Guide
CISA KEV explained: what the catalog is, what it is not, and how to use it
How CVEs get into CISA's Known Exploited Vulnerabilities catalog, what each field means, how due dates changed under BOD 26-04, and how to use the feed.
Analysis and guides
- Guide
EPSS vs CVSS vs KEV: which score answers which question
CVSS rates how bad a flaw could be, EPSS how likely exploitation is, KEV whether it is already used. How the three differ and how to combine them.
- Guide
Hunting on edge appliances: finding compromise on VPNs, firewalls and gateways
Edge appliances run no EDR and attackers tamper with their logs. How to hunt from the outside in, with six ready-to-adapt queries and a response checklist.
- Analysis
Why decade-old CVEs still land in KEV
15 of 289 KEV additions in 2026 were CVEs from 2016 or earlier. What drives them into the catalog now, and what it means for patch prioritisation.