EU Cyber Resilience Act · Regulation (EU) 2024/2847
Manufacturers of products with digital elements shall “identify and document vulnerabilities and components contained in products … including by drawing up a software bill of materials” and “address and remediate vulnerabilities without delay”.
Annex I, Part II
Article 14 reporting duties have been in effect since 11 September 2026: actively exploited vulnerabilities must be notified within 24 hours.
417,743
published vulnerabilities
1,766
known to be actively exploitedCISA KEV catalogue
Latest CVE added to the CISA KEV catalogue · 30 October 2026
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
As of 1 November 2026, from Lucerna's live CVE index.
Do these apply to your products?
Upload an SBOM. Lucerna matches every component against the full CVE index, tells you which vulnerabilities actually affect your build, and tracks what you must fix and report.
Smart products may live for years, but vulnerabilities never stop.
