Of 1,748 KEV entries, 133 (7.6 percent) also appear as a CVE alias in advisories for eight open source package ecosystems. The other 92.4 percent live in operating systems, appliances and commercial products. Your lockfile will rarely contain a KEV entry, but when it does, it deserves first priority.
Method
We downloaded the CISA KEV JSON feed (catalog version 2026.10.16) and eight OSV ecosystem exports (npm, PyPI, Go, Maven, NuGet, Packagist, RubyGems, crates.io) on 19 October 2026. We took each live vulnerability advisory (not MAL-, not withdrawn) and checked whether any CVE alias matched a KEV CVE ID.
Limits: OSV covers more ecosystems than these eight, and KEV entries in operating system packages or containers are outside this count. A CVE alias match shows an advisory exists for a package, not that your version is affected. So 133 is a floor for package-registry overlap.
What the numbers say
KEV CVE IDs found per ecosystem: Maven 54, Packagist 24, PyPI 20, NuGet 16, npm 14, Go 10, RubyGems 4, crates.io 1. These add up to more than 133 because some CVEs appear in more than one ecosystem.
Among the 133, 45 were added to KEV since the start of 2025 and 28 in 2026. Fifteen carry the ransomware flag. By KEV vendor field, Apache accounts for 31 of them, then Google (9), Jenkins (6), Drupal (5), Microsoft (5), Langflow (5), Craft CMS (4), DotNetNuke (3), SaltStack (3) and Laravel (3).
The overlap is therefore weighted to Java web frameworks and servers, PHP content systems, and a handful of tools in the AI and automation space.
What to do with it
Do not conclude that package risk is small. Seven percent of KEV is still 133 flaws, and each one is in code that developers pull in without a purchase. These are also the ones a procurement based vulnerability process never sees.
Do split your KEV work into two streams. One is product and appliance patching, driven by an asset inventory of what you run. The other is dependency work, driven by an SBOM of what you build. They need different owners and different tools.
For the second stream, check three things when a KEV entry matches a package: whether your version is in the affected range, whether the vulnerable code is reachable, and whether a fixed version exists. If the answer to the first two is yes, treat it as an incident-grade patch.
Safeguard's SBOM and dependency scanning and reachability analysis cover those three checks, and the free scan at https://gold.safeguard.sh/scan lets you try them on one repository.
Try it yourself
Open the demo and see how reachability narrows a list of vulnerable dependencies to the ones your code actually calls.
Click through it at your own pace, or open it full screen.
Quick check
Does a KEV match in my lockfile always mean I am exposed?
No. It means an advisory for the package exists. Check your version against the affected range and whether the vulnerable code is reachable.
Where are the other KEV entries?
Mostly in operating systems, network appliances and commercial software, which need an asset inventory, not an SBOM.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
Last reviewed: 19 October 2026.
