Early exploitation intelligence

Known Exploited Vulnerabilities Feed

Browse early exploitation warnings with confidence scoring, proprietary sensor telemetry where available, CISA KEV status, and practical detection artifacts for vulnerability management, CTI, SOC, and MSSP workflows.

Browse feed RSS feed JSON API

Total KEVs: 2,750; Known exploited vulnerabilities tracked by KEV Intelligence
Beyond CISA KEV: 1,079; Additional exploited CVEs beyond the official catalog
Observed in Sensors: 82; Tracked KEVs with sensor activity in the last 7 days
Artifacts Available: 1,728+; PoC, Nuclei, Metasploit, and virtual patch context

Explore the KEV Intelligence Feed

Filter known exploited vulnerabilities by evidence confidence, CISA status, sensor activity, recency, vendor, and available artifacts.

All KEVs 2,750 Beyond CISA 1,079 Observed 82 High confidence With artifacts 1,728+

Sensors only Reset

Displaying vulnerabilities 2451 - 2475 of 2750 in total

Query the complete API

ID	Product / Vendor	Confidence	CISA KEV	Sensors	Added	Artifacts
CVE-2024-41713	MiCollab Mitel	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei Nessus
CVE-2024-55550	MiCollab Mitel	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei Nessus
CVE-2020-2883	WebLogic Server Oracle Corporation	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei Nessus
CVE-2025-0282	Connect Secure, Policy Secure, Neurons for ZTA gateways Ivanti	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei Nessus
CVE-2024-12686	Remote Support(RS) & Privileged Remote Access(PRA) BeyondTrust	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2023-48365	Sense Enterprise for Windows Qlik	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2024-55591	FortiOS, FortiProxy Fortinet	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei Nessus
CVE-2025-21333	Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation) Microsoft	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2025-21334	Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation) Microsoft	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2025-21335	Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation) Microsoft	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2024-50603	Controller Aviatrix	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei
CVE-2020-11023	jQuery jquery	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2025-23006	SMA1000 SonicWall	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2025-24085	iOS and iPadOS, iPadOS, macOS, tvOS, visionOS, watchOS Apple	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2024-45195	Apache OFBiz Apache Software Foundation	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei
CVE-2024-29059	Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 AND 4.6/4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Microsoft	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei
CVE-2018-9276	PRTG Network Monitor Paessler AG	Confirmed	In catalog	—	over 1 year ago	PoC
CVE-2018-19410	PRTG Network Monitor Paessler	Confirmed	In catalog	—	over 1 year ago	PoC Nuclei
CVE-2024-53104	Linux Linux	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2025-0411	7-Zip 7-Zip	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2022-23748	Audinate Dante Application Library for Windows Apple	Confirmed	In catalog	—	over 1 year ago	—
CVE-2024-21413	Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021 Microsoft	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2020-29574	Cyberoam OS Sophos	Confirmed	In catalog	—	over 1 year ago	Nessus
CVE-2020-15069	XG Firewall Sophos	Confirmed	In catalog	—	over 1 year ago	—
CVE-2025-0994	Cityworks, Cityworks (with office companion) Trimble	Confirmed	In catalog	—	over 1 year ago	—

CVE-2024-41713

MiCollab

Mitel

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei Nessus

CVE-2024-55550

MiCollab

Mitel

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei Nessus

CVE-2020-2883

WebLogic Server

Oracle Corporation

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei Nessus

CVE-2025-0282

Connect Secure, Policy Secure, Neurons for ZTA gateways

Ivanti

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei Nessus

CVE-2024-12686

Remote Support(RS) & Privileged Remote Access(PRA)

BeyondTrust

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2023-48365

Sense Enterprise for Windows

Qlik

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2024-55591

FortiOS, FortiProxy

Fortinet

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei Nessus

CVE-2025-21333

Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)

Microsoft

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2025-21334

Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)

Microsoft

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2025-21335

Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)

Microsoft

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2024-50603

Controller

Aviatrix

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2020-11023

jQuery

jquery

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2025-23006

SMA1000

SonicWall

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2025-24085

iOS and iPadOS, iPadOS, macOS, tvOS, visionOS, watchOS

Apple

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2024-45195

Apache OFBiz

Apache Software Foundation

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2024-29059

Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 AND 4.6/4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1

Microsoft

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2018-9276

PRTG Network Monitor

Paessler AG

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC

CVE-2018-19410

PRTG Network Monitor

Paessler

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: PoC Nuclei

CVE-2024-53104

Linux

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2025-0411

7-Zip

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2022-23748

Audinate Dante Application Library for Windows

Apple

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: —

CVE-2024-21413

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021

Microsoft

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2020-29574

Cyberoam OS

Sophos

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: Nessus

CVE-2020-15069

XG Firewall

Sophos

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: —

CVE-2025-0994

Cityworks, Cityworks (with office companion)

Trimble

Confirmed

CISA: In catalog
Sensors: —
Added: over 1 year ago
Artifacts: —

What Are Known Exploited Vulnerabilities?

Known exploited vulnerabilities are CVEs with credible evidence of real-world exploitation. They help security teams move beyond severity-only prioritization and focus remediation on vulnerabilities attackers are actually using.

For a deeper definition, see What Is a Known Exploited Vulnerability?.

Sensor-Led Early Warning

KEV Intelligence uses proprietary sensors and private honeypots to observe exploitation attempts, corroborates those signals with vendor advisories and relevant public evidence, and keeps CISA KEV status as context.

Compare with CISA KEV →

Evidence You Can Act On

Each warning can include confidence, evidence links, exploitation status, EPSS, CVSS, CWE, proof-of-concept references, scanner templates, and sensor telemetry where available.

Read the methodology →

Consume the Data in Your Workflow

Browse the live feed, subscribe via RSS, pull the free JSON feed, or use the Pro API for deeper evidence, available telemetry summaries, virtual patches, and integration-ready delivery.

RSS feed JSON feed API integrations

Known Exploited Vulnerability Feed FAQ

How KEV Intelligence observes, validates, and delivers early exploitation warnings.

What is a known exploited vulnerability?

A known exploited vulnerability is a CVE with credible evidence that attackers have exploited it in real-world conditions, rather than a vulnerability assessed only through theoretical severity. See also What Is a Known Exploited Vulnerability?.

How does KEV Intelligence differ from the CISA KEV Catalog?

CISA KEV is the baseline. KEV Intelligence complements it with proprietary sensor and honeypot observations, then corroborates warnings with vendor advisories and relevant public evidence — with confidence and inspectable provenance attached. Browse known exploited vulnerabilities not in CISA KEV or compare with CISA KEV.

What does observed in sensors mean?

It means KEV Intelligence honeypots recorded activity associated with exploitation attempts for that vulnerability. Sensor observations complement, rather than replace, the wider evidence and confidence model. Explore live telemetry on Exploitation Signals.

Can teams consume the feed through RSS or an API?

Yes. KEV Intelligence provides a free RSS feed, a free JSON feed, and a Pro API for deeper evidence, available telemetry, and integration-oriented workflows. See API & Integrations and API docs.

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.