Early exploitation intelligence

Known Exploited Vulnerabilities Feed

Browse early exploitation warnings with confidence scoring, proprietary sensor telemetry where available, CISA KEV status, and practical detection artifacts for vulnerability management, CTI, SOC, and MSSP workflows.

Browse feed RSS feed JSON API

Total KEVs: 2,750; Known exploited vulnerabilities tracked by KEV Intelligence
Beyond CISA KEV: 1,080; Additional exploited CVEs beyond the official catalog
Observed in Sensors: 83; Tracked KEVs with sensor activity in the last 7 days
Artifacts Available: 1,728+; PoC, Nuclei, Metasploit, and virtual patch context

Explore the KEV Intelligence Feed

Filter known exploited vulnerabilities by evidence confidence, CISA status, sensor activity, recency, vendor, and available artifacts.

All KEVs 2,750 Beyond CISA 1,080 Observed 83 High confidence With artifacts 1,728+

Sensors only Reset

Displaying vulnerabilities 101 - 125 of 151 in total

Query the complete API

ID	Product / Vendor	Confidence	CISA KEV	Sensors	Added	Artifacts
CVE-2025-55182	react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel Meta	Confirmed	In catalog	Observed	3 months ago	PoC Nuclei
CVE-2025-61882	Oracle Concurrent Processing Oracle Corporation	Confirmed	In catalog	Observed	3 months ago	PoC Nuclei
CVE-2025-20281	Cisco Identity Services Engine Software Cisco	Confirmed	In catalog	Observed	3 months ago	PoC Nuclei
CVE-2025-5777	ADC, Gateway NetScaler	Confirmed	In catalog	Observed	3 months ago	PoC Nuclei
CVE-2024-12987	Vigor2960, Vigor300B DrayTek	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2025-31324	SAP NetWeaver (Visual Composer development server) SAP_SE	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2019-19824	Realtek SDK based routers TOTOLINK	Confirmed	Not listed	Observed	over 1 year ago	PoC Nuclei
CVE-2016-10372	D1000 modem Eir	Confirmed	Not listed	Observed	over 1 year ago	PoC
CVE-2023-26801	BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300 LB-LINK	Confirmed	Not listed	Observed	over 1 year ago	—
CVE-2024-3721	DVR-4104, DVR-4216 TBK	Confirmed	Not listed	Observed	over 1 year ago	—
CVE-2024-22024	ICS, IPS Ivanti, Ivant	Confirmed	Not listed	Observed	over 1 year ago	PoC Nuclei
CVE-2018-20062	NoneCms NoneCms	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2021-20016	SonicWall SMA100 SonicWall	Confirmed	In catalog	Observed	over 1 year ago	—
CVE-2020-6287	SAP NetWeaver AS JAVA (LM Configuration Wizard) SAP SE	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei VPatch
CVE-2020-14883	WebLogic Server Oracle Corporation	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei VPatch
CVE-2020-14882	WebLogic Server Oracle Corporation	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei VPatch
CVE-2020-1147	Microsoft SharePoint Enterprise Server, Microsoft SharePoint Server, Microsoft Visual Studio 2019, Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5), Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), .NET Core, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation), Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows Server 2016, Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation), Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems, Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systems, Microsoft .NET Framework 4.8 on Windows RT 8.1, Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Microsoft .NET Framework 4.8 on Windows Server 2012, Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation), Microsoft .NET Framework 4.8 on Windows Server 2012 R2, Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1909 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server, version 1803 (Server Core Installation), Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems, Microsoft .NET Framework 4.6, Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 2004 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for ARM64-based Systems Microsoft	Confirmed	In catalog	Observed	over 1 year ago	PoC
CVE-2018-13379	Fortinet FortiOS, FortiProxy Fortinet	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2020-5902	BIG-IP F5	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2017-9822	DotNetNuke CMS Fixed in 9.1.1 DotNetNuke	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2019-13608	StoreFront Server Citrix	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2020-3452	Cisco Adaptive Security Appliance (ASA) Software Cisco	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2021-41773	Apache HTTP Server Apache Software Foundation	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2017-9805	Apache Struts Apache Software Foundation	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei
CVE-2020-17463	FUEL CMS daylightstudio	Confirmed	In catalog	Observed	over 1 year ago	PoC Nuclei

CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Oracle Concurrent Processing

Oracle Corporation

Confirmed

CISA: In catalog
Sensors: Observed
Added: 3 months ago
Artifacts: PoC Nuclei

CVE-2025-20281

Cisco Identity Services Engine Software

Cisco

Confirmed

CISA: In catalog
Sensors: Observed
Added: 3 months ago
Artifacts: PoC Nuclei

CVE-2025-5777

ADC, Gateway

NetScaler

Confirmed

CISA: In catalog
Sensors: Observed
Added: 3 months ago
Artifacts: PoC Nuclei

CVE-2024-12987

Vigor2960, Vigor300B

DrayTek

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2025-31324

SAP NetWeaver (Visual Composer development server)

SAP_SE

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2019-19824

Realtek SDK based routers

TOTOLINK

Confirmed

CISA: Not listed
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2016-10372

D1000 modem

Eir

Confirmed

CISA: Not listed
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC

CVE-2023-26801

BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300

LB-LINK

Confirmed

CISA: Not listed
Sensors: Observed
Added: over 1 year ago
Artifacts: —

CVE-2024-3721

DVR-4104, DVR-4216

TBK

Confirmed

CISA: Not listed
Sensors: Observed
Added: over 1 year ago
Artifacts: —

CVE-2024-22024

ICS, IPS

Ivanti, Ivant

Confirmed

CISA: Not listed
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2018-20062

NoneCms

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2021-20016

SonicWall SMA100

SonicWall

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: —

CVE-2020-6287

SAP NetWeaver AS JAVA (LM Configuration Wizard)

SAP SE

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei VPatch

CVE-2020-14883

WebLogic Server

Oracle Corporation

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei VPatch

CVE-2020-14882

WebLogic Server

Oracle Corporation

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei VPatch

CVE-2020-1147

Microsoft SharePoint Enterprise Server, Microsoft SharePoint Server, Microsoft Visual Studio 2019, Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5), Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), .NET Core, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation), Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows Server 2016, Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation), Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems, Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systems, Microsoft .NET Framework 4.8 on Windows RT 8.1, Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1, Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Microsoft .NET Framework 4.8 on Windows Server 2012, Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation), Microsoft .NET Framework 4.8 on Windows Server 2012 R2, Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1909 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server, version 1803 (Server Core Installation), Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems, Microsoft .NET Framework 4.6, Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 2004 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for ARM64-based Systems

Microsoft

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC

CVE-2018-13379

Fortinet FortiOS, FortiProxy

Fortinet

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2020-5902

BIG-IP

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2017-9822

DotNetNuke CMS Fixed in 9.1.1

DotNetNuke

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2019-13608

StoreFront Server

Citrix

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2020-3452

Cisco Adaptive Security Appliance (ASA) Software

Cisco

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2021-41773

Apache HTTP Server

Apache Software Foundation

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2017-9805

Apache Struts

Apache Software Foundation

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2020-17463

FUEL CMS

daylightstudio

Confirmed

CISA: In catalog
Sensors: Observed
Added: over 1 year ago
Artifacts: PoC Nuclei

What Are Known Exploited Vulnerabilities?

Known exploited vulnerabilities are CVEs with credible evidence of real-world exploitation. They help security teams move beyond severity-only prioritization and focus remediation on vulnerabilities attackers are actually using.

For a deeper definition, see What Is a Known Exploited Vulnerability?.

Sensor-Led Early Warning

KEV Intelligence uses proprietary sensors and private honeypots to observe exploitation attempts, corroborates those signals with vendor advisories and relevant public evidence, and keeps CISA KEV status as context.

Compare with CISA KEV →

Evidence You Can Act On

Each warning can include confidence, evidence links, exploitation status, EPSS, CVSS, CWE, proof-of-concept references, scanner templates, and sensor telemetry where available.

Read the methodology →

Consume the Data in Your Workflow

Browse the live feed, subscribe via RSS, pull the free JSON feed, or use the Pro API for deeper evidence, available telemetry summaries, virtual patches, and integration-ready delivery.

RSS feed JSON feed API integrations

Known Exploited Vulnerability Feed FAQ

How KEV Intelligence observes, validates, and delivers early exploitation warnings.

What is a known exploited vulnerability?

A known exploited vulnerability is a CVE with credible evidence that attackers have exploited it in real-world conditions, rather than a vulnerability assessed only through theoretical severity. See also What Is a Known Exploited Vulnerability?.

How does KEV Intelligence differ from the CISA KEV Catalog?

CISA KEV is the baseline. KEV Intelligence complements it with proprietary sensor and honeypot observations, then corroborates warnings with vendor advisories and relevant public evidence — with confidence and inspectable provenance attached. Browse known exploited vulnerabilities not in CISA KEV or compare with CISA KEV.

What does observed in sensors mean?

It means KEV Intelligence honeypots recorded activity associated with exploitation attempts for that vulnerability. Sensor observations complement, rather than replace, the wider evidence and confidence model. Explore live telemetry on Exploitation Signals.

Can teams consume the feed through RSS or an API?

Yes. KEV Intelligence provides a free RSS feed, a free JSON feed, and a Pro API for deeper evidence, available telemetry, and integration-oriented workflows. See API & Integrations and API docs.

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.