How is KEV different from CVSS?

CVSS scores how severe a vulnerability could be if exploited. KEV confirms a vulnerability is actually being exploited right now. A vulnerability can have a low CVSS score and still be in KEV, or a high CVSS score and never appear in KEV at all.

The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days, based on observed data. It complements KEV by scoring vulnerabilities that aren't confirmed-exploited yet.

Does being listed in KEV mean my organisation is affected?

No. KEV confirms exploitation is happening somewhere. Whether it affects you depends on whether you run the affected vendor and product — which is exactly what Seraph CTI's technology watches are built to determine.

How often is the Seraph KEV catalogue updated?

Seraph CTI syncs directly against CISA's published feed, which CISA typically updates on business days, and against FIRST.org's EPSS scores, which are refreshed daily.

How does Seraph prioritise vulnerabilities?

By layering signals: CISA KEV status, EPSS exploitation probability, known ransomware association, and — for signed-in customers — whether the affected technology is actually in their environment.

Can Seraph CTI notify us when technologies we use are affected?

Yes. Technology watches let you declare the vendors and products your organisation runs, and get notified when a new KEV entry matches your declared stack.

How does KEV intelligence connect to VAPT?

A confirmed-exploited vulnerability in a technology you run is a strong candidate for safe, targeted validation through penetration testing — rather than waiting for the next scheduled engagement to surface it.

How does KEV intelligence support SOC operations?

SOC analysts can correlate KEV entries against live security events, so an exploitation attempt against a known-vulnerable, known-exploited technology is triaged with that context attached from the start.

CISA Known Exploited Vulnerabilities

Track the vulnerabilities attackers are actively exploiting.

Seraph CTI tracks the CISA Known Exploited Vulnerabilities catalogue and enriches it with exploitability, technology context and threat intelligence — to help security teams prioritise what requires attention first.

Explore KEVs Monitor Your Technologies

1,685KEVs Tracked

+0Added in Last 30 Days

352Known Ransomware Use

Book a Demo

Why KEV Matters

Critical does not always mean exploited.

Thousands of vulnerabilities are disclosed every year. The challenge isn't identifying every vulnerability — it's understanding which ones attackers are actively using, and which of those are relevant to your environment.

CISA KEV answers the first question with authority: every entry is a vulnerability with confirmed, real-world exploitation. Seraph CTI carries that signal the rest of the way to a decision.

Vulnerability

A weakness is disclosed.

CVSS Severity

How bad could this be, in theory.

EPSS Exploitability

How likely is exploitation, in practice.

CISA KEV

Confirmed — this one is being exploited.

Threat Activity

Which actors and campaigns are using it.

Technology Match

Does it touch what you actually run.

Priority Action

What to do, and by when.

This is what Seraph CTI automates

Seraph Intelligence

From public vulnerability data to security context.

CISA KEV is one intelligence signal — an authoritative one, but a single layer. Seraph CTI enriches it with CVSS and EPSS scoring, exploit availability, threat actor and campaign intelligence, technology relevance, and sector and regional context where evidence exists.

Seraph doesn't just answer “is this being exploited?” — it helps answer “does it matter to us?”

CISA KEV
CVSS + EPSS
Exploitation Intelligence
Threat Actors / Campaigns
Technology Watches
Sector / Regional Context
Priority

Your Environment

Know when a KEV affects technology you actually use.

The public catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new KEV entry matches their stack — not the other 1,600 that don't.

Your Technology Watches

Microsoft 365Monitoring
FortinetMonitoring
VMwareMonitoring
CiscoMonitoring
CitrixMonitoring

IllustrativeNew Match

CVE-XXXX-XXXXX

CISA KEVHigh EPSSKnown Exploitation

Technology MatchFortinet FortiOS

Review Intelligence

Monitor Your Technology Stack

Sector Relevance

Understand which vulnerabilities matter to your industry.

Not every KEV entry carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to the technologies commonly used across identity, network/edge, server and cloud infrastructure in a given industry.

Financial ServicesHealthcareGovernmentTechnologyProfessional Services

Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.

Regional Intelligence

Global exploitation. Regional relevance.

Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure, threat actor activity and reported campaigns specific to East Africa.

No verified regional exploitation context is currently available for the public catalogue shown on this page. Seraph CTI customers see regional context directly against their own monitored environment.

One Signal. Multiple Security Actions.

KEV intelligence should not stop at the catalogue.

Threat intelligence is the layer that connects every other layer of defence. A single KEV entry flows across the Seraph platform, not just into a report.

CISA KEV

Seraph
CTI

Exposure

Determine whether affected assets exist in the organization.

Pentest

Safely validate relevant vulnerabilities where appropriate.

SOC

Correlate exploitation intelligence with security events.

Remediation

Compliance

Track remediation, risk and control obligations.

CISA KEV

Seraph CTI

Exposure

Determine whether affected assets exist in the organization.

Pentest

Safely validate relevant vulnerabilities where appropriate.

SOC

Correlate exploitation intelligence with security events.

Remediation

Compliance

Track remediation, risk and control obligations.

From Intelligence to Action

A KEV entry should trigger a decision, not another alert.

Check Exposure
Determine whether affected technologies exist in your environment.
Understand the Threat
Review exploitation activity, threat context and asset importance.
Prioritise Remediation
Escalate vulnerabilities that represent material organisational risk.
Validate
Confirm remediation and continue monitoring.

Frequently Asked Questions

Questions about KEV, EPSS and Seraph intelligence.

Can't find what you need? Ask a security expert.

KEV is a public catalogue maintained by the US Cybersecurity and Infrastructure Security Agency, listing vulnerabilities with confirmed evidence of active, real-world exploitation — not just theoretical risk.

Know when actively exploited vulnerabilities affect your environment.

Monitor your technology stack, receive priority threat intelligence and understand what requires action before exposure becomes an incident.

Explore Seraph CTI Book a Demo

Critical does not always mean exploited.

CISA KEV answers the first question with authority: every entry is a vulnerability with confirmed, real-world exploitation. Seraph CTI carries that signal the rest of the way to a decision.

CVE	Vendor / Product	EPSS	Date Added	Remediation Due	Ransomware Use	Action
CVE-2014-100005	D-Link DIR-600 Router	42.4%	May 16, 2024	Jun 06, 2024 Overdue	Unknown	View
CVE-2021-40655	D-Link DIR-605 Router	86.7%	May 16, 2024	Jun 06, 2024 Overdue	Unknown	View
CVE-2024-4761	Google Chromium V8	11.0%	May 16, 2024	Jun 06, 2024 Overdue	Unknown	View
CVE-2024-30051	Microsoft DWM Core Library	5.6%	May 14, 2024	Jun 04, 2024 Overdue	Known	View
CVE-2024-30040	Microsoft Windows	3.9%	May 14, 2024	Jun 04, 2024 Overdue	Unknown	View
CVE-2024-4671	Google Chromium	8.3%	May 13, 2024	Jun 03, 2024 Overdue	Unknown	View
CVE-2023-7028	GitLab GitLab CE/EE	94.6%	May 01, 2024	May 22, 2024 Overdue	Unknown	View
CVE-2024-29988	Microsoft SmartScreen Prompt	45.2%	Apr 30, 2024	May 21, 2024 Overdue	Unknown	View
CVE-2024-20353	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	70.7%	Apr 24, 2024	May 01, 2024 Overdue	Unknown	View
CVE-2024-20359	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	19.4%	Apr 24, 2024	May 01, 2024 Overdue	Unknown	View
CVE-2024-4040	CrushFTP CrushFTP	99.5%	Apr 24, 2024	May 01, 2024 Overdue	Unknown	View
CVE-2022-38028	Microsoft Windows	14.9%	Apr 23, 2024	May 14, 2024 Overdue	Unknown	View
CVE-2024-3400	Palo Alto Networks PAN-OS	100.0%	Apr 12, 2024	Apr 19, 2024 Overdue	Known	View
CVE-2024-3272	D-Link Multiple NAS Devices	98.0%	Apr 11, 2024	May 02, 2024 Overdue	Unknown	View
CVE-2024-3273	D-Link Multiple NAS Devices	100.0%	Apr 11, 2024	May 02, 2024 Overdue	Unknown	View
CVE-2024-29745	Android Pixel	0.5%	Apr 04, 2024	Apr 25, 2024 Overdue	Unknown	View
CVE-2024-29748	Android Pixel	0.7%	Apr 04, 2024	Apr 25, 2024 Overdue	Unknown	View
CVE-2023-24955	Microsoft SharePoint Server	85.4%	Mar 26, 2024	Apr 16, 2024 Overdue	Known	View
CVE-2023-48788	Fortinet FortiClient EMS	98.4%	Mar 25, 2024	Apr 15, 2024 Overdue	Known	View
CVE-2021-44529	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)	99.1%	Mar 25, 2024	Apr 15, 2024 Overdue	Known	View
CVE-2019-7256	Nice Linear eMerge E3-Series	97.1%	Mar 25, 2024	Apr 15, 2024 Overdue	Unknown	View
CVE-2024-27198	JetBrains TeamCity	99.9%	Mar 07, 2024	Mar 28, 2024 Overdue	Known	View
CVE-2024-23296	Apple Multiple Products	1.4%	Mar 06, 2024	Mar 27, 2024 Overdue	Unknown	View
CVE-2024-23225	Apple Multiple Products	1.5%	Mar 06, 2024	Mar 27, 2024 Overdue	Unknown	View
CVE-2021-36380	Sunhillo SureLine	97.6%	Mar 05, 2024	Mar 26, 2024 Overdue	Unknown	View

CVE

Vendor / Product

EPSS

Date Added

Remediation Due

Ransomware Use

CVE-2014-100005

D-Link

DIR-600 Router

42.4%

May 16, 2024

Jun 06, 2024

Overdue

Unknown

Track the vulnerabilities attackers are actively exploiting.

Critical does not always mean exploited.

Vulnerability

CVSS Severity

EPSS Exploitability

CISA KEV

Threat Activity

Technology Match

Priority Action

From public vulnerability data to security context.

Know when a KEV affects technology you actually use.

CVE-XXXX-XXXXX

Understand which vulnerabilities matter to your industry.

Global exploitation. Regional relevance.

KEV intelligence should not stop at the catalogue.

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

A KEV entry should trigger a decision, not another alert.

Check Exposure

Understand the Threat

Prioritise Remediation

Validate

Questions about KEV, EPSS and Seraph intelligence.

Know when actively exploited vulnerabilities affect your environment.

Track the vulnerabilities attackers are actively exploiting.

Critical does not always mean exploited.

Vulnerability

CVSS Severity

EPSS Exploitability

CISA KEV

Threat Activity

Technology Match

Priority Action

Explore actively exploited vulnerabilities.

More than a CVE number.

CVE-2026-66384

Know how quickly you need to move.

From public vulnerability data to security context.

Know when a KEV affects technology you actually use.

CVE-XXXX-XXXXX

What attackers are exploiting.

KEVs Added by Month

Top Affected Vendors

EPSS Score Distribution

Ransomware-Associated

Avg. Remediation Window

Understand which vulnerabilities matter to your industry.

Global exploitation. Regional relevance.

KEV intelligence should not stop at the catalogue.

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

A KEV entry should trigger a decision, not another alert.

Check Exposure

Understand the Threat

Prioritise Remediation

Validate

Latest additions to the KEV catalogue.

CVE-2026-66384

CVE-2026-53362

CVE-2023-49105