CISA's Known Exploited Vulnerabilities catalog (KEV)
The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
CISA, the Cybersecurity and Infrastructure Security Agency, keeps a public list of vulnerabilities it has reliable evidence are being exploited. It's often called the KEV catalog.
Each entry names the vendor and product, describes the flaw, and sets a due date, usually two or three weeks out, by which U.S. federal agencies must fix it. CISA also flags flaws known to be used in ransomware campaigns.
The deadline only binds federal agencies, but the list is free and public. It's one of the most reliable signals of what to patch first, and it's the backbone of Patch Sonar.
Why it matters to you: If a product you run appears on CISA's list, treat it as urgent. Patch Sonar checks the list every few hours and turns each entry into a plain-English page.
Related terms
- Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.
- RansomwareMalicious software that locks up or steals a business's files and demands payment to get them back.
- CVE numberThe ID number that identifies one specific security flaw, like CVE-2026-41709.