in thirty seconds at analytics.dugganusa.com/nps.html (https://analytics.dugganusa.com/nps.html?post=left-of-boom-128-cves). No cookies, no tracking, no third parties, and your address is hashed and never stored.

If the answer comes back that nobody needs this, we would rather know that too.

We guarantee five percent of what we publish is wrong. Today's most likely five percent is the ranking — we ordered these four by exploit-code activity, and activity is a proxy for interest, not for danger. A quiet vulnerability in something you actually run beats a noisy one in something you do not.

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.