KEV scorecard
CISA, ENISA, Shadowserver, KEVintel, Previdian, CIRCL and the press side by side: how big each catalog is, what only it lists, and who lists a CVE first.
Catalogs
| Catalog | CVEs | Only here | Not in CISA | Added 90 days | Listed before CISA | Median vs CISA |
|---|---|---|---|---|---|---|
| CISA KEV Exploitation confirmed by CISA | 1,748 | 0 | - | 101 | - | reference |
| ENISA EU KEV Exploitation reported by EU CSIRTs | 65 | 5 | 9 | 30 | 11 of 39 (28%) | same day |
| Shadowserver Exploitation attempts seen by honeypots | 1,258 | 16 | 929 | 55 | 79 of 213 (37%) | 4 days later |
| KEVintel Exploitation reported publicly | 2,759 | 189 | 1,086 | 86 | 40 of 1,673 (2%) | same day |
| Previdian Exploitation reported publicly | 243 | 134 | 169 | 240 | 29 of 74 (39%) | same day |
| CIRCL CIRCL incident response, sinkholes, partners | 29 | 1 | 4 | 12 | 2 of 21 (9%) | 1 day later |
| Press (news.mlab.sh) Security news reporting exploitation | 182 | 57 | 80 | 182 | 9 of 27 (33%) | same day |
Overlap
CVEs listed by both the row and the column catalog. The darker the cell, the larger the share of the row catalog it covers.
| CISA KEV | ENISA EU KEV | Shadowserver | KEVintel | Previdian | CIRCL | Press (news.mlab.sh) | |
|---|---|---|---|---|---|---|---|
| CISA KEV | 1,748 | 56 | 329 | 1,673 | 74 | 25 | 102 |
| ENISA EU KEV | 56 | 65 | 16 | 42 | 17 | 9 | 23 |
| Shadowserver | 329 | 16 | 1,258 | 1,219 | 23 | 8 | 24 |
| KEVintel | 1,673 | 42 | 1,219 | 2,759 | 0 | 20 | 68 |
| Previdian | 74 | 17 | 23 | 0 | 243 | 8 | 55 |
| CIRCL | 25 | 9 | 8 | 20 | 8 | 29 | 14 |
| Press (news.mlab.sh) | 102 | 23 | 24 | 68 | 55 | 14 | 182 |
How to read it: a catalog's date is when it first listed the CVE. "Listed before CISA" and the median only use CVEs CISA added after that catalog's first entry, so a catalog that started recently is not penalised for CISA's older entries. Shadowserver counts exploitation attempts against its honeypots, not confirmed compromises. KEVintel dates go back to the first public report of exploitation, which is often years before CISA existed. Press is our own news.mlab.sh coverage, collected since 2026-09-23, so its totals are not comparable over years. Catalogs other than CISA and Press come from CIRCL Vulnerability-Lookup. Updated 2026-10-17 05:59 UTC.