SonicWall, JFrog and Langflow were all reported exploited. None of the three CVEs is in KEV.

Three vulnerabilities were reported as exploited in the wild over the past two days. SonicWall SMA1000, JFrog Artifactory and Langflow. Each claim rests on a single organisation's telemetry, and not one of the three identifiers is in the CISA Known Exploited Vulnerabilities catalogue.

The two identifiers that are in KEV belong to PaperCut, carried the dullest headlines of the week, and have a remediation deadline of 14 September.

Every status below was read on 2 September 2026 from the KEV JSON feed, catalogVersion 2026.09.01, and from the NVD API, one identifier at a time. None of it comes from the coverage.

What led the feeds, and what has a deadline

The three that led, and what is holding each one up

SonicWall SMA1000. The advisory covers CVE-2026-83548, a pre-authentication server-side request forgery in the WorkPlace interface, and CVE-2026-83549, a post-authentication command injection in the management console. SonicWall's wording on exploitation is careful and worth quoting exactly: the company says it "has investigated a case indicating the active exploitation of the vulnerabilities described in this advisory". One case, and "indicating" rather than confirming.

That is not what the coverage did with it. Infosecurity ran "Hackers Chain Two New SonicWall Zero-Day Vulnerabilities". SonicWall's advisory does not mention chaining at all. SecurityWeek wrote that SonicWall "has observed exploitation of both vulnerabilities, which suggests they have been chained", which converts a hedged singular into an observed plural.

In NVD, CVE-2026-83548 sits at status Received with no CVSS score of any kind. The 10.0 that appears everywhere is on SonicWall's own advisory page, and SonicWall did not put any CVSS metrics into the CVE record it authored as the numbering authority. The 7.8 on the second flaw comes from CISA's ADP container, not from SonicWall and not from NVD, and its vector begins AV:L, meaning local access, which sits awkwardly beside a description involving a remote authenticated administrator.

JFrog Artifactory. We covered CVE-2026-82329 yesterday, and the position has not changed: JFrog assigned 9.8 as its own numbering authority, NVD is still Awaiting Analysis and carries only JFrog's score passed through, and the exploitation claim comes from watchTowr's honeypot network. JFrog's own advisory says nothing about exploitation in the wild. SecurityWeek headlined it "Reportedly Exploited", which is honest. The Hacker News headlined it as a statement of fact.

Langflow. CVE-2026-0768 is an unauthenticated remote code execution flaw disclosed through the Zero Day Initiative on 9 January 2026, after the vendor was notified on 18 July 2025. VulnCheck now reports attackers harvesting environment variables for OpenAI and AWS credentials from exposed instances. NVD's status is Analyzed, but it carries only ZDI's 9.8 as a secondary score and assigned no primary of its own, so coverage crediting the severity to "NVD and ZDI" is wrong about half of that.

The detection counts moved from "50 or more canary detections" to "360 observed attacks" inside a day. Both are hits against VulnCheck's own sensor fleet, and the fleet size is never given, so neither number carries a base rate.

The two with a deadline, and a score that is being under-reported

PaperCut's CVE-2026-81578 and CVE-2026-82078 were added to KEV on 31 August with a remediation date of 14 September 2026. Both are Analyzed in NVD, and this is the only pair on the list where NVD has done its own work.

Which produces a specific, checkable error in the reporting. On CVE-2026-81578 the figure being quoted is 8.8. That is PaperCut's own CVSS 4.0 score, recorded in NVD as secondary. NVD's own primary score, assigned by nvd@nist.gov under CVSS 3.1, is 9.8 Critical.

Anyone triaging off the reported number is using both the lower of the two available scores and the one that is not independent. On the companion flaw it runs the other way, PaperCut 9.4 against NVD 9.1, which is the useful control: this is not a vendor systematically underselling, it is two scoring systems producing different answers and only one of them being reported.

Who actually assigned the number

Identifier	NVD status	Score, and who assigned it	In KEV
CVE-2026-83548, SonicWall	Received	No CVSS of any kind in NVD	No
CVE-2026-83549, SonicWall	Received	7.8, CISA ADP container, secondary	No
CVE-2026-82329, JFrog	Awaiting Analysis	9.8, JFrog itself, secondary	No
CVE-2026-0768, Langflow	Analyzed	9.8, ZDI, secondary. No NVD primary	No
CVE-2026-81578, PaperCut	Analyzed	8.8 PaperCut secondary, 9.8 NVD primary	Yes, due 14 Sept
CVE-2026-82078, PaperCut	Analyzed	9.4 PaperCut secondary, 9.1 NVD primary	Yes, due 14 Sept

The trap underneath it

This is the part worth a minute of anyone's time, because the obvious defensive move produces the wrong answer.

A sensible reader sees "JFrog Artifactory flaw exploited", opens the KEV catalogue and searches for JFrog Artifactory. They get a hit: CVE-2026-66384, a path traversal flaw, added on 27 August with a deadline of 10 September. Reasonable conclusion, wrong conclusion. That is a different vulnerability. The one in the headlines, CVE-2026-82329, is not catalogued.

Langflow is worse, because the numbers are adjacent. The exploited identifier is CVE-2026-0768. The one in KEV, added on 21 July, is CVE-2026-0770. Two digits apart. There is a third Langflow entry, CVE-2026-9198, added 4 August under the vendor name IBM.

So on both of today's loud products, searching the authoritative catalogue by product name returns a genuine entry for a genuine exploited vulnerability, and it is not the one you were reading about. A product-level check clears an identifier you never verified.

This is the fourth time in a fortnight

The pattern is not new here and it is getting easier to spot. Yesterday it was JFrog: one firm's honeypots, no write-up, no host count, no second observer, and CISA recording the exploitation status as none about a day earlier. Before that it was UAC-0099, where an entire technique claim rested on three posts on X and nobody had run the test. Before that it was Manchester Airports, where an extortion group's figure of 8.7 million became a number in a headline while the victim's own published statement contained no figure at all.

Four stories, one shape. A single organisation makes a claim, the claim is interesting, and the qualifier that was in the original wording does not survive the second telling.

None of those organisations is doing anything wrong. watchTowr, VulnCheck and SonicWall are all credible, all reporting what they see, and all hedging appropriately in their own words. The loss happens between the source and the headline, and it happens reliably enough to plan around.

What this is not

It is not an argument that the three uncatalogued flaws are safe to ignore, and reading it that way would be a worse mistake than the one it describes.

SonicWall SMA1000 is an internet-facing SSL VPN concentrator with a pre-authentication flaw and a vendor statement about a real case. That deserves your weekend regardless of what any catalogue says. KEV is a record of what CISA has confirmed, and confirmation lags reality by design; absence from KEV is an absence of evidence, not evidence of absence.

The narrower and more useful point: the strength of the evidence behind an exploitation claim varies enormously from story to story, the catalogues record that variation, and the headlines flatten it. If your patching order is set by what you read rather than by what you can verify, the order will be wrong.

The position

A vulnerability programme that consumes headlines will always be a week behind and pointed in the wrong direction, because headline volume tracks novelty and remediation deadlines track confirmation. Those two things are not merely different, today they were inverted.

The fix is unglamorous and takes about ten minutes. Read the KEV JSON feed directly rather than a summary of it, check by identifier, and record the scoring source alongside the score, because for four of the six identifiers here NVD has not independently looked at the number your dashboard is showing you.