Most Exploited Open-Source Vulnerabilities: Q2 2026 Edition

Note: CVE identifiers, and the per-CVE EPSS/CVSS/KEV-date figures attached to them, are illustrative examples based on real vulnerability patterns — they do not correspond to actual CVE records. Aggregate quarterly figures (KEV-addition counts, ecosystem advisory volumes, patch-time medians, and the GeekWala-scanned-project percentages) illustrate the shape of a real quarterly analysis using this report format; they are not audited external statistics. For real, per-CVE and per-project data, check your own dependencies with GeekWala's scanner.

A note on cadence: our March 2026 report was billed as the first in a monthly series. It was the only monthly edition we shipped. Rather than backfill three months we didn't actually analyze in real time, we're switching this series to a quarterly cadence going forward — enough time between editions to spot real trend shifts (which ecosystems are improving, which EPSS movements actually mattered) without diluting the report into a recap of routine advisory volume. This edition covers April through June 2026 in full.

Executive Summary: Q2 2026

• 19 new CVEs added to the CISA Known Exploited Vulnerabilities catalog across April-June, versus 7 in March alone — a pace consistent with the accelerating EPSS-to-KEV pipeline described below.
• 41% of GeekWala-scanned projects carried at least one KEV-listed dependency by end of quarter, up from 34% in March.
• npm (138 new advisories) and PyPI (94 new advisories) remained the highest-volume ecosystems; Go and crates.io again posted the fastest median patch times.
• 9 confirmed supply chain incidents involving compromised build tooling or post-install scripts, up from 3 in March — the trend flagged last quarter continued to accelerate rather than plateau.

Top 10 Most Exploited Vulnerabilities, Q2 2026

The table format mirrors what GeekWala's scanner surfaces from OSV advisory data, FIRST.org EPSS scores, and the CISA KEV catalog for a real dependency tree — but, per the note above, the CVE identifiers and their EPSS/CVSS/KEV-date values below are illustrative examples, not a real quarter-end data pull.

#1 CVE-2026-91001 (illustrative; npm, EPSS 0.81) was a command injection flaw in a widely used build-tooling CLI, exploited within days of disclosure via crafted package.json scripts in dependency-confusion-style attacks. It anchors this quarter's build-tooling trend described below.

#2 CVE-2026-91002 (illustrative; PyPI, EPSS 0.74) was an unauthenticated deserialization bug in a message-queue client library, actively exploited against internet-facing worker processes that consumed untrusted queue payloads.

#3 CVE-2026-91003 (illustrative; Maven, EPSS 0.69) repeats the pattern flagged in March: a Java ORM's dynamic query builder allowed column-name injection, this time in a different framework's implementation. If your team patched March's finding, check whether this is the same underlying library or a sibling implementation — the pattern keeps recurring because parameterized-query protections don't cover column/table identifiers by default.

CISA KEV Additions This Quarter

19 CVEs joined the KEV catalog across April, May, and June — more than double March's 7. The composition shifted too: April and May additions skewed toward npm and PyPI (consistent with build-tooling and CI-adjacent attack patterns), while June's additions were more evenly spread across RubyGems, Packagist, and NuGet, suggesting attackers broadened targeting beyond the highest-volume ecosystems once the easier wins there were patched.

EPSS Score Movements: The Quarter's Fastest Risers

Three vulnerabilities crossed from "watch list" to "patch now" fastest this quarter:

CVE-2026-91001 (illustrative) went from EPSS 0.11 to 0.81 in nine days after a working exploit was published to a public penetration-testing framework — the fastest EPSS climb GeekWala tracked all quarter, and a reminder that a low initial EPSS score is not a reason to deprioritize a critical-severity finding indefinitely.

CVE-2026-91006 (illustrative) climbed from 0.22 to 0.55 over three weeks as automated scanning for the vulnerable RubyGems dependency spread across public honeypot networks, ahead of its eventual June 2 KEV listing.

CVE-2026-91008 (illustrative) remains the quarter's highest-EPSS finding not yet on the KEV catalog (0.47 and climbing). We're tracking it into Q3 — treat it as functionally KEV-equivalent for prioritization purposes if it appears in your dependency tree.

Quarter-over-quarter, the EPSS-to-KEV lag continued compressing: median time from crossing EPSS 0.4 to KEV listing fell to 14 days in Q2, down from 18 days in Q1 (see our March report for the Q1 baseline). CISA's confirmation pipeline is getting faster, which makes EPSS an increasingly reliable leading indicator rather than a lagging one. For the full case on why EPSS beats CVSS as a prioritization signal, see our EPSS explainer — and for how rare exploitation actually is in aggregate, see At Most 6% of CVEs Are Exploited.

Ecosystem Breakdown, Q2 2026

The per-ecosystem patch-time gap held steady from March: Go and crates.io maintainers continue shipping fixes in 2-3 days, while Maven's enterprise-release cadence keeps it at roughly double that. The volume shift worth noting is Go's — advisory count nearly tripled versus March (18 to 52), which tracks with Go's continued growth in cloud-native tooling rather than any change in the language's security posture.

Build Tooling: This Quarter's Recurring Theme

Nine confirmed supply chain incidents this quarter involved compromised build tooling or post-install scripts — triple March's count of three. The pattern is consistent: malicious code executes during npm install, pip install, or an equivalent build step, exfiltrating CI environment variables before the application is ever deployed. Because the payload never reaches the running application, standard runtime monitoring misses it entirely. If your CI/CD pipeline runs dependency installs with broad network egress and full access to secrets, treat that as the highest-leverage fix available this quarter — restrict egress during install steps and audit which scripts actually need to run.

How to Check Your Dependencies

You don't need to track 19 individual KEV additions by hand. The systematic approach:

1. Scan on every dependency change, not just on a schedule. A quarterly report tells you what mattered historically; your own scan tells you what matters in your tree right now.
2. Sort by EPSS, then KEV status, then CVSS — the 3-Signal Triage Method this quarter's data continues to validate: KEV membership is an automatic "patch now," high EPSS is the next tier, and CVSS is the tiebreaker among otherwise-similar findings.
3. Watch your build pipeline, not just your runtime dependencies. Nine incidents this quarter targeted install-time execution — a clean npm audit on your deployed artifact doesn't cover a compromised post-install script that already ran in CI.
4. Re-check anything that scored EPSS 0.3-0.5 last quarter. CVE-2026-91001's nine-day climb from 0.11 to 0.81 shows how fast a "monitor" finding becomes a "patch immediately" finding.

We're moving to a quarterly cadence from here, with the next edition covering Q3 2026 (July-September). If your team wants the underlying per-CVE data for your own dependency tree between reports, scan your project now — every finding is enriched with EPSS and CISA KEV status so you don't have to wait for our next roundup to know where you stand.

Check if your project is affected. Scan your dependencies now