CISA Known Exploited Vulnerabilities (KEV)

The US Cybersecurity and Infrastructure Security Agency's catalog of vulnerabilities known to be exploited in the wild, with the date each was added, the remediation due date and whether it has been used in ransomware campaigns.

Table: demo.security.cisa_kev
Source: CISA Known Exploited Vulnerabilities Catalog
Rows
Updated

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT cve_id, vendor_project, product, date_added, due_date, known_ransomware_campaign_use
  FROM demo.security.cisa_kev
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

Which vendors' vulnerabilities are used most in ransomware campaigns?

SELECT vendor_project, COUNT(*) AS cves
  FROM demo.security.cisa_kev
 WHERE known_ransomware_campaign_use = 'Known'
 GROUP BY vendor_project
 ORDER BY cves DESC, vendor_project
 LIMIT 10

Edit in Studio

What has been added to the catalog most recently?

SELECT cve_id, vendor_project, product, date_added, due_date
  FROM demo.security.cisa_kev
 ORDER BY date_added DESC, cve_id
 LIMIT 10

Edit in Studio

Which products appear in the catalog most often?

SELECT vendor_project, product, COUNT(*) AS cves
  FROM demo.security.cisa_kev
 GROUP BY vendor_project, product
 ORDER BY cves DESC, vendor_project, product
 LIMIT 10

Edit in Studio

Schema

Columns

Column	Type
cve_id	VARCHAR
vendor_project	VARCHAR
product	VARCHAR
vulnerability_name	VARCHAR
date_added	DATE
short_description	VARCHAR
required_action	VARCHAR
due_date	DATE
known_ransomware_campaign_use	VARCHAR
notes	VARCHAR
cwes	VARCHAR