Also known as: Known Exploited Vulnerabilities · CISA KEV
The KEV (Known Exploited Vulnerabilities) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with confirmed evidence of active exploitation in the wild.
KEV is deliberately conservative: a vulnerability is added only when there is reliable evidence of real-world exploitation, not merely a published proof of concept. That restraint is what makes it useful — inclusion is a strong, low-noise signal that patching is genuinely urgent.
US federal civilian agencies are bound to remediate KEV entries within set deadlines, which is why the catalog carries regulatory weight. Many private organisations adopt it voluntarily as the top tier of their patch queue.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
EPSS
EPSS (Exploit Prediction Scoring System) estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage between 0 and 100.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.