KEV tracking · exploitation reports in Tia's coverage, against the CISA KEV catalog

KEV tracking

Every CVE that Tia's reporting has claimed is being exploited — when we first reported it, when the exploitation report landed, and when CISA added it to the KEV (if it has). CVEs merely mentioned in patch records are excluded. Deterministic: a join of the story store, the exploitation flags, the NVD publish dates, and the kevrichment KEV index.

Subscribe to this list via RSS

No CVEs match.

"All" shows every CVE with an observed-exploitation report from Tia's coverage, on the KEV or not. "Pure candidates" = not on the KEV catalog yet. CVEs with only a "suspected" flag (public PoC / exploit code, no observed exploitation) are excluded, as are patch-record mentions. "First exploit report" = the earliest event claiming observed exploitation; it is a reporting date, not the true first exploitation. "Exploit → KEV" and the crossings stat are measured from CISA's catalog date (dateAdded); negative = CISA listed it before our exploitation reporting. Disclosed = NVD published date. Exploitation flags come from the deterministic backfill (source "backfill") or the hourly triage gate (source "triage").