Known Exploited Vulnerability Catalogs
Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
UUID:405284c2-e461-4670-8979-7fd2c9755a60
Shadowserver
1307 entries · 0 subscribersVulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.
UUID:c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8
Hover a cell to compare two catalogs.
Hover a line for a catalog's running total.
Across 2368 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 1 day of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.
Overlapping catalogs list 49% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.
Hover a catalog for its lead-time detail.
Across 3059 vulnerabilities and 5801 evidence records, 32% are backed by both first-hand observation and reports, 11% by observation alone and 57% by reports alone.
Evidence mix per catalog
Hover a catalog for the evidence behind its entries.
Show as a table
| Catalog | Entries | With evidence | Evidence type | Records | Share | Avg confidence |
|---|---|---|---|---|---|---|
| CISA | 1709 | 1709 | Vendor report (reports) | 1709 | 100.0% | 0.8 |
| CIRCL | 19 | 7 | Sinkhole (first-hand observation) | 5 | 71.4% | 1.0 |
| Incident response (first-hand observation) | 1 | 14.3% | ||||
| Public report (reports) | 1 | 14.3% | ||||
| ENISA | 50 | 50 | CSIRT report (reports) | 50 | 100.0% | 0.75 |
| Shadowserver | 1307 | 1307 | Honeypot (first-hand observation) | 1307 | 100.0% | 0.7 |
| Previdian | 2728 | 2728 | Public report (reports) | 2728 | 100.0% | 0.7 |
Strongest signal per vulnerability
The firmest claim any catalog makes about each vulnerability, from a confirmed compromise down to an exploit merely being available.
Independent corroboration
Whether a vulnerability's evidence, across every catalog listing it, comes from first-hand observation, from reports, or from both.
Of 3059 vulnerabilities, 3003 have a CVE publication date on record. 109 of them were listed by some catalog before the CVE was published — exploited as zero-days, or disclosed through the catalog itself — and 187 are listed although EPSS currently scores them below 0.01.
Age at listing
Days between the CVE's publication and the catalog's listing: the box spans the middle half of a catalog's entries, the tick is its median. Entries listed before publication sit at zero and are counted apart.
Hover a catalog for its detail.
Time to first listing, by CVE publication year
Median days from a CVE's publication to its first listing in any catalog. Only CVEs published from 2021-11-03 on, when the earliest catalog started listing: older CVEs were listed when the catalogs were founded, not when their exploitation began.
EPSS today
Where each catalog's entries fall on the current EPSS scale, and the share of them with a critical CVSS base score.
Hover a catalog for its detail.
Show as a table
| Catalog | Entries | Dated | p25 | Median | p75 | Before publication | EPSS below 0.01 | EPSS 0.01 to 0.1 | EPSS 0.1 to 0.5 | EPSS 0.5 and above | No EPSS | CVSS ≥ 9 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CISA | 1709 | 1709 | 9 d | 252 d | 1387 d | 60 | 51 (3%) | 364 (21%) | 414 (24%) | 880 (51%) | 0 | 35% of 1709 |
| CIRCL | 19 | 19 | 2 d | 10 d | 437 d | 1 | 0 (0%) | 2 (11%) | 3 (17%) | 13 (72%) | 1 | 72% of 18 |
| ENISA | 50 | 50 | 15 d | 117 d | 496 d | 2 | 4 (8%) | 4 (8%) | 11 (22%) | 31 (62%) | 0 | 65% of 48 |
| Shadowserver | 1307 | 1252 | 105 d | 532 d | 1184 d | 15 | 55 (4%) | 279 (22%) | 302 (24%) | 615 (49%) | 56 | 55% of 853 |
| Previdian | 2728 | 2727 | 26 d | 342 d | 1343 d | 87 | 164 (6%) | 676 (25%) | 689 (25%) | 1197 (44%) | 2 | 39% of 2316 |
Computed at 2026-09-14T18:46:36+00:00, refreshed hourly.
Events marked: 2026-09-11 CRA reporting obligation (Art. 14) applies
Hover a week in any panel for its figures.
New listings per week
Entries by listing date, stacked by catalog; a bulk import is clipped and marked.Listed before CVE publication
Listings that precede the CVE's publication, among those with a publication date.Days from publication to first listing
Median for the vulnerabilities first listed that week; bars above a year are clipped and marked.Evidence behind the week's listings
Evidence records by type, as a share of the week's records.First to list
Among the week's first listings later carried by several catalogs, which catalog listed first (ties count for each).The last week is the current one and still filling up. Recent weeks understate late listings by construction: a vulnerability listed next month is not in the data yet.
Hover a column to see which catalogs share that group of vulnerabilities.