Watching the KEV catalog is a small job. From 1 January 2025 to 16 October 2026, CISA added entries on 237 of 654 calendar days, averaging 2.15 entries per addition day, with a peak of 8 in one day. A short daily check is enough if you can match entries to your inventory.
Method
We downloaded the KEV JSON feed on 19 October 2026 (catalog version 2026.10.16, 1,748 entries, last release 16 October 2026) and counted entries by dateAdded. The feed gives dates only, not times, so we cannot say when in the day entries appear. Weekday counts use the calendar date.
What the numbers say
Since 1 January 2025:
- 237 distinct addition days out of 654 calendar days, about 36 percent.
- 509 entries in total, an average of 2.15 per addition day.
- The busiest days: 8 entries on 20 April 2026, and 7 each on 20 May 2026 and 2 September 2026.
Monthly additions in 2026: January 17, February 28, March 26, April 31, May 21, June 23, July 26, August 31, September 43, and 18 for October through the 16th. For 2025 the monthly average is about 20. September 2026 is the busiest month in either year.
By weekday, for entries added since 2023 (882 entries): Tuesday 252, Monday 199, Thursday 176, Wednesday 156, Friday 95, Sunday 4, Saturday 0. Tuesday and Monday together account for about 51 percent.
Outliers exist. On 3 November 2021 the catalog launched with 287 entries, and 95 more came on 3 March 2022. These are loads, not typical days.
A 15 minute daily routine
You do not need a team to keep up. A workable routine for a small group:
- Pull the feed or subscribe to CISA's email updates once each working day.
- Diff against yesterday's copy and list new CVE IDs.
- Match each against your inventory: products, versions, and dependencies.
- For each match, open a ticket with an owner and a due date. Start with internet facing systems.
- Record the entries that did not match, so you can say why.
The matching step is where time goes. With two or three entries on a typical addition day, reading is cheap. Finding out whether you run the affected product is the slow part, and that depends on a current inventory.
On weeks with a spike, such as the 43 entries of September 2026, batch the matching and handle internet facing hits first.
Safeguard's asset discovery and SBOM and dependency scanning keep the inventory and matching side current, so the daily check starts from a list of your own exposures.
Quick check
Do I need to check KEV on weekends?
Almost no additions land on weekends: 4 of 882 since 2023 fell on a Sunday and none on a Saturday. Exploitation does not pause, so your own monitoring should not either.
How many entries should I expect in a month?
In 2025 the average was about 20 and in 2026 it has ranged from 17 to 43, so plan for a range, not a fixed number.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
