What is the CISA KEV catalog?
CISA's Known Exploited Vulnerabilities (KEV) catalog is the U.S. government's authoritative list of CVEs confirmed to be exploited in the wild. Because exploitation is proven, KEV entries are the vulnerabilities to patch first, ahead of anything scored only by severity.
What is an EPSS score?
EPSS (Exploit Prediction Scoring System) from FIRST.org estimates the probability that a CVE will be exploited in the next 30 days. This tracker ranks the exploited vulnerabilities by EPSS so the most likely-to-be-attacked rise to the top.
Which vulnerabilities does this tracker cover?
Every actively exploited, third-party (non-Microsoft) vulnerability in CISA KEV: Apache, Cisco, Citrix, Fortinet, Ivanti, VMware, and the rest, with vendor, product, CVSS, ransomware use, and the vendor advisory that fixes each one. Microsoft vulnerabilities are on the separate Microsoft patch tracker.
How often is the exploited vulnerability list updated?
Daily. The data refreshes from CISA KEV, NVD, and FIRST.org EPSS, cross-referenced with VulnCheck KEV and the ENISA EUVD, so newly exploited CVEs appear within a day of being cataloged.
Is this exploited vulnerability tracker free?
Yes, free with no sign-in. You can search, sort, and export to CSV or JSON. Running Senserva adds the part a public list cannot: which of these exploited CVEs your own estate is actually exposed to, ranked, so you fix the right things first.
Can I use this exploited-CVE data with my own AI?
Yes. A free copy-paste AI prompt near the table is generated from the live data each day and carries the top exploited CVEs, with vendor, CVSS, EPSS, ransomware use, and CISA due dates, into Claude, ChatGPT, or Copilot for triage in your own words.
What are the top routinely exploited vulnerabilities?
CISA and its international partners publish a yearly joint advisory naming the CVEs attackers exploited most. For 2023, advisory AA24-317A lists 15, led by Citrix NetScaler (CVE-2023-3519 and Citrix Bleed CVE-2023-4966), Cisco IOS XE (CVE-2023-20198), Fortinet FortiOS (CVE-2023-27997), and Progress MOVEit Transfer (CVE-2023-34362). All 15 are listed above and appear in the live table with current EPSS and ransomware flags.
How often does CISA add new known exploited vulnerabilities?
CISA adds CVEs to the KEV catalog on a rolling basis, often several times a week, whenever exploitation is confirmed. This tracker refreshes daily, so new additions appear within a day of being cataloged. The most recent ones are on the exploited this week page.
Will a CISA KEV-listed vulnerability see ransomware exploitation soon?
Many do. CISA flags the KEV entries known to be used in ransomware campaigns, and those are marked in the Ransomware column here. A KEV listing already means exploitation is confirmed, so treat every entry, ransomware-flagged or not, as urgent and patch by the CISA due date shown in the table.
