Sensor-led exploitation intelligence
KEV Intelligence uses proprietary sensors and private honeypots to surface active exploitation, corroborated by vendor advisories and public evidence. Inspect the evidence, prioritize with confidence, and act sooner.
Start with the free live feed, RSS, and JSON. Pro adds deeper evidence, telemetry, and integration-ready context.
Live sensor activity
Exploitation activity observed across KEV Intelligence sensors during the last 7 days.
74
KEVs observed
4,698
Exploitation events
840
Attacker IPs
Exploitation records supported by strong, inspectable evidence
Exploited vulnerabilities missing from CISA’s catalog
Tracked KEVs seen across proprietary sensors in the last 7 days
PoCs, Nuclei, Metasploit, and virtual-patch context
Early warning alerts
Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.
Evidence depth
Every warning connects the exploitation verdict to inspectable evidence, confidence, available sensor telemetry, affected versions, and practical security artifacts.
Browse exploited CVEsVerified vulnerability record
langflow · affected before 1.7.1
Version 1.7.1 contains a patch
Sensor telemetry
1 attempt · 1 sensor
First-party observations recorded across 1 attacker IP.
Evidence
Active exploitation observed
Independent exploitation attestation added to the KEV Intelligence record.
Actionable artifact
Nuclei template available
Public scanner coverage helps validate exposed systems.
Evidence, telemetry, and action stay attached to the CVE.
Browse exploited CVEs →Intelligence system
KEV Intelligence observes exploitation through proprietary sensors and private honeypots, corroborates signals against vendor advisories and public evidence, and keeps the evidence chain attached as warnings move into operational workflows.
Proprietary sensors and private honeypots surface exploitation activity, supported by vendor advisories and relevant public evidence.
Evaluate source credibility, specificity, corroboration, and available first-party telemetry.
Add EPSS, CVSS, CWE, affected-version context, PoCs, Nuclei, Metasploit, and virtual-patch context.
Send trusted warnings through the live feed, email alerts, RSS, JSON, and Pro API.
74 KEVs observed in sensors (7d)
Evidence remains inspectable at every stage
Built to act
Vulnerability management
Use sensor observations, evidence confidence, EPSS, CVSS, and asset context to identify which exploited vulnerabilities need attention first.
Learn moreSOC and detection
Use observed paths, payloads, attacker infrastructure, PoCs, and scanner context to guide monitoring and response.
Learn moreMSSP and MDR
Deliver evidence-backed exploitation intelligence with timelines, available telemetry, and practical artifacts.
Learn moreCyber threat intelligence
Follow exploitation timelines, confidence changes, source provenance, and available first-party attacker activity.
Learn moreAct on exploitation sooner
Start with the free live feed, then add deeper telemetry, confidence, and automation through the Pro API.
