A snapshot of CISA's Known Exploited Vulnerabilities catalogue, embedded in this page. Nothing is fetched: everything runs in this tab. The host replaces the snapshot in this file every three hours from CISA's public catalogue.
Known exploited
Every flaw in CISA's catalogue of vulnerabilities exploited in the wild, grouped by the vendor whose product it hit. The most exploited vendors ride the inner orbits, and the core holds one dot for every CVE, newest at the top.
Vendors in orbit
The catalogue
Pick a vendor from the list or the orrery to see its products and CVEs.
- A body is a vendor, sized by its entries. The most exploited ride the inner orbits.
- Ember shows the share of a vendor's entries with known ransomware use.
- A ring marks a vendor with an entry added in the 30 days before this snapshot.
- Each dot in the core is one CVE: newest at the top, the 2021 launch batch at the bottom.
- The outer belt is the long tail, one speck per vendor.
The latest entries
What the catalogue is, and what to do with it
What KEV is
CISA, the US Cybersecurity and Infrastructure Security Agency, keeps the Known Exploited Vulnerabilities catalogue: the flaws it has reliable evidence attackers have exploited in the wild. It opened on 3 Nov 2021, and 0 of today's entries date from that first day. This snapshot holds 0, from 0 vendors.
An entry has to clear three bars:
- A CVE ID. The public identifier the rest of the industry uses for the flaw.
- Reliable evidence of exploitation in the wild. Attempted and successful attacks both count. Scanning, security research and a published proof of concept do not.
- A clear action. Usually a vendor update or mitigation, or taking a product past its end of life off the network.
Who has to act, and by when
US federal civilian agencies have to fix listed flaws by deadlines CISA sets. BOD 22-01 created the catalogue and those deadlines in November 2021. On 10 June 2026 BOD 26-04 revoked BOD 22-01 and tied each deadline to four questions: internet exposure, a catalogue listing, whether the exploit can be automated, and how much control it gives. A flaw on exposed assets that is automatable and gives total control gets three days.
For an entry flagged for forensic triage (0 in this snapshot), agencies must also check the affected systems for signs they were already compromised. The newest entries cite BOD 26-04, first cited on . Other organisations aren't bound by these deadlines, but CISA strongly recommends that every organisation prioritise the catalogue.
Days from being added to being due, by the year CISA added the entry. At launch most older CVEs got six months and most 2021 CVEs two weeks. Three weeks was the norm from 2022 to 2025.
How defenders use it
- Patch these first. Attackers have already used every flaw on the list, whatever its CVSS score says. Of the entries here, 0 have known use in ransomware campaigns.
- Exposed systems before internal ones. Internet exposure is one of the factors that shortens a federal deadline to days, and internet-facing systems are the first thing attackers reach.
- Read it with the other signals. CVSS rates how severe a flaw would be, EPSS estimates the chance it's exploited in the next 30 days, and KEV records exploitation that has already happened. Frameworks such as SSVC weigh exploitation status, and CISA calls the catalogue the authoritative record of it.
- Automate the watch. Pull CISA's JSON feed every day, match new entries against your software inventory and alert on a hit. Many vulnerability scanners can flag catalogue entries for you. a cron job and jq count as automation lol.
- Look for intruders as well as holes. A patch closes the flaw but doesn't remove anyone who already got in through it, so check for signs of compromise too.
- Don't read a gap as safe. The catalogue only lists exploitation CISA has reliable evidence of, and "Unknown" ransomware use means unconfirmed. It doesn't mean ruled out.
Where this comes from
- CISA's Known Exploited Vulnerabilities catalogue, read from its JSON feed.
- CISA distributes the KEV database under CC0 1.0. This page is not affiliated with or endorsed by CISA or DHS.
- The snapshot keeps every entry's CVE ID, vendor, product, date added and ransomware and triage flags. The latest 80 are kept in full, with descriptions trimmed.
- Vendors appear as CISA names them.
- Every field was checked when the snapshot was built and again when this page loaded. Text from the catalogue reaches the page as plain text, and a CVE becomes a link to NVD only when it has the CVE-YYYY-NNNN form.
- Nothing is fetched: the page runs from the snapshot in this file, which the host refreshes from CISA every three hours. Links to NVD, MITRE's CWE list, FIRST and CISA open only when you follow them.