Skip to content

Exploited vulnerabilitiesBriefConfirmed by two or more outlets

Ghost CMS (CVE-2026-26980)

Mass ClickFix and FakeCaptcha site-poisoning campaigns (XLab).

Disclosed: May 2026
CVE: CVE-2026-26980

What happened

Mass ClickFix and FakeCaptcha site-poisoning campaigns (XLab). Listed in KEV per Recorded Future’s May 2026 CVE landscape report.

Live scores

Live scores

EPSS: 0.711
very likely to be attacked soon
VEDAS: 0.989
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Sources

https://www.recordedfuture.com/blog/may-2026-cve-landscape

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.