Known Exploited Vulnerability Catalogs
Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
UUID:405284c2-e461-4670-8979-7fd2c9755a60
Shadowserver
1313 entries · 5 subscribersVulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.
UUID:c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8
Hover a cell to compare two catalogs.
Hover a line for a catalog's running total.
Across 2625 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 16 days of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.
Overlapping catalogs list 44% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.
Hover a catalog for its lead-time detail.
Across 2935 vulnerabilities and 5934 evidence records, 42% are backed by both first-hand observation and reports, 3% by observation alone and 55% by reports alone.
Evidence mix per catalog
Hover a catalog for the evidence behind its entries.
Show as a table
| Catalog | Entries | With evidence | Evidence type | Records | Share | Avg confidence |
|---|---|---|---|---|---|---|
| CISA | 1709 | 1709 | Vendor report (reports) | 1709 | 100.0% | 0.8 |
| CIRCL | 24 | 9 | Sinkhole (first-hand observation) | 6 | 66.7% | 1.0 |
| Incident response (first-hand observation) | 2 | 22.2% | ||||
| Public report (reports) | 1 | 11.1% | ||||
| ENISA | 50 | 50 | CSIRT report (reports) | 50 | 100.0% | 0.75 |
| Shadowserver | 1313 | 1313 | Honeypot (first-hand observation) | 1313 | 100.0% | 0.7 |
| Previdian | 2853 | 2853 | Public report (reports) | 2853 | 100.0% | 0.7 |
Strongest signal per vulnerability
The firmest claim any catalog makes about each vulnerability, from a confirmed compromise down to an exploit merely being available.
Independent corroboration
Whether a vulnerability's evidence, across every catalog listing it, comes from first-hand observation, from reports, or from both.
Of 2935 vulnerabilities, 2873 have a CVE publication date on record. 102 of them were listed by some catalog before the CVE was published — exploited as zero-days, or disclosed through the catalog itself — and 135 are listed although EPSS currently scores them below 0.01.
Age at listing
Days between the CVE's publication and the catalog's listing: the box spans the middle half of a catalog's entries, the tick is its median. Entries listed before publication sit at zero and are counted apart.
Hover a catalog for its detail.
Time to first listing, by CVE publication year
Median days from a CVE's publication to its first listing in any catalog. Only CVEs published from 2019-06-17 on, when the earliest catalog started listing: older CVEs were listed when the catalogs were founded, not when their exploitation began.
EPSS today
Where each catalog's entries fall on the current EPSS scale, and the share of them with a critical CVSS base score.
Hover a catalog for its detail.
Show as a table
| Catalog | Entries | Dated | p25 | Median | p75 | Before publication | EPSS below 0.01 | EPSS 0.01 to 0.1 | EPSS 0.1 to 0.5 | EPSS 0.5 and above | No EPSS | CVSS ≥ 9 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CISA | 1709 | 1709 | 9 d | 252 d | 1387 d | 60 | 51 (3%) | 366 (21%) | 412 (24%) | 880 (51%) | 0 | 35% of 1709 |
| CIRCL | 24 | 24 | 0 d | 8 d | 356 d | 1 | 0 (0%) | 3 (14%) | 3 (14%) | 15 (71%) | 3 | 74% of 23 |
| ENISA | 50 | 50 | 15 d | 117 d | 496 d | 2 | 4 (8%) | 4 (8%) | 11 (22%) | 31 (62%) | 0 | 65% of 48 |
| Shadowserver | 1313 | 1252 | 105 d | 532 d | 1184 d | 15 | 55 (4%) | 279 (22%) | 302 (24%) | 615 (49%) | 62 | 55% of 853 |
| Previdian | 2853 | 2852 | 5 d | 277 d | 1248 d | 80 | 134 (5%) | 740 (26%) | 746 (26%) | 1231 (43%) | 2 | 38% of 2336 |
Computed at 2026-09-14T03:33:05+00:00, refreshed hourly.
Hover a column to see which catalogs share that group of vulnerabilities.