CISA KEV

CISA KEV is the Known Exploited Vulnerabilities catalog, a public list kept by the US Cybersecurity and Infrastructure Security Agency (CISA). It names security flaws in software that attackers have already used in real attacks, not flaws that could only be used in theory. Think of it like a product recall notice that says a problem has already hurt someone, so fixing it should come first.

CISA advises organizations to use the catalog when deciding which fixes to make first. Each entry is tied to a CVE. On this site, we mark an advisory “known exploited” when its CVE appears in the catalog.

Why it matters

A small organization rarely has time to fix every flaw at once, and a high CVSS score does not tell you whether anyone is actually attacking it. If an AI tool or service you use has a flaw on the KEV list, treat it as urgent: install the update or ask your IT support to do it this week. When you choose a vendor, ask how quickly they fix flaws that land on the CISA KEV list and how they tell customers. You can read more in our look at AI vulnerabilities on the list.