AI-agent software vulnerabilities on CISA KEV: quarterly count
Quick answer, Nov 11, 2026The latest edition, Q3 2026, names six CVEs that CISA added to its Known Exploited Vulnerabilities catalog from 7 July to 2 September 2026: three in Langflow and one each in Ray, MLflow and BerriAI LiteLLM. None was marked for known ransomware campaign use when the catalog was read. Quarterly totals for the stack are not published here.
Editions
| Edition | KEV additions dated | Catalog read |
|---|---|---|
| Q3 2026 | 1 July to 30 September 2026 | Version 2026.10.28, 29 October 2026, about 15:00 ET |
Each edition is a dated page, frozen at its catalog read. The Q3 2026 edition names each CVE with its vendor, product and the date CISA added it.
Why there is no quarterly total
These pages do not publish a quarterly count for the AI-agent stack. The full phrase list that defines the stack, lib/records/ai-stack.json, is not publicly readable (HTTP 404, 11 November 2026), so a reader cannot independently reproduce a complete count. The CVEs named in each edition are named from the catalog. They are not presented as the complete count for the stack.
How this count is made
What was reviewed. CISA's Known Exploited Vulnerabilities (KEV) catalog, read as the JSON feed known_exploited_vulnerabilities.json. Each entry is a CVE that CISA has added because of evidence of exploitation.
Date window. For the Q3 2026 edition, KEV additions dated 1 July to 30 September 2026, by the catalog's dateAdded field.
When the catalog was read. For the Q3 2026 edition, 29 October 2026, about 15:00 ET, catalog version 2026.10.28.
How entries are selected. An entry counts when its vendor, product, vulnerability name or short description, after lowercasing and replacing runs of non-alphanumeric characters with spaces, contains a whole-word phrase from the Distributed Risk AI-stack list. The list covers agent frameworks (LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, Langflow, Flowise, n8n, Dify, smolagents), LLM gateways (LiteLLM), MCP servers and clients, model serving (vLLM, Ollama, SGLang, llama.cpp), ML platforms (MLflow, Ray, Jupyter) and AI apps. The full phrase list and its version are in lib/records/ai-stack.json; that file is not publicly readable (HTTP 404, 11 November 2026), so a reader cannot independently reproduce a complete count.
What counts. Each CVE counts once, in the quarter of its dateAdded. A product with several CVEs added in the quarter counts once per CVE.
Limits.
- The filter matches words. A KEV entry used inside an AI pipeline whose catalog text names no AI-stack phrase (for example, a general Python runtime) does not count.
- A word match can also include an entry outside the stack if the phrase appears in another sense; each match should be read before counting (whether this was done: UNKNOWN).
- KEV lists exploited vulnerabilities only. It is not a count of all vulnerabilities in this software; EPSS, from FIRST, is a model estimate for the rest and is not part of the count. See KEV vs EPSS.
The catalog is on CISA's KEV page.
In an AI assistant
Run the same filter in an AI assistant with search_kev on the Distributed Risk MCP server.