Download the CISA Known Exploited Vulnerabilities catalog as CSV or JSON, filter it by the vendor and product names you are considering, and read each entry's date added and required action. A hit shows real exploitation in the wild. A miss does not prove the product is safe.
What the catalog is
CISA describes the KEV catalog as the authoritative source of vulnerabilities that have been exploited in the wild, and says organizations should use it as an input to their vulnerability management prioritization. The page offers CSV and JSON downloads plus a JSON schema, and each entry carries a date added and a due date. The entries also point to CISA's directive on prioritizing security updates based on risk, BOD 26-04.
That makes it a cheap pre-purchase check. It takes minutes and the data is public.
Steps
- Write down the exact vendor and product names, including older names and acquired brands.
- Download the JSON or CSV feed from the CISA catalog page.
- Filter on the vendor field first, then narrow by product.
- For each match, note the CVE, the date added, and the action text.
- Ask the vendor how each one was fixed, in which versions, and how long customers had to wait.
- Record the result with the date, since the list changes.
How to read what you find
| What you see | What it suggests | What to ask |
|---|---|---|
| No entries | No listed exploitation to date | How do you find your own flaws? |
| Old entries, fixed quickly | Mature response | Show the advisory and fix versions |
| Several recent entries in one product line | Attractive target, or weak design | Is there an architectural fix planned? |
| Entry for a version you would deploy | Direct exposure | Is the fixed version the one you will receive? |
Limits of the check
The catalog lists vulnerabilities with confirmed exploitation. It does not list every product flaw, and it says nothing about vendors whose software is rarely targeted. It also covers software you run. For a hosted service the vendor patches on its side, so a listing there tells you about their response rather than your exposure. Pair this check with the vendor's own advisories and see how to read a vendor security advisory.
Try it yourself
Open the zero-day watch demo and look at how a newly exploited flaw is matched to the software you actually run.
Click through it at your own pace, or open it full screen.
Quick check
Does a KEV entry mean we should not buy the product?
Not by itself. Look at how fast the fix arrived, whether the fixed version is the one you would get, and how the vendor communicated. Every widely used product eventually appears.
How often does the catalog change?
It changes as new exploited vulnerabilities are added, so always record the date you checked and recheck before signing.
Safeguard's zero-day discovery and SBOM scanning can keep watching the software you already run, and the free scan at gold.safeguard.sh/scan is a quick way to start.
Sources
Last reviewed: 19 October 2026.
