DEV Community: CyberMax

Which CVEs to patch first this week (KEV + EPSS, 27 Sep 2026)

CyberMax — Sun, 11 Oct 2026 14:50:22 +0000

There are more than 380,000 CVEs with an EPSS score and no team patches them all. The two free signals that cut the list down fastest are CISA's Known Exploited Vulnerabilities (KEV) catalog (confirmed exploitation in the wild) and FIRST's EPSS (the probability of exploitation activity in the next 30 days). This week's list, and a repeatable way to build it.

This week: 17 new exploited CVEs, 3-day deadlines

Between 14 and 25 September 2026 CISA added 17 CVEs to KEV (catalog version 2026.09.25, 1,726 CVEs in total). All 17 carry a federal due date three days after they were added (the latest due date is 28 September). Sorted by EPSS:

CVE	Vendor / product	Added	Federal due	EPSS
CVE-2026-71362	Adobe Commerce and Magento	24 Sep	27 Sep	87.5%
CVE-2026-76461	Cisco Secure Email Gateway	14 Sep	17 Sep	28.3%
CVE-2026-93616	Check Point (multiple products)	22 Sep	25 Sep	19.7%
CVE-2026-87902	WordPress Core (remote file inclusion)	25 Sep	28 Sep	18.2%
CVE-2026-76460	Cisco Identity Services Engine	16 Sep	19 Sep	14.0%
CVE-2025-39682	Linux Kernel	18 Sep	21 Sep	2.9%
CVE-2026-7273	Zyxel GS1900 switches	21 Sep	24 Sep	2.5%
CVE-2026-94127	F5 BIG-IP APM	22 Sep	25 Sep	2.2%
CVE-2026-65660	Microsoft SharePoint	25 Sep	28 Sep	2.1%
CVE-2026-67279	MikroTik RouterOS	25 Sep	28 Sep	1.0%

The other seven (Arista VeloCloud Orchestrator, a second Check Point CVE, two more Linux kernel CVEs, WSO2, Acronis Backup and Google Pixel) score under 1.1%. They are still exploited; EPSS only tells you where mass exploitation is most likely.

EPSS of the CVEs CISA added 14–25 Sep 2026


Adobe Commerce	87.5%
Cisco Email Gateway	28.3%
Check Point	19.7%
WordPress Core	18.2%
Cisco ISE	14.0%
Linux Kernel	2.9%
Zyxel GS1900	2.5%
F5 BIG-IP APM	2.2%

FIRST EPSS scores dated 27 Sep 2026: the estimated chance of exploitation activity in the next 30 days. Top 8 of the 17 additions.

The order to patch in

In KEV and internet-facing: Adobe Commerce/Magento, WordPress core, Cisco Secure Email Gateway, Check Point gateways, F5 BIG-IP APM, SharePoint. Exploitation is confirmed and the systems are reachable by anyone.
In KEV, inside the network: Cisco ISE, the Linux kernel CVEs, Zyxel switches, MikroTik routers, Acronis Backup.
Not in KEV but EPSS above 10%: the early-warning list. 17,267 CVEs have an EPSS of 10% or more today, and only 1,274 of them are in KEV. Run your scanner output through both signals and the gap is where the next KEV entries usually come from.
Everything else by CVSS and exposure, on your normal patch cycle.

Try it: CVEs added to KEV in the last 14 days (free, no key):

curl 'https://kevscope-api.cybermaxtools.com/api/kev/recent?days=14'

Why KEV plus EPSS beats CVSS alone

CVSS rates how bad a flaw could be. It does not say whether anyone is using it. Of the 1,726 KEV entries, 361 are known to be used in ransomware campaigns. Vendor pages show how concentrated the risk is: Microsoft has 389 CVEs in KEV, Cisco 99, Apple 94 and Ivanti 35. See every vendor.

Automate it: one call per 20 CVEs

Paste your scanner's CVE list into Kevscope and every CVE comes back with a verdict (act_now, high, medium, low) and the evidence behind it: KEV status, due date and ransomware use, EPSS score and percentile, CVSS and CISA's SSVC decision points. The rules are public: act_now means it is in KEV or SSVC says exploitation is active; high means EPSS of 10% or more, or an automatable CVSS 9+ flaw with a public exploit.

curl "https://kevscope-api.cybermaxtools.com/api/priority?cve=CVE-2026-71362,CVE-2026-65660"

The same key works as a remote MCP server, so an AI agent can triage a scan for you.

Kevscope: CVE priority API: up to 20 CVEs per call, each with a verdict and the KEV, EPSS, CVSS and SSVC evidence.

Free: 200 calls a day, no key and no card. Paid keys from $19/month (10,000 calls), or $5 pay as you go (2,000, no expiry).

See Kevscope plans and pricing

Published prices on 27 September 2026: OpenCVE Starter is €19/month and Pro €49/month; Vulners Basic is $600/month. Kevscope is free for 200 calls a day, then $19/month for 10,000 calls. Prefer a report to an API? The Exploited Vulnerabilities Brief lands every Monday.

Sources: CISA KEV catalog, FIRST EPSS scores dated 27 Sep 2026, NIST NVD.

Published automatically by CyberMax. Every number above comes from the linked public data; nothing is estimated.

How to check any US tariff rate by HTS code (2026)

CyberMax — Sat, 10 Oct 2026 23:00:28 +0000

The US duty on an imported product is set by its 10-digit HTS code (Harmonized Tariff Schedule of the United States). For products of China, a second layer applies on top: the Section 301 tariffs, which add 7.5% or 25% to most codes. This guide shows how to get both numbers for any code, from the official source, in under a minute.

The short answer

Find the code: search the HTS by product words (for example "coffee maker").
Read the General rate column for that 8-digit line. That is the normal (MFN) duty.
Check Chapter 99 U.S. note 20 to see if the code is on a Section 301 list. If it is, products of China pay the list's extra duty as well.

Doing step 3 by hand is the slow part: note 20 is a long list of codes spread over several lists, exclusions and later increases. The rest of this guide does all three steps with real data.

Step 1: find the HTS code

Search the product words. A search for coffee maker in the current schedule (2026 Revision 19, in effect from 15 September 2026) returns heading 8516, subheading 8516.71.00 "Coffee or tea makers", with statistical suffixes such as 8516.71.00.20 "Automatic drip and pump type".

Try it: look up 8516.71.00 (free, no key):

curl 'https://dutyfinch.cybermaxtools.com/api/hts?code=8516.71.00'

Step 2: read the general duty rate

For 8516.71.00 the official rates are:

Column	Rate	Who pays it
General (MFN)	3.7%	most countries, including China
Special	Free	free-trade partners (AU, CL, CO, KR, SG and others listed on the line)
Column 2	40%	the few countries without normal trade relations

Across the whole schedule, 38% of the 11,414 rated tariff lines are duty-free at the general rate, and only 107 lines are above 25%:

US tariff lines by general (MFN) duty rate


Free	4,315
0-5%	2,678
5-10%	2,268
10-25%	810
over 25%	107
specific or compound	1,236

11,414 tariff lines with a rate in the USITC HTS 2026 Revision 19. Specific or compound = a rate per unit (e.g. ¢/kg).

Step 3: check Section 301 for products of China

8516.71.00 is on List 4A (heading 9903.88.15), so a coffee maker made in China pays 3.7% + 7.5% = 11.2% of its customs value. The same coffee maker made in Vietnam pays 3.7%.

Section 301 is not a niche issue: 10,003 of the 11,414 rated lines (88%) are on a list that is in effect today. The lists differ a lot in size:

HTS codes on each Section 301 China list


List 1 (+25%)	856
List 2 (+25%)	283
List 3 (+25%)	5,906
List 4A (+7.5%)	2,958
4B (+15%, suspended)	546

Codes named in HTS Chapter 99, U.S. note 20. List 4B has been suspended since December 2019, so it is not collected.

Some codes also have product exclusions (currently running to 9 November 2026) or a 2024 four-year-review increase with its own start date, such as electric vehicles (+100%) and semiconductors (+50%). Always read the exclusion text: it often covers only one described product inside a code.

Other duties can apply too: Section 232 (steel, aluminium and others), antidumping and countervailing duties, and other Chapter 99 measures. Confirm any classification with CBP or a licensed customs broker before you import.

The 2026 US–China tariff cuts

On 26 September 2026 the US and Chinese governments announced plans to lower tariffs on about $30 billion of "non-sensitive" goods in each direction; press reports name small appliances, toys and decorations. As of 27 September the HTS code lists and effective dates are not published. When USTR publishes them in the Federal Register, every affected code changes at once, which is exactly when a manual spreadsheet goes stale.

Do it by API (and get told when a rate changes)

If you check more than a handful of codes, or you quote landed costs to customers, the lookups belong in code. Dutyfinch answers GET /api/hts?code=8516.71.00 with the description path, the three rate columns, the Section 301 list, exclusions with end dates and a flag for the 2026 US–China reduction list. Keyword search covers all 26,246 HTS codes, and the same key works as a remote MCP server for AI agents.

curl "https://dutyfinch.cybermaxtools.com/api/hts?code=8516.71.00"

Dutyfinch: US tariff lookup API and MCP server: official duty rates, Section 301 China status and the 2026 US–China reduction flag.

Free: 50 calls a day, no key and no card. Paid keys from $19/month (2,500 calls), or $5 pay as you go (500, no expiry).

See Dutyfinch plans and pricing

How it compares

Published prices on 27 September 2026: US Tariff Rates Pro is $49/month for 5,000 requests, Global Tariff Rates Pro is $49/month, and Dutify Plus is $75/month for 500 tariff lookups. Dutyfinch has 50 free calls a day with no key, Importer at $19/month for 2,500 calls, Broker at $49/month for 7,500 calls plus webhook alerts on 100 watched codes. See the full comparisons and every chapter's rates on the tariff pages, for example chapter 85 (electrical machinery).

Sources: USITC Harmonized Tariff Schedule 2026 Revision 19 and HTS Chapter 99 U.S. notes 20 and 31; Federal Register (USTR notices, checked daily).

Published automatically by CyberMax. Every number above comes from the linked public data; nothing is estimated.