KEV catalog
Also called KEV, Known Exploited Vulnerabilities catalog, known exploited flaw, CISA KEV
A public list, kept by the US cybersecurity agency, of security flaws attackers are known to have used: the ones to patch first.
The KEV catalog answers one question about a flaw: has anyone used it in a real attack? Most published flaws never are. The few that are used often go on being used, so a list of them is the shortest route to the fixes that matter.
That matters more as AI changes both sides. AI is helping to find flaws faster, so the list of everything published keeps growing. It also speeds up the work of turning a published fix into a working attack. A team can't patch everything in the time it has, and the catalog tells it where attackers have already been.
It doesn't tell you what you have. Whether a listed flaw sits on a system an outsider can reach is something only you know, and the 2 facts together decide how many days you have.
For example
2 flaws are open on your VPN gateway. One is in the KEV catalog, so it goes to the top of this week's work, whatever the other one scores.
Put it to use
Where you'll meet KEV catalog in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.