Glossary
Known Exploited Vulnerabilities (KEV) catalog
CISA's list of security flaws confirmed to be used by attackers.
The Known Exploited Vulnerabilities catalog is maintained by CISA. A flaw is added when there is reliable evidence that attackers are exploiting it and a fix or mitigation exists.
U.S. federal civilian agencies must patch listed flaws by a set due date. Other organizations are not bound by those deadlines, but CISA recommends treating the list as a patching priority.