Cybersecurity report highlights non-CVE vulnerabilities and new CISA KEV entries

Recent cybersecurity analysis emphasizes the limitations of relying solely on Common Vulnerabilities and Exposures (CVE) databases. Research indicates that a significant portion of real-world risk stems from non-CVE vulnerabilities, including flaws in custom code, SaaS configurations, business logic errors, and misconfigurations like dangling DNS records or expired certificates. Because the CVE program is primarily designed for distributed software, many cloud-native web application flaws and slow-disclosed vulnerabilities often bypass traditional scanners.

Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) added five new entries to its Known Exploited Vulnerabilities (KEV) catalogue for the week of October 5 to October 11, 2026. These actively exploited vulnerabilities include flaws in Strapi, ONLYOFFICE Docs Server, Apache Struts, ISC BIND, and ProFTPD.

In related data breach news, Have I Been Pwned reported several significant account breaches, including Angel One with over 6.7 million accounts, Neogen with approximately 435,000 accounts, CyrusOne with over 373,000 accounts, and Double Counter with approximately 274,000 accounts.