Threadlinqs IntelligenceStart free

Vendor1 product tracked

BerriAI vulnerabilities & exploitation

2 in CISA KEV7 with public exploit

As of 2026-11-06, Threadlinqs tracks 8 BerriAI CVEs, 2 in the CISA Known Exploited Vulnerabilities catalog, linked to 34 tracked threat campaigns and 8 named threat actors.

CVEs
8Since 2026
CISA KEV
225% of CVEs
Critical
0CVSS v3 9.0+
Avg CVSS
8.2/10Max 8.8
Threats
34Linked campaigns
Actors
8Named in campaigns

Data as of:

Exploitation timeline

Threadlinqs has recorded 8 BerriAI CVEs published between and . The busiest month was 2026-05 (3 new CVEs). 2 of them (25%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 8 of 8 tracked BerriAI CVEs.

Products affected

Threadlinqs normalises CPE and CNA product records across all 8 CVEs; 1 distinct BerriAI product is affected. The most frequently affected:

  • litellm 8 CVEs

Threat activity

34 tracked threat campaigns reference BerriAI products or exploit BerriAI CVEs; the 25 most recent are listed.

Threat actors targeting BerriAI

Named threat actors attributed to campaigns that involve BerriAI products or CVEs, with the number of linked campaigns:

How to prioritise BerriAI patching

This order follows the data Threadlinqs holds for BerriAI, not a generic severity checklist:

  • 2 of 8 BerriAI CVEs (25%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2026-42271, CVE-2026-59822.
  • Outside KEV, the highest EPSS scores are CVE-2026-35029 (38.6%), CVE-2026-40217 (15.5%), CVE-2026-49468 (3%).
  • 0 CVEs score Critical and 7 High on CVSS v3 (maximum 8.8, average 8.2); sequence these after KEV and high-EPSS items.
  • 7 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-06 and refresh daily.