CISA KEV catalog · 0 entries
Exploited in the wild
Vulnerabilities with reliable evidence of active exploitation. All of these are P1. US federal agencies must patch them by the due date; everyone else should treat that date as a ceiling.
| CVE | Vendor / product | Used by | Exploit | Vulnerability | Added | Due | EPSS |
|---|
How to read this page
- Weaponization ladder
- Five squares, left to right: GitHub PoC, ExploitDB entry, Nuclei template, Metasploit module, exploited in the wild (red). Each step lowers the skill needed to attack: a Nuclei template means anyone can scan the internet for it, a Metasploit module means anyone can exploit it with one command.
- EPSS
- FIRST's Exploit Prediction Scoring System: the estimated probability that a CVE is exploited in the next 30 days, from observed attack data. The percentile compares it with every other CVE. It measures likelihood, not impact.
- KEV
- CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of exploitation in the wild. The due date is binding for US federal agencies and a useful upper limit for everyone else.