Archive of older KEV entries
Vulnerabilities that left the recent list keep their page. 21 pages are kept here by the month CISA added them to KEV. Entries CISA still lists are refreshed on every collection.
Build snapshot collected · KEV catalog 2026.10.21 · EPSS of 21 Oct 2026 · not a live feed: collected once, at build time
Months
Questions
What is in the archive?
Pages of vulnerabilities that were once on the recent list and then left it. The recent list covers about 90 days of CISA KEV additions; the pages of older entries are kept, never deleted, so that links to them keep working.
Does an archived page show current data?
For an entry that CISA still lists, the collector refreshes EPSS, published CVSS and dates on every run. An entry marked "Archived record" is no longer in the KEV catalog: its page keeps what was published when it was last seen, with that date, and may be out of date.
How is the archive organised?
By the month in which CISA added the entry to the KEV catalog. Each month has one page listing its entries, newest first, and each entry has its own page.
Related sections
- WatchlistWhat attackers started using this month, most urgent first.
- Exploited catalogEvery flaw CISA lists as used in real attacks (KEV), searchable.
- CVE lookupType one identifier: attack status, probability, severity, versions.
- Attack probabilityEPSS score for up to 100 identifiers at once.
- VendorsWhich vendors have the most exploited flaws.
- RSS and JSON feedsFollow new exploited flaws for the vendors you run.
- Sources and methodWhere each number comes from and how the order is decided.