KEV

Known Exploited Vulnerability Catalogs

Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.

GCVE Local

0 entries

UUID: 36161c14-9c7f-4167-bf35-710f406ea15d

Browse

CISA

1629 entries

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

UUID: 405284c2-e461-4670-8979-7fd2c9755a60

Browse Source

CIRCL

17 entries

CIRCL provides a known-exploited vulnerability and supporting the different status_reason described in GCVE BCP-07.

UUID: 1a89b78e-f703-45f3-bb86-59eb712668bd

Browse Source

ENISA

32 entries

ENISA via the CSIRTs network provides list of known-exploited seen in the CSIRTs network.

UUID: cce329bf-df49-4c6e-a027-80be2e6483bd

Browse Source

KEVIntel

2516 entries

Evidence-backed KEV intelligence enriched with confidence scoring, exploitation status, CISA KEV status, and sensor telemetry.

UUID: caeb2787-0d58-4236-9039-7c86c3e566f3

Browse Source

Catalog overlap How much each pair of KEV catalogs shares. Each cell is the number of vulnerabilities present in both catalogs; colour intensity is the Jaccard index (shared ÷ combined). The diagonal shows each catalog's own total.

Hover a cell to compare two catalogs.

Less overlap More

Coverage timeline Cumulative number of vulnerabilities each catalog has listed over time, by each catalog's earliest observation date (first seen, then recorded, falling back to the status update). A steep step marks a bulk import.

Hover a line for a catalog's running total.

Coverage lead time Which catalog tends to list a vulnerability first. Based on each catalog's earliest observation date (first seen, then recorded, falling back to the status update).

1633

Across 1633 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 0 days of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.

Overlapping catalogs list 81% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.

Hover a catalog for its lead-time detail.

Blind spots Vulnerabilities other catalogs flag as exploited but a given catalog does not carry. Click a catalog to list its gaps in the coverage table below; the corroborated figure counts those confirmed by two or more other catalogs — the stronger signal worth investigating.

GCVE 2520 missing · 1633 corroborated CIRCL 2503 missing · 1617 corroborated ENISA 2488 missing · 1604 corroborated CISA 891 missing · 4 corroborated KEVIntel 4 missing

Catalog combinations An UpSet view of catalog membership: each bar counts the vulnerabilities present in exactly the catalogs marked below it. The left bars show each catalog's own total — a catalog's columns are disjoint slices that add up to that total. Click a column to filter the coverage table below to that combination.

2520

Hover a column to see which catalogs share that group of vulnerabilities.

Catalog coverage All vulnerabilities across all catalogs, newest first listed at the top, showing in which KEV catalogs each vulnerability appears.

First listed Last updated

2520

Vulnerability ID	First Listed	GCVE	CISA	CIRCL	ENISA	KEVIntel
CVE-2024-43093 Google - Android	2024-11-07
CVE-2024-5910 Palo Alto Networks - Expedition , paloaltonetworks - expedition	2024-11-07
CVE-2019-16278 nazgul - nostromo_nhttpd	2024-11-07
CVE-2024-51567 cyberpanel - cyberpanel	2024-11-07
CVE-2024-8957 PTZOptics - PT30X-SDI , PTZOptics - PT30X-NDI +2 more	2024-11-04
CVE-2024-8956 PTZOptics - PT30X-SDI , PTZOptics - PT30X-NDI +2 more	2024-11-04
CVE-2024-20481 Cisco - Cisco Adaptive Security Appliance (ASA) Software , Cisco - Cisco Firepower Threat Defense Software +2 more	2024-10-24
CVE-2024-37383 roundcube - webmail	2024-10-24
CVE-2024-47575 Fortinet - FortiManager	2024-10-23
CVE-2024-38094 Microsoft - Microsoft SharePoint Enterprise Server 2016 , Microsoft - Microsoft SharePoint Server 2019 +1 more	2024-10-22
CVE-2024-9537 ScienceLogic - SL1 , sciencelogic - sl1	2024-10-21
CVE-2024-40711 Veeam - Backup and Recovery , veeam - backup_\&_replication	2024-10-17
CVE-2024-30088 Microsoft - Windows 10 Version 1809 , Microsoft - Windows Server 2019 +13 more	2024-10-15
CVE-2024-28987 SolarWinds - Web Help Desk , solarwinds - webhelpdesk	2024-10-15
CVE-2024-9680 Mozilla - Firefox , Mozilla - Firefox ESR +4 more	2024-10-15
CVE-2024-23113 Fortinet - FortiSwitchManager , Fortinet - FortiOS +6 more	2024-10-09
CVE-2024-9379 Ivanti - CSA (Cloud Services Appliance) , ivanti - endpoint_manager_cloud_services_appliance	2024-10-09
CVE-2024-9380 Ivanti - CSA (Cloud Services Appliance) , ivanti - endpoint_manager_cloud_services_appliance	2024-10-09
CVE-2024-43572 Microsoft - Windows 10 Version 1507 , Microsoft - Windows 10 Version 1607 +23 more	2024-10-08
CVE-2024-43047 Qualcomm, Inc. - Snapdragon , qualcomm - fastconnect_6700_firmware +63 more	2024-10-08

displaying 1161 - 1180 vulnerabilities in total 2520