CVE / KEV
Definition
Common Vulnerabilities and Exposures (MITRE-assigned identifier per public flaw). Known Exploited Vulnerabilities catalogue (CISA), which lists CVEs proven to be actively exploited in the wild.
- CVE issuer
- MITRE
- KEV issuer
- CISA
- CVE scope
- Identifier per publicly disclosed flaw
- KEV scope
- CVEs confirmed exploited in the wild
Common questions
How is a KEV listing different from just having a high CVSS score?+
CVSS scores predicted severity based on the vulnerability's technical properties, while KEV listing is empirical evidence that real attackers have already used the flaw, which is why KEV entries typically carry mandatory patch deadlines for federal agencies.
Why would an investigator check the CVE identifier during an incident response?+
The CVE number lets the responder pull the vendor advisory, affected version range, and available patches quickly, and cross-checking it against the KEV catalogue shows whether the flaw is a known active threat rather than a theoretical one.
Related terms
- ARP Poisoning
- Sending forged ARP replies on a LAN to bind an attacker's MAC to a victim's IP in other hosts' ARP caches, redirecting...
- DDoS (Distributed Denial of Service)
- Service-denial attack sourced from many hosts at once. Volumetric (saturate bandwidth), protocol (exhaust state on stateful boxes), or application-layer (exhaust application resources).
- MITM (Man-in-the-Middle)
- Any attack in which the adversary sits between two endpoints and reads or modifies traffic. ARP poisoning, rogue access points, BGP hijacks...
- OWASP Top 10
- Open Worldwide Application Security Project's ranking of the most common web application security risks, refreshed every 3 to 4 years. Current edition:...
- Packet Sniffing
- Capture of network traffic from a wired tap, a switch SPAN port, or a Wi-Fi monitor-mode radio. Passive sniffing reads; active sniffing...