EU Cyber Resilience Act · Regulation (EU) 2024/2847

Manufacturers of products with digital elements shall “identify and document vulnerabilities and components contained in products … including by drawing up a software bill of materials” and “address and remediate vulnerabilities without delay”. Annex I, Part II

Article 14 reporting duties have been in effect since 11 September 2026: actively exploited vulnerabilities must be notified within 24 hours.

419,051 published vulnerabilities
1,767 known to be actively exploitedCISA KEV catalogue

Latest CVE added to the CISA KEV catalogue · 3 November 2026

CVE-2026-119977 CVSS v3.1 8.1 · High

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the…

As of 4 November 2026, from Lucerna's live CVE index.

Do these apply to your products?

Upload an SBOM. Lucerna matches every component against the full CVE index, tells you which vulnerabilities actually affect your build, and tracks what you must fix and report.

Smart products may live for years, but vulnerabilities never stop.

Vulnerability Management System

Forgot password?

New to Lucerna?

Start a free trial

enquiries@rufilla.com rufilla.com