Skip to content

CISA KEV: latest known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities (KEV) catalog lists the vulnerabilities attackers are exploiting in the wild. US federal agencies must patch each one by its due date; everyone else uses the list to decide what to patch first.

Loading the catalog…

Get alerted when one hits your stack

Reading this list tells you what is being exploited, not whether you run it. Pharon keeps an inventory of your packages, container images, runtimes and cloud services, and alerts the team that owns one within minutes when it is affected, with the version and where it runs. Start a free trial or read the docs.

Questions

What is the CISA KEV catalog?
A list kept by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with evidence of active exploitation. Each entry names the CVE, the vendor and product, the date it was added, the action to take and a due date.
How is KEV different from CVE, CVSS and EPSS?
A CVE is an identifier for any publicly known vulnerability. CVSS rates how severe it could be, and EPSS estimates how likely it is to be exploited. KEV is the short list CISA has evidence is being exploited now, which makes it the usual place to start patching.
How often is the KEV catalog updated?
Whenever CISA confirms exploitation, often several times a week and usually a few entries at a time. Pharon syncs the catalog daily.
Is there a CISA KEV RSS feed or API?
CISA publishes the catalog as JSON and CSV on cisa.gov and announces additions as alerts. Pharon turns it into alerts that fire only when a listed vulnerability is in something your team runs, by email, Slack or webhook.
Do the KEV due dates apply to me?
They bind US federal civilian agencies. For everyone else they are a sensible deadline: a vulnerability on this list is already being used against real targets.
How does Pharon use KEV?
Pharon checks the catalog daily. A vulnerability on the list is treated as actively exploited: its notice gets a higher severity, and the team running the affected package, container image or runtime is alerted with the version found and where.