Known Exploited Vulnerability Catalogs
Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
UUID:405284c2-e461-4670-8979-7fd2c9755a60
Vulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.
UUID:c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8
Hover a cell to compare two catalogs.
Hover a line for a catalog's running total.
Across 2506 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 26 days of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.
Overlapping catalogs list 44% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.
Hover a catalog for its lead-time detail.
Hover a column to see which catalogs share that group of vulnerabilities.