Reproduce a KEV analysis yourself in 30 lines of Python

You can reproduce most KEV statistics with one standard library script: download the CISA JSON feed, count a field, print the result. The script below does three counts in under 30 lines. Run it, compare with any article you read, and note the release date so your numbers match.

Why reproduce instead of trust

Statistics about the catalog go stale quickly. New entries arrive most weeks, and fields such as the ransomware flag can change after an entry is added. A number from a blog post is only true for the day it was run.

Running the count yourself gives you a number with a date on it. It also shows you the odd cases, such as the 287 entries loaded on a single day in November 2021, which can distort a naive average.

The script

This uses only the Python standard library.

import json, urllib.request
from collections import Counter

URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
data = json.load(urllib.request.urlopen(URL))
entries = data["vulnerabilities"]
print("release", data["dateReleased"], "entries", len(entries))

# 1. Entries added per year
per_year = Counter(e["dateAdded"][:4] for e in entries)
print(sorted(per_year.items()))

# 2. Share added in the same year as the CVE ID, since 2023
recent = [e for e in entries if e["dateAdded"] >= "2023-01-01"]
same = sum(1 for e in recent if e["cveID"].split("-")[1] == e["dateAdded"][:4])
print("same year share since 2023:", round(100 * same / len(recent), 1))

# 3. Top vendors
vendors = Counter(e["vendorProject"] for e in entries)
print(vendors.most_common(5))

When we ran it on 19 October 2026 against release 2026-10-16T17:15:48Z, it printed 1,748 entries, 311 added in 2021, 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025 and 264 in 2026. The same-year share since 2023 came out at 64.1 percent. The top five vendors were Microsoft (390), Cisco (101), Apple (95), Adobe (82) and Google (75).

If your run prints different numbers, check the release line first. A newer release explains most differences.

Fields worth knowing

Each entry in the feed includes the CVE ID, vendor and product names, a short description, the date added, a due date, the ransomware flag, a notes field and a list of CWE IDs. Most of the interesting questions can be answered by counting one of these or by subtracting two dates.

A few cautions when you build on this:

• Treat vendor names as free text. Do not assume two spellings are the same company.
• Some entries have an empty CWE list. Count them separately instead of dropping them.
• Dates are calendar dates without times.
• Save the file with its release date in the name, so you can rerun a past analysis on the same data.

Going further

Two extensions are easy. Join the feed to EPSS scores from the public FIRST API to see how a model scores known exploited flaws. Or join it to your own SBOM and list the entries whose CVE IDs appear in your dependencies. The second one is the version that changes what you do on Monday.

If you would rather not build the join yourself, Safeguard's SBOM and dependency scanning does the match against your repositories, and the free scan at https://gold.safeguard.sh/scan is a way to try it.

Quick check

Sources

• CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
• CISA Known Exploited Vulnerabilities Catalog

Last reviewed: 19 October 2026.