GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
KEV

Known Exploited Vulnerability Catalogs

Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.

GCVE Local
0 entries · 0 subscribers

UUID: 36161c14-9c7f-4167-bf35-710f406ea15d
Browse
CISA
1709 entries · 0 subscribers · CC0-1.0

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

UUID: 405284c2-e461-4670-8979-7fd2c9755a60
Browse Source
CIRCL
19 entries · 0 subscribers · CC0-1.0

CIRCL provides a known-exploited vulnerability catalog and supports the different status reasons described in GCVE BCP-07.

UUID: 1a89b78e-f703-45f3-bb86-59eb712668bd
Browse Source
ENISA
50 entries · 0 subscribers

ENISA, via the CSIRTs network, provides a list of known-exploited vulnerabilities observed across the CSIRTs network.

UUID: cce329bf-df49-4c6e-a027-80be2e6483bd
Browse Source
Shadowserver
1307 entries · 0 subscribers

Vulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.

UUID: c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8
Browse Source
Previdian
2728 entries · 0 subscribers

Evidence-backed KEV intelligence enriched with confidence scoring, exploitation status, CISA KEV status, and sensor telemetry.

UUID: caeb2787-0d58-4236-9039-7c86c3e566f3
Browse Source
Catalog overlap How much each pair of KEV catalogs shares. Each cell is the number of vulnerabilities present in both catalogs; colour intensity is the Jaccard index (shared ÷ combined). The diagonal shows each catalog's own total.

Hover a cell to compare two catalogs.

Less overlap More
Coverage timeline Cumulative number of vulnerabilities each catalog has listed over time, by each catalog's earliest observation date (first seen, then recorded, falling back to the status update). A steep step marks a bulk import.

Hover a line for a catalog's running total.

Coverage lead time Which catalog tends to list a vulnerability first. Based on each catalog's earliest observation date (first seen, then recorded, falling back to the status update).
2368

Across 2368 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 1 day of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.

Overlapping catalogs list 49% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.

Hover a catalog for its lead-time detail.

Evidence behind the listings What each catalog's assertions rest on: first-hand observation (honeypot, sinkhole, telemetry, incident response) or reports relayed from a vendor, a CSIRT, the public or researchers. A vulnerability listed by both kinds of catalog is corroborated by two independent kinds of evidence — something no single catalog can tell. Click a corroboration bucket to list its vulnerabilities in the coverage table below.
3059

Across 3059 vulnerabilities and 5801 evidence records, 32% are backed by both first-hand observation and reports, 11% by observation alone and 57% by reports alone.

Evidence mix per catalog

Hover a catalog for the evidence behind its entries.

Show as a table
Catalog Entries With evidence Evidence type Records Share Avg confidence
CISA 1709 1709 Vendor report (reports) 1709 100.0% 0.8
CIRCL 19 7 Sinkhole (first-hand observation) 5 71.4% 1.0
Incident response (first-hand observation) 1 14.3%
Public report (reports) 1 14.3%
ENISA 50 50 CSIRT report (reports) 50 100.0% 0.75
Shadowserver 1307 1307 Honeypot (first-hand observation) 1307 100.0% 0.7
Previdian 2728 2728 Public report (reports) 2728 100.0% 0.7

Strongest signal per vulnerability

The firmest claim any catalog makes about each vulnerability, from a confirmed compromise down to an exploit merely being available.

Confirmed compromise 332 · 11%
Successful exploitation 2402 · 79%
In-the-wild attempts 325 · 11%
Mass scanning 0 · 0%
Weaponized exploit 0 · 0%
No signal recorded 0 · 0%

Independent corroboration

Whether a vulnerability's evidence, across every catalog listing it, comes from first-hand observation, from reports, or from both.

Observed and reported 986 · 32% Observed only 325 · 11% Reported only 1748 · 57% No typed evidence 0 · 0%
The vulnerabilities behind the listings What the CVE records say about what each catalog lists: how old a vulnerability is when the catalog picks it up, how quickly the catalogs as a whole react to newly published CVEs, and how their listings compare with today's EPSS scores. Click a highlighted count to list those vulnerabilities in the coverage table below.
3059

Of 3059 vulnerabilities, 3003 have a CVE publication date on record. 109 of them were listed by some catalog before the CVE was published — exploited as zero-days, or disclosed through the catalog itself — and 187 are listed although EPSS currently scores them below 0.01.

Age at listing

Days between the CVE's publication and the catalog's listing: the box spans the middle half of a catalog's entries, the tick is its median. Entries listed before publication sit at zero and are counted apart.

Hover a catalog for its detail.

Time to first listing, by CVE publication year

Median days from a CVE's publication to its first listing in any catalog. Only CVEs published from 2021-11-03 on, when the earliest catalog started listing: older CVEs were listed when the catalogs were founded, not when their exploitation began.

EPSS today

Where each catalog's entries fall on the current EPSS scale, and the share of them with a critical CVSS base score.

Hover a catalog for its detail.

Show as a table
Catalog Entries Dated p25 Median p75 Before publication EPSS below 0.01 EPSS 0.01 to 0.1 EPSS 0.1 to 0.5 EPSS 0.5 and above No EPSS CVSS ≥ 9
CISA 1709 1709 9 d 252 d 1387 d 60 51 (3%) 364 (21%) 414 (24%) 880 (51%) 0 35% of 1709
CIRCL 19 19 2 d 10 d 437 d 1 0 (0%) 2 (11%) 3 (17%) 13 (72%) 1 72% of 18
ENISA 50 50 15 d 117 d 496 d 2 4 (8%) 4 (8%) 11 (22%) 31 (62%) 0 65% of 48
Shadowserver 1307 1252 105 d 532 d 1184 d 15 55 (4%) 279 (22%) 302 (24%) 615 (49%) 56 55% of 853
Previdian 2728 2727 26 d 342 d 1343 d 87 164 (6%) 676 (25%) 689 (25%) 1197 (44%) 2 39% of 2316

Computed at 2026-09-14T19:47:49+00:00, refreshed hourly.

Blind spots Vulnerabilities other catalogs flag as exploited but a given catalog does not carry. Click a catalog to list its gaps in the coverage table below; the corroborated figure counts those confirmed by two or more other catalogs — the stronger signal worth investigating.
GCVE 3059 missing · 2368 corroborated CIRCL 3040 missing · 2350 corroborated ENISA 3009 missing · 2323 corroborated Shadowserver 1752 missing · 1385 corroborated CISA 1350 missing · 659 corroborated Previdian 331 missing · 1 corroborated
Catalog combinations An UpSet view of catalog membership: each bar counts the vulnerabilities present in exactly the catalogs marked below it. The left bars show each catalog's own total — a catalog's columns are disjoint slices that add up to that total. Click a column to filter the coverage table below to that combination.
3059

Hover a column to see which catalogs share that group of vulnerabilities.

displaying 161 - 180 vulnerabilities in total 325