Download the KEV catalog as JSON or CSV from CISA, write down the products and versions you run, and search the file for those names. Any match is a known exploited vulnerability that deserves attention this week. The whole check takes about ten minutes once you have a product list.
What the catalog is
CISA describes the Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities that have been exploited in the wild, and says organizations should use it as an input to their vulnerability management prioritization framework. When I reviewed the page it listed 1,748 entries, so it keeps growing. It is offered as a CSV file and a JSON file, with a JSON Schema describing the format.
The ten minute method
- Minutes 0 to 2. Download the CSV from the CISA page.
- Minutes 2 to 4. Open your product list. Include operating systems, your web framework, your database, your reverse proxy, your VPN and network devices, your CI tools and your admin consoles.
- Minutes 4 to 8. Search the file for each product name. In a spreadsheet this is a filter on the vendor and product columns. Check the column names against the schema CISA links rather than assuming them.
- Minutes 8 to 10. For each match, compare the version you run with the affected versions in the linked advisory. Record the result.
Why product names are tricky
Vendors name products inconsistently, and a library may be inside another product. A search for the headline name can miss a bundled component. If you need component-level matching, use a scanner that reads your lockfiles and then check its CVE IDs against the KEV list. This is a shortcut, not a guarantee.
What a match means
A match means attackers have used that flaw in the real world. It does not mean you were attacked, and it does not mean your version is affected. Verify the version, then act: patch, apply the vendor's mitigation, or disconnect the affected system until you can.
Make it a weekly line
Add the check to your routine. Save the date you last ran it. If you want automation, a small script can read the JSON and compare CVE IDs against a list exported from your scanner, but even the manual version beats not looking.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the KEV list a full list of dangerous flaws?
No. It lists vulnerabilities with evidence of exploitation that meet CISA's criteria. Many serious flaws are not on it.
Do I have to follow it?
For most teams it is a free input to prioritization, as CISA itself describes it. Check your own contracts for any specific obligations.
Safeguard zero-day discovery and exploitability checks aim to bring this signal to you without the manual search, and the free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
