Which vulnerabilities are being exploited right now?
CISA’s Known Exploited Vulnerabilities catalog is the authoritative free list, published as JSON and CSV and updated as evidence arrives. Pair it with vendor advisories, which often warn of exploitation before an entry appears, and with EPSS to rank everything not yet confirmed. Absence from the catalog means unconfirmed, never safe.
KEV is a trailing indicator by construction. An entry requires that an attack happened, was detected, was tied to a specific CVE, and was reported publicly. Every one of those steps costs time, so the catalog always lags first exploitation. Read it as the floor of what is being exploited, never the whole of it.
The detail that breaks most workflows is the dates. A large share of entries added in any given year carry identifiers from earlier years, so the set under active attack is not the set published recently. A filter showing only this month’s disclosures will miss most of what is actually being used, and a new KEV addition should reopen a backlog item you closed as low priority years ago.
For the much larger remainder, EPSS gives a probability of exploitation in the next 30 days. It ranks the unconfirmed rather than leaving it undifferentiated, and because the scores move as exploit code circulates it has to be re-read rather than snapshotted once during triage. Cross it against what you actually run: a high probability on software you do not deploy is not your problem.
Do not take any single site’s word for the current list, this one included. CISA publishes the catalog itself, free, and pulling it directly is the right primary integration. What we hold as of September 2026 is 134 KEV-flagged records against the 1,695 entries in CISA’s catalog — a working subset with EPSS and severity attached, not a mirror. Match the catalog against your own inventory first, then use ranked data for everything it does not cover.
More on prioritisation