90,000 CVEs a year. 283 that are being used against you.
KEV is the U.S. government's list of vulnerabilities with confirmed real-world exploitation. CRDS only prints cards for KEV entries — and nothing else.
What KEV is
The Known Exploited Vulnerabilities catalog is maintained by CISA, the U.S. Cybersecurity and Infrastructure Security Agency. A vulnerability goes in only when all three are true:
- it has a CVE ID
- there is reliable evidence of active exploitation — real attacks, not proof-of-concept code or scanner noise
- there is clear remediation guidance, so you can actually act on it
That third rule is why KEV is a to-do list, not a threat feed.
- 187
- added in 2023
- 186
- added in 2024
- 245
- added in 2025
- 283
- added in 2026 (to 3 Nov)
The latest year's additions are equal to about 0.3% of the CVEs published this year.
Why volume stopped being the signal
- 28,816 2023 187 KEV
- 39,953 2024 186 KEV
- 48,151 2025 245 KEV
- 89,859 2026 283 KEV
Status: 3 Nov 2026 · 2026 runs through 31 Oct for CVEs and 3 Nov for KEV.
2026 has already nearly doubled last year's total. AI-assisted research is a plausible driver. Exploitation has not doubled. CVSS tells you how bad a bug could be; KEV tells you it is being used.
What CISA tells organisations to do
-
BOD 22-01 November 2021
Federal civilian agencies had to fix every KEV entry: within two weeks for CVEs assigned 2021 or later, within six months for older ones. “CISA strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation of the listed vulnerabilities.”
-
BOD 26-04 June 2026
Replaces 22-01 with a risk-tiered model built on four questions:
- Is it in KEV?
- Is the asset publicly exposed?
- Can the attack be automated?
- Does it give total control of the system?
| Condition | Deadline |
|---|---|
| In KEV, total control, and exposed or automatable | 3 days + forensic triage |
| In KEV, exposed, automatable, partial control | 3 days |
| Not in KEV, exposed, automatable, total control | 3 days |
| All other KEV entries | 14 days |
| Not in KEV, exposed, and either automatable with partial control or not automatable with total control | 14 days |
| Not in KEV, and either exposed, not automatable, partial control, or not exposed and automatable | 60 days |
| Not exposed, not in KEV, not automatable | Fix on system upgrade |
Read that again: the directive's stated aim includes “deferring action against low-risk vulnerabilities.” The count is officially not the queue.
Binding Operational Directives apply to U.S. federal civilian agencies. “Although not bound by BOD 26-04, every organization […] can significantly strengthen their security and resilience posture by prioritizing the remediation of the vulnerabilities listed in the KEV catalog.” Figures and wording from CISA; see sources.
How CRDS uses this
KEV entries only
Exploited, actionable, readable. CRDS only prints cards for KEV entries.
The CISA clock on every card
kev_added and kev_due are fields, not footnotes.
Your deck = KEV ∩ your software
Add an SBOM and get the cards that apply to you. Parsed in your browser, never uploaded.
Legends
Pre-2026 KEV entries — Log4Shell, MOVEit, Citrix Bleed — as the reference set for training and tabletop exercises.
Sources
FAQ
Is KEV complete?
No. KEV lists only what CISA has confirmed; other trackers list more. KEV is the conservative, government-vetted floor.
Does a CVE ever leave KEV?
A card whose CVE leaves KEV is kept and marked, never deleted.
Is this U.S.-only?
The directives are. Exploitation isn't.