Skip to content
Teach AI ToolsCYBER AI TERMINALBlog ↗
CISA KEV SNAPSHOT

1,766 catalog entries · Latest additions dated 2026-10-30 · Fetched 2026-10-31 03:54 UTC

Scope & source ↗
← Platforms

Evidence & threat data

Real provenance, defined populations and explicit gaps. The former simulated attack/CVE display is replaced by a dated CISA catalog snapshot.

CISA Known Exploited Vulnerabilities

All entries in the downloaded CISA Known Exploited Vulnerabilities catalog, not all CVEs or current attacks.

1,766entries in this snapshot
2added on 2026-10-30
Last successful fetch
2026-10-31T03:54:28.266Z (UTC)
Catalog version
2026.10.30
Catalog release
2026-10-30T17:02:45.3665Z
Refresh model
Static snapshot captured during publication; no automatic refresh claimed

Dated snapshot; not a live attack feed. No “active CVEs”, global critical count, 24-hour addition count or average CVSS is inferred from this feed. CISA dateAdded is a calendar date.

Open the current CISA catalog ↗Original JSON feed ↗Download this snapshot ↗

Most recent catalog additions

These are actual entries in the downloaded catalog, not sample CVE identifiers. A KEV entry indicates known exploitation; it does not establish that your environment is vulnerable. CISA remediation due dates apply according to the relevant directive and organization scope, not universally to every reader.

CVE-2026-118527 ↗

Ivanti / Connect Secure — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Added 2026-10-30 · CISA due date 2026-11-13

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-111357 ↗

Ivanti / Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Added 2026-10-30 · CISA due date 2026-11-02

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Comparison methodology and evidence limits

  1. Selection: 26 existing platform entries, grouped by overlapping use cases. The directory is an editorial shortlist, not an exhaustive market survey.
  2. Source review: official vendor product and pricing pages reviewed October 31, 2026. Descriptions report advertised scope, not independently tested effectiveness. Sources and dates appear in each brief.
  3. Benchmarks: unsourced detection speed, false-positive rate, zero-day coverage, overhead and recovery numbers are removed. No replacement score or objective ranking is calculated.
  4. MITRE: MITRE states its evaluations do not rank vendors. Compare original results within the tested scenario, product configuration and round; a vendor participation claim is not a general performance guarantee.
  5. Pricing: published amounts identify plan, billing unit, source and review date. Annual and monthly figures are distinct. Quotes, licensed services, data volume, retention and regional eligibility can change costs.
  6. Threat data: the statistics above are computed from the downloaded CISA KEV JSON. The full NVD CVE population and CVSS distributions are different datasets; NVD’s API documentation defines its data. No fabricated live feed is used.
  7. Human review: test false positives, response overrides, rollback/recovery and sensitive data access with your own systems. Agentic security claims do not establish permission for unrestricted automatic action.
Editorial standards ↗

Microsoft Sentinel billing clarification

Microsoft documents free data sources including Azure Activity Logs, Sentinel Health, Office 365 audit logs and specified security alerts. It also states that some raw Defender, Entra ID and related data types are paid, and connected Azure services can incur charges. “Office 365 and Azure ingestion is free” is not a general rule.

Microsoft’s free-data-source and billing documentation ↗