The exploitability map of the known-exploited record.
Every vulnerability here is already being exploited in the wild. We break the 1,612-record CISA KEV catalog out by what it actually lets an attacker do — ransomware association, the attack surface it opens, the weakness behind it, and who it targets — and every number traces to a named public source you can open yourself.
Type to search the full corpus, or click any vendor or CWE below to filter it.
The exploitability funnel
— this catalog is the narrow end alreadyBasis · CISA KEV (exploited-in-wild + ransomware flag) and FIRST EPSS (modeled probability). Every record on this site has already cleared the top bar.
325 of 1,612 KEV records carry CISA's known-ransomware-campaign flag.
Source · CISA KEV74 of 233 edge-infra records (32%) — the front-door class ransomware crews favor.
Source · CISA KEVNew known-exploited entries since 2026-03-07 — the freshness signal, rebuilt daily from the public feeds.
Source · CISA KEVFrom disclosure to decision — the attack-path view
— the sequence is what turns “patch this” into “fund this”One bug, walked end to end. A single known-exploited flaw, taken from the open internet to a ransom note — same facts told twice, once in the language of the adversary, once in the language of the board. Every step is cited on the record it links to.
Front door — unauthenticated access narrative 1
Keys to the kingdom — identity takeover narrative 2
Data at risk — exfiltration narrative 4
Lights out — disruption & extortion narrative 5
How far do they get?
— how many of the 1,612 known-exploited records reach each stageNamed adversary on the path: 1 of 1,612. The rest map the sequence from the flaw’s mechanism, not a named crew — shown, not hidden. Attacker→business framing present for 1,612 of 1,612 (100%).
Basis · reach across the five-narrative framing (audited, injection-guarded LLM pass over cited public evidence) — counts exact, the mapping is a model output; the ransomware overlay is the deterministic CISA flag. A record reaches more than one stage, so bars don’t sum to 1,612.
Where the path ends
— the deepest outcome each record reaches (counted once)Basis · furthest supported narrative per record. Almost everything clears the front door; 208 of 1,612 carry an attacker all the way to data-at-risk or lights-out — that tail is the fund-this signal.
What’s being targeted
— attack surface the known-exploited record opensBasis · heuristic mapping of the NVD/feed vendor & product strings to attack surface. Toggle overlays the 325 ransomware-flagged records.
Where the paths cluster
— attack surface × how far the path goesBasis · heuristic surface mapping × furthest narrative per record (triage). Each row is a surface; columns are the five outcomes; darker = more records. Click a surface to filter the corpus. Read the edge concentration as directional, not unit-precise.
Weakness class
— how the flaw is reachedBasis · NVD CWE mapping (1,441 of 1,612 records carry a CWE).
Top weaknesses
— click a count to filterBasis · NVD CWE mapping. Each CWE links to its MITRE definition. Bar length is √-scaled for readability; counts are exact.
Most-exploited vendors
— click to filterBasis · affected-vendor field from the public feed. Bar length is √-scaled for readability; counts are exact.
The evidence behind the record
— researchers & vendors citedRecords crediting each advisory/research source. The universal feeds — NVD, CVE.org, CISA KEV, FIRST EPSS — back every record and are the shared backbone.
Fund the fix here
— products whose known-exploited flaws most often reach data-at-risk or lights-outBasis · affected-vendor field × records whose path reaches narrative ≥ 4 (data-at-risk / lights-out). 208 of 1,612 records reach that depth; this ranks where they concentrate.
Who’s doing the work
— find it, catalog it, credit itThree different jobs sit behind every known-exploited CVE — who found the bug, who assigned the CVE (the CNA), and who gets credited. The public record documents them very unevenly, and that gap is itself a finding.
1,476 of 1,612 CVE records ship with no machine-readable credit. Who found them is simply not recorded.
136 records carry named credits — concentrated in a small set of offensive-research and threat-intel teams.
415 assigned by an independent CNA (MITRE, VulnCheck, ZDI, HackerOne, GitHub, CERTs) rather than the affected vendor.
Who finds the exploited bugs
— credited research teamsBasis · the credits field in the public CVE.org record (roles: 127 finder · 42 unspecified · 23 remediation developer · 16 reporter · 14 coordinator · 4 analyst). Sparse by nature — most entries name no one.
Who catalogs them
— CNA assignerBasis · CVE.org assigner (CNA). 3rd-party = assigned by an independent CNA (MITRE, VulnCheck, ZDI, HackerOne, GitHub, CERTs), not the affected vendor. Bar length √-scaled; counts exact.
Recently added to KEV
— newest known-exploitedHighest exploit risk
— top EPSS probabilityKEV additions by year
— red = ransomware-associated shareBasis · CISA KEV date-added field. Bar height = entries added that year; red segment = ransomware-flagged share.
Are the paths getting deeper?
— share of each year’s additions reaching data-at-risk or beyondBasis · KEV date-added × furthest narrative (triage). Label = deep / total for the year; shaded segment = the deep share. Read as directional: narrative depth is a model output, so a year-over-year trend conflates real escalation with triage recency — stated, not hidden.
From narrative to technique
— named where the record names itWhere a public source names the MITRE ATT&CK technique, the path stops being abstract. Sourced on 1 of 1,612 records today — an empty map is an unfilled record, never “not happening.” Coverage grows as named threat-actor reporting is folded in.
Featured analysis
— the attacker→business story, in full1,612 of 1,612 records now carry the five-narrative breakdown — what an attacker does at each step (front door → keys → lateral → data → lights out) and the business consequence, written by an audited, injection-guarded LLM pass over the public evidence, with the deterministic facts and citations untouched. Here are the highest-stakes ones.