Exploitation intelligence
KEV Intelligence connects exploited CVEs to source evidence, confidence, proprietary sensor telemetry, and practical artifacts so security teams can act on what matters first.
Free live feed, RSS, and JSON. Pro adds deeper evidence, telemetry, and integration-ready context.
Sensor activity
Observed exploitation events · last 7 days
65
KEVs observed
4,773
Events
770
Attacker IPs
Evidence-backed exploitation records
Additional exploited CVEs
Tracked KEVs in the last 7 days
PoC, Nuclei, Metasploit, and virtual patch context
Evidence depth
Every record connects the exploitation verdict to evidence your team can inspect, telemetry it can weigh, and artifacts it can use.
Open the full CVE reportVerified vulnerability record
Helix3 extension for Joomla
Helix3 extension for Joomla
Evidence
Active exploitation observed
Independent exploitation attestation added to the KEV Intelligence record.
Sensor telemetry
2 attempts · 1 sensor
First-party observations recorded across 1 attacker IP.
Actionable artifact
Proof of concept available
Public PoC material increases practical exploitability.
Evidence, telemetry, and action stay attached to the CVE.
Browse exploited CVEs →Intelligence system
KEV Intelligence combines 60+ public sources, vendor advisories, and private honeypots—then keeps the evidence chain attached as records move into operational workflows.
Public sources, vendor advisories, private honeypots, and custom sensors.
Review source credibility, specificity, corroboration, and first-hand telemetry.
Add EPSS, CVSS, CWE, PoCs, Nuclei, Metasploit, and affected-version context.
Ship through the live feed, email, RSS, JSON, and Pro API.
1,059+ additional exploited CVEs beyond CISA KEV
Evidence stays inspectable at every stage
Built to act
Vulnerability management
Rank exploited CVEs using evidence confidence, sensor observations, EPSS, CVSS, and asset context.
Learn moreSOC and detection
Connect observed paths, payloads, PoCs, and scanner context to monitoring and response.
Learn moreMSSP and MDR
Deliver evidence-backed exploited-vulnerability context with timelines and practical artifacts.
Learn moreCyber threat intelligence
Follow source provenance, exploitation timelines, confidence changes, and attacker activity.
Learn moreEvidence before urgency
Start with the free live feed, then add deeper evidence, telemetry, and automation through the Pro API.
