Total KEVs
2694
KEVs (Last 30 Days)
212
CISA KEVs
1656
Beyond CISA KEV
1038
Total Tags
31
Total Vendors
883
Intelligence Highlights
Rolling last 7 days by KEV attestation date. “Ahead of CISA” uses operational sources only (excludes CVE metadata ingest). Sensor counts reflect observed exploitation attempts in the honeypot and sensor network (90-day aggregate history; lifetime first/last observed preserved).
Last 7 Days
New KEVs
10
Beyond CISA KEV
7
In CISA
3
Ahead of CISA
0
Avg Faster
—
Median Faster
—
Sensor Telemetry
KEVs in Sensors
90
Active (7d)
75
Exploitation Events (7d)
3,944
Unique Attackers (7d)
531
Ahead of CISA This Week
No operational ahead-of-CISA KEVs added in the last 7 days.
Trends
KEVs Over Time (Last 12 Months)
KEVs by Year Added
Note: CISA KEV launched on November 3rd, 2021. KEVIntel launched on April 30th, 2025.
KEVs by Tag
Distribution
Table
| Tag | KEV Count |
|---|---|
| cisa | 1656 |
| nuclei_scanner | 1187 |
| windows | 433 |
| metasploit | 420 |
| nessus_scanner | 368 |
| malware | 328 |
| microsoft | 312 |
| edge | 276 |
| ransomware | 261 |
| ios | 178 |
| php | 137 |
| macos | 96 |
| linux | 93 |
| java | 90 |
| wordpress | 69 |
| apache | 67 |
| android | 49 |
| dotnet | 27 |
| joomla | 11 |
| python | 6 |
| elasticsearch | 5 |
| drupal | 5 |
| nodejs | 3 |
| redis | 3 |
| ruby | 3 |
| magento | 2 |
| mysql | 2 |
| qilin ransomware | 2 |
| mongodb | 1 |
| postgresql | 1 |
Distribution
Top 10 Vendors by KEV Count
Top 10 Vendors with Edge KEVs
Vendors with the most KEVs tagged as 'edge' (edge computing, edge devices, etc.)
CVSS Score Distribution
Each chart shows the distribution of CVSS scores for all KEVs. Only KEVs with a score for that version are included in the chart.
CVSS v4.0
CVSS v3.0
CVSS v2.0
EPSS Analysis
EPSS Score Distribution (Last 30 Days)
Top 10 KEVs by EPSS Score
CVE Analysis
Top 10 KEVs by News Mentions
Based on mentions in security news articles and advisories
Top 10 KEVs by Proof of Concepts
Based on publicly available unverified proof of concept exploits
Exploitation Analysis
Time Between CVE Publication and KEV Listing
Note: This shows the time between CVE publication and KEV listing, not necessarily when exploitation began