Here’s my latest “back of the envelope” drawing, which I drew as a companion for a new NetFoundry series called Reachability Watch.
Published fortnightly, Reachability Watch covers the volume of new network-exploitable CVEs, the handful that clear a CVSS 8.6 bar, whatever KEV actually caused damage that period, and a running tally so the trend line becomes visible over time.
The drawing features this edition’s highlighted KEV. More formally known as CVE-2026-72898, it’s what I call “BYOK: bring Your Own Key,” because that’s essentially what the exploit does. You hand Metabase’s password-reset endpoint an extra user-id key it never asked for, nobody strips it, and it rides all the way into the SQL query.
Read it here:
https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/