The CISA Known Exploited Vulnerabilities catalog is a public list of software flaws that have been used in real attacks. Leaders care because it is far shorter than the list of all flaws, so it gives a clear question for engineering: do we run any of these, and when will they be fixed?
What the catalog is
CISA describes the catalog as the authoritative source of vulnerabilities that have been exploited in the wild. It is available as CSV and JSON as well as on the web. CISA advises organizations to use it as one input to their vulnerability management prioritization.
Why a short list helps
Most scanners produce long lists. Executives cannot weigh thousands of rows, and neither can most teams. A list built from observed exploitation narrows attention to flaws attackers have already used. That does not make everything else safe, only a sensible place to look first.
What entries tell you to do
Individual entries describe actions such as applying vendor mitigations, assessing internet exposure, performing forensic triage where the entry says so, and discontinuing use of the product if mitigations are unavailable.
Four questions for your next risk meeting
- Do any of our products or vendor products contain a KEV listed flaw?
- How many days passed between listing and fix last quarter?
- Which of those items face the internet?
- How do we find out about a new listing, and who acts on it?
Common misreadings
A flaw missing from KEV is not proof it is safe; the catalog is a record of confirmed exploitation, not a complete map of risk. A flaw present in KEV is not an incident at your company; it means the matter is worth checking now.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Try it yourself
Look at how the dashboard orders findings, and ask which of those would belong on a short list of known exploited items.
Click through it at your own pace, or open it full screen.
Quick check
Is the KEV list only for government?
No. It is public and CISA says any organization can use it as a prioritization input.
Does being on the list mean there is a patch?
Not always. Entries note mitigations and, where none exist, discontinuing use of the product.
Sources
Last reviewed: 19 October 2026.
