KEV

Known Exploited Vulnerability Catalogs

Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.

GCVE Local

0 entries

UUID: 36161c14-9c7f-4167-bf35-710f406ea15d

Browse

CISA

1631 entries

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

UUID: 405284c2-e461-4670-8979-7fd2c9755a60

Browse Source

CIRCL

17 entries

CIRCL provides a known-exploited vulnerability catalog and supports the different status reasons described in GCVE BCP-07.

UUID: 1a89b78e-f703-45f3-bb86-59eb712668bd

Browse Source

ENISA

32 entries

ENISA, via the CSIRTs network, provides a list of known-exploited vulnerabilities observed across the CSIRTs network.

UUID: cce329bf-df49-4c6e-a027-80be2e6483bd

Browse Source

Shadowserver

1231 entries

Vulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.

UUID: c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8

Browse Source

KEVIntel

2521 entries

Evidence-backed KEV intelligence enriched with confidence scoring, exploitation status, CISA KEV status, and sensor telemetry.

UUID: caeb2787-0d58-4236-9039-7c86c3e566f3

Browse Source

Catalog overlap How much each pair of KEV catalogs shares. Each cell is the number of vulnerabilities present in both catalogs; colour intensity is the Jaccard index (shared ÷ combined). The diagonal shows each catalog's own total.

Hover a cell to compare two catalogs.

Less overlap More

Coverage timeline Cumulative number of vulnerabilities each catalog has listed over time, by each catalog's earliest observation date (first seen, then recorded, falling back to the status update). A steep step marks a bulk import.

Hover a line for a catalog's running total.

Coverage lead time Which catalog tends to list a vulnerability first. Based on each catalog's earliest observation date (first seen, then recorded, falling back to the status update).

2224

Across 2224 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 2 days of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.

Overlapping catalogs list 49% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.

Hover a catalog for its lead-time detail.

Blind spots Vulnerabilities other catalogs flag as exploited but a given catalog does not carry. Click a catalog to list its gaps in the coverage table below; the corroborated figure counts those confirmed by two or more other catalogs — the stronger signal worth investigating.

GCVE 2852 missing · 2224 corroborated CIRCL 2835 missing · 2208 corroborated ENISA 2820 missing · 2194 corroborated Shadowserver 1621 missing · 1320 corroborated CISA 1221 missing · 593 corroborated KEVIntel 331 missing · 1 corroborated

Catalog combinations An UpSet view of catalog membership: each bar counts the vulnerabilities present in exactly the catalogs marked below it. The left bars show each catalog's own total — a catalog's columns are disjoint slices that add up to that total. Click a column to filter the coverage table below to that combination.

2852

Hover a column to see which catalogs share that group of vulnerabilities.

Catalog coverage Vulnerabilities other catalogs flag as exploited but GCVE does not carry — its blind spots, newest first listed at the top.

First listed Last updated

Missing from GCVE 2852

Vulnerability ID	First Listed	GCVE	CISA	CIRCL	ENISA	Shadowserver	KEVIntel
CVE-2020-27950 Apple - watchOS , Apple - iOS and iPadOS +1 more	2021-11-03
CVE-2021-28310 Microsoft - Windows 10 Version 1803 , Microsoft - Windows 10 Version 1809 +8 more	2021-11-03
CVE-2021-20021 SonicWall - Email Security	2021-11-03
CVE-2016-3718	2021-11-03
CVE-2019-4716 IBM - Planning Analytics	2021-11-03
CVE-2020-6418 Google - Chrome	2021-11-03
CVE-2019-11634	2021-11-03
CVE-2021-27059 Microsoft - Microsoft Office 2016 , Microsoft - Microsoft Office 2010 Service Pack 2 +1 more	2021-11-03
CVE-2021-1905 Qualcomm, Inc. - Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	2021-11-03
CVE-2019-0859 Microsoft - Windows , Microsoft - Windows Server	2021-11-03
CVE-2020-3580 Cisco - Cisco Adaptive Security Appliance (ASA) Software	2021-11-03
CVE-2021-36742 Trend Micro - Trend Micro Apex One , Trend Micro - Trend Micro OfficeScan +1 more	2021-11-03
CVE-2021-30713 Apple - macOS	2021-11-03
CVE-2020-17144 Microsoft - Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 31	2021-11-03
CVE-2020-8599 Trend Micro - Trend Micro OfficeScan, Trend Micro Apex One	2021-11-03
CVE-2020-17087 Microsoft - Windows 10 Version 1803 , Microsoft - Windows 10 Version 1809 +28 more	2021-11-03
CVE-2020-1472 Microsoft - Windows Server version 2004 , Microsoft - Windows Server 2019 +12 more	2021-11-03
CVE-2020-8515	2021-11-03
CVE-2019-5591 Fortinet - Fortinet FortiOS	2021-11-03
CVE-2019-0863 Microsoft - Windows , Microsoft - Windows Server +4 more	2021-11-03

displaying 2581 - 2600 vulnerabilities in total 2852