Trends

6 weeks so far, oldest first. Counts are the items on each week's page, so they describe what the reviewed sources published, not the whole threat landscape.

The table covers six weeks from 2026-W38 to 2026-W46. W42, W44 and W45 are not included. Every week lists 45 items, so the counts can be compared directly. The biggest change is in W46: 21 items were flagged as exploited and 21 were on the KEV list. In the five earlier weeks, each of those counts stayed between 7 and 11. The W46 figure is close to double the previous high and nearly half of that week's items. Because W44 and W45 are missing, the data cannot show whether the rise was sudden or gradual.

The mix of vulnerability types has also shifted. Type labels cover only some items (13 to 33 labels a week), and most counts are small. Privilege escalation led W38 with 13 but appeared only once in each of the last two weeks. Remote code execution peaked at 9 in W39 and has stayed between 1 and 5 since. Authentication and authorization bypass together rose from 1 in W41 to 6 in W43 and 7 in W46. In W46, authentication bypass (5) was the most common type. Injection flaws (command, code and SQL) went from 1 to 3 to 4 over the same weeks. XML external entity flaws (2) appear for the first time in this table in W46.

Items tagged M365 rose from 5 in W38 to 13 in W39, fell back to 5 by W43, then rose to 10 in W46. The main thing to watch is whether the exploited and KEV counts stay near the W46 level or return to the earlier 7 to 11 range. One high week after a gap in the data is not yet a trend. The rise in bypass and injection flaws is also worth following, though both rest on small numbers. For teams working through W46, the exploited items are the place to start.