Security intelligence, with context.
Response snapshot Oct 26, 2026, 20:02 UTC
An evidence-first reading desk
Understand the vulnerability. Check the evidence. See what deserves a closer look.
KEVWire / Security intelligence
95 matching records
Configure your stack. No technologies are selected.
Tag-based possible relevance, not a scanner or complete asset inventory. Review marks are a local reading checklist, not proof of a fix.
AI systems acting on their own. AI used by attackers. Flaws in and attacks on AI systems. Defensive research.
A chronological reading list. Attribution stays qualified: an affected AI product is not evidence of an AI-assisted attack, and an AI system's own action is not an outside attack. Scope is only as broad as the source states.
Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.
Catalog snapshot: Oct 23, 2026. 1756 catalog records.
| Month | Additions |
|---|---|
| 2021-11 | 291 |
| 2021-12 | 20 |
| 2022-01 | 40 |
| 2022-02 | 32 |
| 2022-03 | 226 |
| 2022-04 | 45 |
| 2022-05 | 83 |
| 2022-06 | 48 |
| 2022-07 | 3 |
| 2022-08 | 23 |
| 2022-09 | 24 |
| 2022-10 | 12 |
| 2022-11 | 10 |
| 2022-12 | 9 |
| 2023-01 | 5 |
| 2023-02 | 14 |
| 2023-03 | 18 |
| 2023-04 | 17 |
| 2023-05 | 19 |
| 2023-06 | 24 |
| 2023-07 | 16 |
| 2023-08 | 8 |
| 2023-09 | 19 |
| 2023-10 | 18 |
| 2023-11 | 18 |
| 2023-12 | 11 |
| 2024-01 | 21 |
| 2024-02 | 9 |
| 2024-03 | 10 |
| 2024-04 | 10 |
| 2024-05 | 14 |
| 2024-06 | 9 |
| 2024-07 | 14 |
| 2024-08 | 19 |
| 2024-09 | 25 |
| 2024-10 | 17 |
| 2024-11 | 22 |
| 2024-12 | 16 |
| 2025-01 | 14 |
| 2025-02 | 27 |
| 2025-03 | 32 |
| 2025-04 | 15 |
| 2025-05 | 24 |
| 2025-06 | 20 |
| 2025-07 | 20 |
| 2025-08 | 15 |
| 2025-09 | 16 |
| 2025-10 | 31 |
| 2025-11 | 11 |
| 2025-12 | 20 |
| 2026-01 | 17 |
| 2026-02 | 28 |
| 2026-03 | 26 |
| 2026-04 | 31 |
| 2026-05 | 21 |
| 2026-06 | 23 |
| 2026-07 | 26 |
| 2026-08 | 31 |
| 2026-09 | 43 |
| 2026-10 | 26 |
380,000 euros in damage to around 170 victims. That was the figure the Rotterdam Cybercrime Team faced in the three weeks that the investigation team had seen on the servers of a criminal collaboration. Die crim ...
Summary In two evaluations, an internal model tasked to retrieve figures from a public research dashboard accessed the organization’s internal systems and changed their configuration. In the first evaluation, it used exposed credentials to ...
Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally, Microsoft said on Wedne ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month. Laun ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fa ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
The police have arrested two suspects in an investigation into a new form of bankhelpdesk fraud. In doing so, scammers have dumped around 170 victims for a total of 380,000 euros. Dutch banks in the middle of September ...
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have use ...
AI system acted on its ownReported attributionThe source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog .
AI used by attackersSource-confirmedThe source describes people using AI to carry out or assist harmful activity. Disclosed by Microsoft Security blog, the organization that runs or studies the system.
Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents ...
In 1964, Lyndon B. Johnson’s campaign ran a terrifying 60-second advertisement. It opens with a three-year-old girl in a field, pulling petals off a daisy while counting to ten. Then, a man’s voice begins a countdown, and a nuclear explosio ... (report_number: 8180)
Sen. Cathy Kipp, a Fort Collins Democrat, speaks on the Colorado Senate floor about a bill to ask voters for more public education funding on April 24, 2026. (Screenshot from Colorado Channel YouTube) The Colorado secretary of state’s offi ... (report_number: 8190)
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
The Dembo campaign alleges a Trump-linked PAC used improper AI to create an attack ad in Kentucky. The attack ad failed to disclose its use of AI, which violates specific requirements under Kentucky law. Campaign organizers will ask the N ... (report_number: 8189)
AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday. The Indian Computer Emergency Response Team (CERT-In) said ...
AI system acted on its ownReported attributionThe source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Senate Republicans released an online ad this week in which a real-looking but fake version of a Democratic candidate, fabricated with artificial intelligence, appears to speak directly into the camera for more than a minute. The National ... (report_number: 8178)
AI system acted on its ownReported attributionThe source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Personal assistant, or secret saboteur? A man claims that his Muse AI agent gave out his address to strangers and even sent them to his home, after letting the brand-new model handle his Facebook Marketplace account. The complaint comes fr ...
Artificial intelligence ("AI") is rapidly reshaping legal practice. Lawyers are increasingly using AI tools for drafting, research assistance, document review, summarisation and litigation preparation. As adoption grows, South African court ...
CERT-In Advisory CIAD-2026-0049 AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets Original Issue Date: October 15, 2026 Severity Rating: Cri ...
The Democrat filed a police complaint against the Republican incumbent, saying state law bans deceptive video so close to the election. Patrick’s camp said they were obvious parodies. State Rep. Vikki Goodwin, D-Austin, and Democratic cand ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented. This was after the ...
An unusual case of domestic violence has drawn the attention of authorities to the misuse of new technologies in intimidation crimes. A man was arrested by the Civil Police of Goiás (PCGO) after using intelligence tools Art ...
WASHINGTON, Oct 19 (Reuters) - Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere (DE.N), home applia ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
More than 20 exposed Cairn panels give an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems. 01 TL;DR An investigation by ...
AI used by attackersReported attributionThe source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
BRASELTON, Ga. --- A woman accusing the Braselton police chief of stalking her was denied a protective order against him before his arrest. Channel 2 Action News reported last week when Michael Steffman, retired and resigned from his posit ...
Braselton, Jackson County, GA (November 19, 2025) -- The GBI has arrested and charged Braselton Police Department Chief Michael Steffman, age 49, of Braselton, GA, with Violation of Oath by Public Officer, Stalking, Harassing Communications ...
1–25 of 95 matching records
Missing records are not an all-clear. Read the coverage and methodology.
23 current, 2 cached; each source has a bounded scope.
editorial · 19 retained records
Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.
A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.
Last successful retrieval: Not yet recorded.
live · 1756 retained records
The full successfully validated KEV catalog, without a newest-record slice.
Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.
Last successful retrieval: Oct 26, 2026, 20:00 UTC.
Source documentationlive · 308 retained records
GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication.
Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.
Last successful retrieval: Oct 26, 2026, 20:01 UTC.
Source documentationlive · 32 retained records
Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor.
RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.
Last successful retrieval: Oct 26, 2026, 19:55 UTC.
Source documentationlive · 10 retained records
Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling.
The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.
Last successful retrieval: Oct 26, 2026, 19:35 UTC.
Source documentationlive · 47 retained records
At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications.
Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.
Last successful retrieval: Oct 26, 2026, 19:35 UTC.
Source documentationlive · 5944 retained records
Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval.
Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.
Last successful retrieval: Oct 26, 2026, 20:01 UTC.
Source documentationunavailable · 0 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Not yet recorded.
Public source returned an error. (HTTP 403)
Source documentationlive · 30 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 20:00 UTC.
Source documentationlive · 6 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationcached · 1 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 19:45 UTC.
Public source redirect limit exceeded.
Source documentationcached · 1 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 14:15 UTC.
Syndication returned no eligible validated records; HTTP success was not ingestion success.
Source documentationlive · 3 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationlive · 3 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationlive · 5 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationlive · 0 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationlive · 0 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
Source documentationlive · 121 retained records
Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one.
HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.
Last successful retrieval: Oct 26, 2026, 19:25 UTC.
Source documentationlive · 5 retained records
Breach and incident reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 19:55 UTC.
Source documentationlive · 8 retained records
Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Oct 26, 2026, 19:55 UTC.
Source documentationlive · 1 retained records
Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Oct 26, 2026, 19:26 UTC.
Source documentationlive · 61 retained records
OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Oct 26, 2026, 19:55 UTC.
Source documentationlive · 1 retained records
Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Oct 26, 2026, 19:25 UTC.
Source documentationlive · 4 retained records
Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed.
The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.
Last successful retrieval: Oct 26, 2026, 19:50 UTC.
1 malformed upstream records were excluded.
Source documentationlive · 49 retained records
Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English.
Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.
Last successful retrieval: Oct 26, 2026, 19:51 UTC.
Source documentationlive · 7750 retained records
Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters.
Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.
Last successful retrieval: Oct 26, 2026, 19:41 UTC.
Source documentationlive · 175 retained records
At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling.
Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.
Last successful retrieval: Oct 26, 2026, 20:01 UTC.
1 targeted CNA requests failed. Public source returned an error. (HTTP 404)
Source documentationHow to read the wire
Data feeds are polled periodically. A successful HTTP request is not, on its own, a successful ingestion. Each source reports its accepted records, scope, and retrieval state.
Editorial selections and reporting are separate from live feeds. Editorial describes how a record was assembled, not whether every claim is independently confirmed.
Primary documents and reporting are labeled separately. AI classifications need an exact supporting source. Reported attribution remains reported; not assessed does not mean ruled out.
An AI-stack flaw is an issue in an AI product. It does not establish attacker AI use or global AI-driven causation.
CVSS is base severity. EPSS is a dated model estimate of CVE exploitation in the following 30 days. Missing measurements stay unavailable, and incident or research records are not scored CVEs.
KEV means known exploitation, not necessarily a zero-day. CISA deadlines apply to covered US federal agencies, not the reader's SLA.
No scanning, verified exposure, complete asset inventory, or remediation certification. Stack matches use explicit technology tags. Local review marks only record that you chose to review an item.
This source corpus is not worldwide incident frequency. Unknown publication dates and AI involvement remain unknown.
Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.
Catalog snapshot: Oct 23, 2026. 1756 catalog records.
| Month | Additions |
|---|---|
| 2021-11 | 291 |
| 2021-12 | 20 |
| 2022-01 | 40 |
| 2022-02 | 32 |
| 2022-03 | 226 |
| 2022-04 | 45 |
| 2022-05 | 83 |
| 2022-06 | 48 |
| 2022-07 | 3 |
| 2022-08 | 23 |
| 2022-09 | 24 |
| 2022-10 | 12 |
| 2022-11 | 10 |
| 2022-12 | 9 |
| 2023-01 | 5 |
| 2023-02 | 14 |
| 2023-03 | 18 |
| 2023-04 | 17 |
| 2023-05 | 19 |
| 2023-06 | 24 |
| 2023-07 | 16 |
| 2023-08 | 8 |
| 2023-09 | 19 |
| 2023-10 | 18 |
| 2023-11 | 18 |
| 2023-12 | 11 |
| 2024-01 | 21 |
| 2024-02 | 9 |
| 2024-03 | 10 |
| 2024-04 | 10 |
| 2024-05 | 14 |
| 2024-06 | 9 |
| 2024-07 | 14 |
| 2024-08 | 19 |
| 2024-09 | 25 |
| 2024-10 | 17 |
| 2024-11 | 22 |
| 2024-12 | 16 |
| 2025-01 | 14 |
| 2025-02 | 27 |
| 2025-03 | 32 |
| 2025-04 | 15 |
| 2025-05 | 24 |
| 2025-06 | 20 |
| 2025-07 | 20 |
| 2025-08 | 15 |
| 2025-09 | 16 |
| 2025-10 | 31 |
| 2025-11 | 11 |
| 2025-12 | 20 |
| 2026-01 | 17 |
| 2026-02 | 28 |
| 2026-03 | 26 |
| 2026-04 | 31 |
| 2026-05 | 21 |
| 2026-06 | 23 |
| 2026-07 | 26 |
| 2026-08 | 31 |
| 2026-09 | 43 |
| 2026-10 | 26 |
Built to be read by software, too
Everything on this site is available to agents and scripts, read-only and without a key. Records keep their exact source URLs and measurement dates, so an agent can cite the evidence rather than this site.
/mcpsearch_vulnerabilities, get_record, recent_exploited, list_technologies, list_sources.Add KEVWire to an MCP client (Claude, ChatGPT, Cursor, VS Code, and others) with:
{"mcpServers": {"kevwire": {"type": "http", "url": "/mcp"}}}Please describe coverage honestly: this is a bounded source corpus, not every attack. Known exploitation and CISA KEV membership are different facts, and federal due dates are not an organization's SLA.
Feeds and exports follow the current filters. Exported review IDs are user-supplied reading marks, not verified remediation.