◆ IOC feeds

CISA Known Exploited Vulnerabilities

CC0-1.0

CISA's catalogue of CVEs confirmed exploited in the wild, the list US federal agencies must patch against — git history gives it a change log the official page lacks.

source ↗ ★ 114 last push 2026-09-10

Summary

This repository is home to the data files that make up the Known Exploited Vulnerabilities (KEV) catalog. The data is originally sourced from which is short linked at

from the project README

Formats: jsoncsv
License: CC0-1.0
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ curl -LO https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json
```
The CSV sits beside it as known_exploited_vulnerabilities.csv. The repository mirrors cisa.gov/kev within minutes.

11 files 2.8 MB repository

.md 5
.json 2
.csv 1
.html 1
(no ext) 1
.yml 1

Use it with

Commands are curated, not yet run by us.

jq — Stream the records one per line to see their shape before loading them anywhere.

sample.json

$ jq -c . sample.json

DuckDB — Query the file in place with SQL — DuckDB detects CSV and JSON by extension.