KEV

Known Exploited Vulnerability Catalogs

Catalogs of Known Exploited Vulnerabilities (KEV) explorable via this Vulnerability-Lookup instance. All catalogs conform to the GCVE BCP-07 standard.

CISA

1695 entries · 6 subscribers · CC0-1.0

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

UUID: 405284c2-e461-4670-8979-7fd2c9755a60

Browse Source

CIRCL Local

23 entries · 6 subscribers · CC0-1.0

CIRCL provides a known-exploited vulnerability catalog and supports the different status reasons described in GCVE BCP-07.

UUID: 1a89b78e-f703-45f3-bb86-59eb712668bd

Browse Source

ENISA

43 entries · 5 subscribers

ENISA, via the CSIRTs network, provides a list of known-exploited vulnerabilities observed across the CSIRTs network.

UUID: cce329bf-df49-4c6e-a027-80be2e6483bd

Browse Source

Shadowserver

1304 entries · 5 subscribers

Vulnerabilities actively exploited in the wild as observed by The Shadowserver Foundation's global honeypot network (honeypot/exploited-vulnerabilities API), ranked by number of unique IPs per day and enriched with CVSS scores and CISA KEV status.

UUID: c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8

Browse Source

Previdian

2800 entries · 4 subscribers

Evidence-backed KEV intelligence enriched with confidence scoring, exploitation status, CISA KEV status, and sensor telemetry.

UUID: caeb2787-0d58-4236-9039-7c86c3e566f3

Browse Source

Catalog overlap How much each pair of KEV catalogs shares. Each cell is the number of vulnerabilities present in both catalogs; colour intensity is the Jaccard index (shared ÷ combined). The diagonal shows each catalog's own total.

Hover a cell to compare two catalogs.

Less overlap More

Coverage timeline Cumulative number of vulnerabilities each catalog has listed over time, by each catalog's earliest observation date (first seen, then recorded, falling back to the status update). A steep step marks a bulk import.

Hover a line for a catalog's running total.

Coverage lead time Which catalog tends to list a vulnerability first. Based on each catalog's earliest observation date (first seen, then recorded, falling back to the status update).

2597

Across 2597 vulnerabilities listed by more than one catalog, half reach all of their catalogs within 18 days of the first listing. The bars show how often each catalog is the earliest to list a vulnerability it shares.

Overlapping catalogs list 44% of shared vulnerabilities on the same day (often because one catalog mirrors another's listing date), so the per-catalog lead below is typically near zero — it is an average, surfacing the genuine separation in the long tail.

Hover a catalog for its lead-time detail.

Blind spots Vulnerabilities other catalogs flag as exploited but a given catalog does not carry. Click a catalog to list its gaps in the coverage table below; the corroborated figure counts those confirmed by two or more other catalogs — the stronger signal worth investigating.

CIRCL 2863 missing · 2577 corroborated ENISA 2843 missing · 2558 corroborated Shadowserver 1582 missing · 1368 corroborated CISA 1191 missing · 905 corroborated Previdian 86 missing · 1 corroborated

Catalog combinations An UpSet view of catalog membership: each bar counts the vulnerabilities present in exactly the catalogs marked below it. The left bars show each catalog's own total — a catalog's columns are disjoint slices that add up to that total. Click a column to filter the coverage table below to that combination.

2886

Hover a column to see which catalogs share that group of vulnerabilities.

Catalog coverage All vulnerabilities across all catalogs, newest first listed at the top, showing in which KEV catalogs each vulnerability appears.

First listed Last updated

2886

Vulnerability ID	First Listed	CISA	CIRCL	ENISA	Shadowserver	Previdian
CVE-2024-7339 TVT - DVR TD-2104TS-CL , TVT - DVR TD-2108TS-HP +6 more	2024-09-14
CVE-2024-8190 Ivanti - CSA (Cloud Services Appliance) , ivanti - endpoint_manager_cloud_services_appliance	2024-09-13
CVE-2022-22274 SonicWall - SonicOS	2024-09-12
CVE-2024-8522 thimpress - LearnPress – WordPress LMS Plugin for Create and Sell Online Courses , thimpress - learnpress	2024-09-12
CVE-2023-0656 SonicWall - SonicOS	2024-09-12
CVE-2023-6023 vertaai - vertaai/modeldb	2024-09-11
CVE-2024-38014 Microsoft - Windows 10 Version 1507 , Microsoft - Windows 10 Version 1607 +23 more	2024-09-10
CVE-2024-38217 Microsoft - Windows 10 Version 1507 , Microsoft - Windows 10 Version 1607 +23 more	2024-09-10
CVE-2024-38226 Microsoft - Microsoft Office 2019 , Microsoft - Microsoft Office LTSC 2021 +1 more	2024-09-10
CVE-2016-3714 imagemagick - imagemagick , canonical - ubuntu_linux +4 more	2024-09-09
CVE-2017-1000253 centos - centos , redhat - enterprise_linux +1 more	2024-09-09
CVE-2024-40766 SonicWall - SonicOS , sonicwall - sonicos	2024-09-09
CVE-2024-7593 Ivanti - vTM , ivanti - virtual_traffic_manager	2024-09-06
CVE-2024-45506 haproxy - haproxy	2024-09-04
CVE-2024-6893 Journyx - Journyx (jtime) , journyx - journyx	2024-09-04
CVE-2021-20123 draytek - vigorconnect	2024-09-03
CVE-2024-7262 Kingsoft - WPS Office , kingsoft - wps_office	2024-09-03
CVE-2021-20124 draytek - vigorconnect	2024-09-03
CVE-2024-7029 AVTech - AVM1203 (IP Camera) , avtec - avm1203\/ipcamera\/	2024-09-01
CVE-2024-7928 fastadmin - fastadmin	2024-08-29

displaying 921 - 940 vulnerabilities in total 2886