CISA KEV Patch Queue
CISA KEV ranked by ransomware use, due date and live EPSS. Patch the top first.
Loading the newest KEV additions
Fetching the queue from the pwnsy data API and the full catalog from CISA.
Across: date added to CISA KEV. Up: priority score. Size: EPSS. Data: CISA KEV, FIRST.
Background readingThe KEV catalogEPSSVulnerability management
Pasted text stays here; only CVE IDs go to FIRST and package names to OSV.
Due dates in view (tap to filter)
KEV added per month
Nothing checked yet
Paste scanner output or a list of CVE IDs above, or try a sample. Each ID is matched against the KEV catalog with its EPSS score and a patch priority.
No lockfile checked yet
Malicious packages (OpenSSF MAL- records) go to the top with remove-and-rotate advice. Each vulnerable dependency gets one action: upgrade inside the same release line, a breaking upgrade, or a patch because no fixed release exists. KEV and EPSS are added where the advisory has a CVE. Packages with install scripts are listed below the findings.
How the patch queue works
Score out of 100: 35 for known ransomware use, 30 when the CISA due date has passed (25 at 0 to 3 days, 15 at 4 to 7), plus EPSS times 35.
The 20 newest come from the pwnsy data API; the full catalog loads from CISA, with EPSS from FIRST.
How to read the result
P1 is 60 or more, P2 35 or more, P3 the rest. EPSS ranks urgency inside KEV; Due is CISA's federal deadline, a floor for everyone else.
Not in KEV, EPSS high marks a CVE at 10% EPSS or more that CISA has not listed yet.
FAQ
How is the priority score calculated?
35 for ransomware use, up to 30 for the due date, plus EPSS times 35. 60 or more is P1, 35 or more is P2, the rest P3.
Where does the data come from?
The pwnsy data API (newest 20, monthly counts), CISA's kev-data repository, FIRST for EPSS, and the CVE record service when you open a row.
What does the bulk CVE checker send anywhere?
Only the CVE IDs (up to 100), to FIRST for EPSS and to the CVE record service. The last text is kept in this browser; Escape clears it.
Is the CISA due date my deadline?
It binds US federal civilian agencies (BOD 22-01, and BOD 26-04 for entries since June 2026). For everyone else it is a floor.
What do the Newest 20, 30 days and 90 days windows show?
Newest 20 is the latest additions. Once the full catalog loads, 30 and 90 days show every entry added in that period, with EPSS.
What are the surveillance and VPN collections?
KEV slices for cameras, recorders and footage NAS, and for SSL VPN and VPN-capable firewalls, also on their own pages: Camera CVE Watch and VPN Appliance CVE Watch.
Sources: pwnsy data API, CISA KEV (cisagov/kev-data), FIRST EPSS, cve.org.