CVEs exploited in the last N days

Attested exploitation only (confirmed: CISA KEV, CISA-ADP SSVC active or two independent sources; reported: one source), first seen, last seen or added to KEV inside the window; Rejected CVEs excluded. CVEs first attested inside the window come before those only seen again in it; in each group confirmed first, then the most recent evidence. iocCount24h / iocCount7d are null when the CVE→IOC index is missing (unknown, never 0); kevLeadDays only when an independent source attested exploitation before CISA KEV listed it. titleSource names OpenCVE or MSRC when the line's title is theirs, and attribution carries MITRE's CVE designation and licence, the NVD notice, and the clause of every restricted source a line draws on (also the header Link: <https://api.ismalicious.com/cve/attribution>; rel="license"). Costs one request with an API key.