Known exploited vulnerability intelligence

Security Pulse Overview

What's Changed

Waiting for published comparison data.

Recently Added to CISA KEV

Waiting for snapshot data.

Vulnerability explorer

The table above is the bounded preview (most recently added KEV entries). Search of all published records loads data/latest.json from this site. It does not call external APIs.

Previous Catalog not loaded. Next

How to read these signals

• Confirmed exploitation means CISA listed the CVE in the Known Exploited Vulnerabilities catalog. KEV indicates confirmed historical exploitation, not current exposure.
• EPSS, when present, is an estimated probability of exploitation, not confirmation. When EPSS is disabled it is not a probability of zero.
• Severity is CVSS from the CVE CNA container when available. Missing scores are shown as unavailable, not guessed. CVSS describes vulnerability severity, not exploitation probability.
• Collection outcome (ok, degraded, or failed) is whether the collector finished. A degraded snapshot succeeded; it is not a failed collection.
• Record completeness is per CVE: complete extracted inventory, partial truncated product/version text, or unavailable enrichment. Completeness refers to extracted data, not proof of complete real-world affectedness. These are not the collection outcome and are not freshness.
• Product affectedness is vendor/product text from KEV and CVE records. A complete extracted inventory does not prove complete real-world product coverage or deployment exposure.
• Freshness is computed at viewing time from the snapshot timestamp. It is independent of collection outcome and record completeness.
• What's Changed compares the current published snapshot to the immediately preceding published snapshot. It is not a collect-time candidate diff and is not CISA's KEV dateAdded list.
• No composite risk score is calculated. Signals stay independent.
• Deployment exposure is not assessed here.

Data provenance and methodology

Operational timestamps below include catalog publication time, which is not the date a CVE was added to KEV. KEV added dates are shown in the tables. Collection time and publication time are distinct.