The exploitability map of the known-exploited record.
Every vulnerability here is already being exploited in the wild. We break the 1,612-record CISA KEV catalog out by what it actually lets an attacker do — ransomware association, the attack surface it opens, the weakness behind it, and who it targets — and every number traces to a named public source you can open yourself.
Type to search the full corpus, or click any vendor or CWE below to filter it.
The exploitability funnel
— this catalog is the narrow end alreadyBasis · CISA KEV (exploited-in-wild + ransomware flag) and FIRST EPSS (modeled probability). Every record on this site has already cleared the top bar.
325 of 1,612 KEV records carry CISA's known-ransomware-campaign flag.
Source · CISA KEV74 of 233 edge-infra records (32%) — the front-door class ransomware crews favor.
Source · CISA KEVNew known-exploited entries since 2026-03-07 — the freshness signal, rebuilt daily from the public feeds.
Source · CISA KEVWhat’s being targeted
— attack surface the known-exploited record opensBasis · heuristic mapping of the NVD/feed vendor & product strings to attack surface. Toggle overlays the 325 ransomware-flagged records.
Weakness class
— how the flaw is reachedBasis · NVD CWE mapping (1,441 of 1,612 records carry a CWE).
Top weaknesses
— click a count to filterBasis · NVD CWE mapping. Each CWE links to its MITRE definition. Bar length is √-scaled for readability; counts are exact.
Most-exploited vendors
— click to filterBasis · affected-vendor field from the public feed. Bar length is √-scaled for readability; counts are exact.
The evidence behind the record
— researchers & vendors citedRecords crediting each advisory/research source. The universal feeds — NVD, CVE.org, CISA KEV, FIRST EPSS — back every record and are the shared backbone.
Who’s doing the work
— find it, catalog it, credit itThree different jobs sit behind every known-exploited CVE — who found the bug, who assigned the CVE (the CNA), and who gets credited. The public record documents them very unevenly, and that gap is itself a finding.
1,476 of 1,612 CVE records ship with no machine-readable credit. Who found them is simply not recorded.
136 records carry named credits — concentrated in a small set of offensive-research and threat-intel teams.
415 assigned by an independent CNA (MITRE, VulnCheck, ZDI, HackerOne, GitHub, CERTs) rather than the affected vendor.
Who finds the exploited bugs
— credited research teamsBasis · the credits field in the public CVE.org record (roles: 127 finder · 42 unspecified · 23 remediation developer · 16 reporter · 14 coordinator · 4 analyst). Sparse by nature — most entries name no one.
Who catalogs them
— CNA assignerBasis · CVE.org assigner (CNA). 3rd-party = assigned by an independent CNA (MITRE, VulnCheck, ZDI, HackerOne, GitHub, CERTs), not the affected vendor. Bar length √-scaled; counts exact.
Recently added to KEV
— newest known-exploitedHighest exploit risk
— top EPSS probabilityKEV additions by year
— red = ransomware-associated shareBasis · CISA KEV date-added field. Bar height = entries added that year; red segment = ransomware-flagged share.
Featured analysis
— the attacker→business story, in full1,612 of 1,612 records now carry the five-narrative breakdown — what an attacker does at each step (front door → keys → lateral → data → lights out) and the business consequence, written by an audited, injection-guarded LLM pass over the public evidence, with the deterministic facts and citations untouched. Here are the highest-stakes ones.