Skip to main content

CISA Known Exploited Vulnerabilities

The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities attackers are known to exploit. Under Binding Operational Directive 22-01, US federal agencies must fix each one by its due date. Threat Radar mirrors the catalog with its dates, required actions and ransomware flag, and adds scores, fixes and exploitation evidence on every entry's page.

Source: CISA KEV catalog (opens in a new tab) · synced 26 Oct 2026, 15:55 UTC · catalog version 2026.10.23

In the catalog
1,756
Added, last 7 days
8
Added, last 30 days
30
Due this week
2
Past due, all time
1,751
Known ransomware use
361

Recently added

Newest additions to the catalog first

Added in the last 7 daysAll 1,756 entries

Due soonest

Open deadlines, nearest first

All by deadlineDue this weekOverdue, last 30 days

About the catalog

What is the KEV catalog?
CISA, the US Cybersecurity and Infrastructure Security Agency, lists a vulnerability once there is reliable evidence that attackers exploit it, it has a CVE ID, and there is clear remediation guidance such as a vendor update. It is a short list of what is being used in attacks, not a ranking of every serious flaw.
What do the due dates mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to remediate each entry by the due date CISA sets for it, often a few weeks after it is added. Anyone else can use the same dates as a sensible patch deadline.
What does Threat Radar add?
Each entry links to its vulnerability page with CVSS and EPSS scores, affected versions and packages, fixes, the CISA required action, and exploitation seen by OffSeq Mirage honeypots.

Track KEV from your own tools

The catalog is free to read here. An account adds API access to the same data; a paid plan watches your hosts for you.

Free accountFree, no card needed

  • KEV filters on the API: kev=true, kev=overdue and kev=upcoming, up to 10 results a request
  • The full archive, past the newest 1,000 results
  • 200 list reads a minute instead of 100
  • An API key: 20 API requests an hour, 30 a day, 900 a month
Create a free account

Individual plan€12 a month or €120 a year

  • Register your hosts: a new vulnerability that affects them alerts you, and a KEV listing or missed deadline raises its priority
  • 25 API requests an hour, 75 a day, 2,250 a month
  • Up to 25 results per request
  • Alerts by email, Slack and webhook; 3 monitored hosts
Upgrade to Individual

Compare all plans