CISA KEV exploit-priority ranking (monthly)

License unclearFresh

Sample onlyDownload sample CSV Download sample JSONSample rows only (up to 20) — not the complete dataset.

Monthly exploit-priority ranking of every vulnerability in CISA's Known Exploited Vulnerabilities (KEV) catalog. The full KEV feed (cveID, vendor/product, dateAdded, dueDate, ransomware-campaign flag, required action) is joined with the FIRST EPSS daily exploit-probability CSV on CVE id, deduplicated and validated on cveID, with vendor names whitespace-normalized through a deterministic alias map (raw value kept for audit). Each row carries days since added, days to due (negative = overdue), an EPSS tier, and a documented 0-100 priority_score = 100*(0.40*EPSS percentile + 0.25*due-date urgency + 0.20*recency + 0.15*ransomware flag), ranked as exploit_rank. Month-granular as-of stamping makes same-month re-runs hash-identical; the EPSS score_date is recorded per row so the daily vintage is auditable. Columns: snapshot month, fetch timestamp, CVE id, canonical + raw vendor, product, vulnerability name, description, CWE ids, dates, day counts, overdue/ransomware flags, forensic triage, required action, notes, KEV catalog version + provenance URLs, EPSS score/percentile/date/tier, priority score/tier/rank. Primary key: (snapshot_month, cve_id). Cadence: monthly; each snapshot is the full KEV catalog joined with that day's EPSS scores, ranked for remediation triage. Nullability: epss/epss_percentile/epss_tier are null when a KEV CVE is absent from the EPSS CSV (epss_missing=1; contributes 0 to the score — rare, only very fresh catalog additions); nothing else is null. Caveats: priority_score is a triage heuristic, not a risk quantification; EPSS estimates 30-day exploitation probability, not observed exploitation; KEV vendor names are CISA-curated. KEV catalog is US federal government work (public domain); EPSS scores are published free of charge by the FIRST EPSS SIG with no registration — no explicit redistribution license is stated, so commercial_use = unclear with per-source attribution. Sample use: order by exploit_rank for the vulnerabilities to patch first, or filter priority_tier = 'p1'.

Source: CISA KEV exploit-priority intelligence (agent-curated)
Rows: 1,723
Columns: 30
Source cadence: Monthly
Last refreshed: Sep 25, 2026
Theme: technology

Column	Type	Description
snapshot_month	string	ISO calendar month of the fetch (YYYY-MM); the logical snapshot identity together with cve_id. (unit: ISO month)
fetched_at	string	Fetch timestamp, month-granular: the first of snapshot_month at 00:00 UTC. Same-month re-runs produce identical snapshots; a new month always yields a new content-hashed snapshot. (unit: ISO datetime)
cve_id	string	Canonical CVE identifier, uppercased (CVE-YYYY-NNNNN); the primary row identity. Malformed ids are dropped, never repaired. (unit: id)
vendor_canonical	string	Vendor/project name with whitespace collapsed and the deterministic alias map applied. CISA-curated strings, not a full vendor taxonomy. (unit: name)
vendor_raw	string	CISA vendorProject string verbatim (trimmed only), kept so the canonical mapping stays auditable. (unit: name)
product	string	Affected product(s) as named by CISA; whitespace-collapsed. 'Multiple Products' marks multi-product advisories. (unit: name)
vulnerability_name	string	CISA's short vulnerability name; emails stripped. (unit: text)
short_description	string	CISA's plain-language description of the vulnerability and its impact; emails stripped. US federal government work (public domain). (unit: text)
cwes	string	Comma-joined CWE identifiers from the KEV entry (e.g. CWE-79,CWE-89); empty when CISA lists none. (unit: ids)
date_added	string	Date CISA added the CVE to the KEV catalog (YYYY-MM-DD). (unit: ISO date)
due_date	string	CISA BOD 22-01 remediation due date (YYYY-MM-DD). (unit: ISO date)
days_since_added	integer	Whole days from date_added to the as-of month start; the recency factor of the priority score. Floored at 0. (unit: days)
days_to_due	integer	Whole days from the as-of month start to due_date; negative means the remediation deadline already passed. (unit: days)
overdue_flag	integer	1 when days_to_due is negative (past the CISA remediation deadline), else 0. (unit: flag)
ransomware_flag	integer	1 when CISA flags knownRansomwareCampaignUse = 'Known', else 0. (unit: flag)
forensic_triage	string	CISA's forensic-triage guidance value (Yes/No) as published in the catalog. (unit: flag)
required_action	string	CISA's required remediation action (verbatim, whitespace-collapsed); public domain US federal work. (unit: text)
notes	string	CISA's free-text notes, typically vendor advisory URLs separated by ' ; '; whitespace-collapsed, emails stripped. (unit: text)
kev_catalog_version	string	KEV catalog version string from the feed (e.g. 2026.09.24); identifies the upstream vintage. (unit: version)
kev_date_released	string	Feed release timestamp from the KEV JSON metadata. (unit: ISO datetime)
kev_source_url	string	Exact source URL of the KEV feed behind every row; per-row provenance. (unit: url)
epss	float	EPSS exploit-probability score (0-1): the model's estimated probability the CVE is exploited in the wild in the next 30 days. Null when the CVE is absent from the EPSS CSV (epss_missing=1). Published free of charge by the FIRST EPSS SIG. (unit: probability)
epss_percentile	float	EPSS percentile rank (0-1): proportion of all scored CVEs with the same score or lower. The percentile (not the raw score) feeds priority_score. (unit: proportion)
epss_date	string	score_date from the EPSS CSV header: the daily vintage behind epss/epss_percentile, so every score is auditable. (unit: ISO datetime)
epss_tier	string	Coarse EPSS band: critical (>= 0.9), high (>= 0.7), medium (>= 0.5), low (below), unknown when EPSS is missing. (unit: category)
epss_missing	integer	1 when the KEV CVE was absent from the EPSS CSV (very fresh catalog additions); contributes 0 to priority_score. (unit: flag)
epss_source_url	string	Exact source URL of the EPSS daily CSV behind the enrichment; per-row provenance. (unit: url)
priority_score	float	Remediation-triage score, 0-100: 100(0.40EPSS percentile + 0.25due-date urgency + 0.20recency + 0.15*ransomware flag). A triage heuristic for ordering patches — not a quantified risk measure. (unit: score)
priority_tier	string	priority_score buckets: p1 (>= 75), p2 (>= 50), p3 (>= 25), p4 (below). (unit: category)
exploit_rank	integer	Rank by priority_score descending (1 = patch first); ties broken by epss descending (missing last), then cve_id. (unit: rank)

First 10 sample rows — a preview, not the complete dataset.

snapshot_month	fetched_at	cve_id	vendor_canonical	vendor_raw	product	vulnerability_name	short_description	cwes	date_added	due_date	days_since_added	days_to_due	overdue_flag	ransomware_flag	forensic_triage	required_action	notes	kev_catalog_version	kev_date_released	kev_source_url	epss	epss_percentile	epss_date	epss_tier	epss_source_url	priority_score	priority_tier	exploit_rank
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-20316	Cisco	Cisco	Secure Firewall Management Center (FMC)	Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability	Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.	CWE-259	2026-07-29	2026-08-01	34	-31	1	1	No	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20316	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.351	0.984	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	97.58	p1	1
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-63077	JetBrains	JetBrains	TeamCity	JetBrains TeamCity Deserialization of Untrusted Data Vulnerability	JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.	CWE-502	2026-08-05	2026-08-08	27	-24	1	1	Yes	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/; https://www.jetbrains.com/privacy-security/issues-fixed/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63077	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.098	0.954	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	96.72	p1	2
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-12569	PTC	PTC	Windchill and FlexPLM	PTC Windchill and FlexPLM Improper Input Validation Vulnerability	PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.	CWE-20,CWE-502	2026-06-25	2026-06-28	68	-65	1	1	No	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://www.ptc.com/en/support/article/CS473270 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-12569	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.46	0.988	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	96.11	p1	3
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-15410	SonicWall	SonicWall	SMA1000 Appliances	SonicWall SMA1000 Appliances Code Injection Vulnerability	SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.	CWE-94	2026-07-14	2026-07-17	49	-46	1	1	Yes	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15410	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.118	0.959	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	95.86	p1	4
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-0257	Palo Alto Networks	Palo Alto Networks	PAN-OS	Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.	CWE-565	2026-05-29	2026-06-01	95	-92	1	1	No	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.969	0.999	2026-09-24T12:00:20Z	critical	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	95.37	p1	5
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-15409	SonicWall	SonicWall	SMA1000 Appliances	SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability	SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.	CWE-918	2026-07-14	2026-07-17	49	-46	1	1	Yes	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.068	0.938	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	94.99	p1	6
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-41940	WebPros	WebPros	cPanel & WHM and WP2 (WordPress Squared)	WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability	WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.	CWE-306	2026-04-30	2026-05-03	124	-121	1	1	No	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.985	0.999	2026-09-24T12:00:20Z	critical	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	94.21	p1	7
2026-09	2026-09-01T00:00:00+00:00	CVE-2026-35273	Oracle	Oracle	PeopleSoft Enterprise PeopleTools	Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability	Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.	CWE-306	2026-06-12	2026-06-15	81	-78	1	1	No	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	https://www.oracle.com/security-alerts/alert-cve-2026-35273.html ; https://support.oracle.com/signin/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-35273	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.094	0.952	2026-09-24T12:00:20Z	low	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	94.12	p1	8
2026-09	2026-09-01T00:00:00+00:00	CVE-2024-1708	ConnectWise	ConnectWise	ScreenConnect	ConnectWise ScreenConnect Path Traversal Vulnerability	ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.	CWE-22	2026-04-28	2026-05-12	126	-112	1	1	No	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	0.954	0.999	2026-09-24T12:00:20Z	critical	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	94.11	p1	9
2026-09	2026-09-01T00:00:00+00:00	CVE-2024-27199	JetBrains	JetBrains	TeamCity	JetBrains TeamCity Relative Path Traversal Vulnerability	JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.	CWE-23	2026-04-20	2026-05-04	134	-120	1	1	No	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	https://www.jetbrains.com/privacy-security/issues-fixed/ ; https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27199	2026.09.24	2026-09-24T19:00:55.0481Z	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json	1	1	2026-09-24T12:00:20Z	critical	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz	93.85	p1	10

Profiled Sep 25, 2026 from snapshot 20260925T055636Z-97be826fdeeb

Measured

Completeness: 100%
Rows: 1,723
Columns: 30
Columns with gaps: 0

Column	Missing	Distinct	Range	Distribution
snapshot_monthvarchar	0%	1	—	2026-091,723
fetched_atvarchar	0%	1	—	2026-09-01T00:00:00+00:001,723
cve_idvarchar	0%	2,182	—	CVE-2002-03671 CVE-2004-02101 CVE-2004-14641
vendor_canonicalvarchar	0%	313	—	Microsoft388 Cisco99 Apple94
vendor_rawvarchar	0%	313	—	Microsoft388 Cisco99 Apple94
productvarchar	0%	681	—	Windows174 Multiple Products83 Chromium V841
vulnerability_namevarchar	0%	1,129	—	Microsoft Win32k Privilege Escalation Vulnerability23 Google Chromium V8 Type Confusion Vulnerability20 Apple Multiple Products Memory Corruption Vulnerability11
short_descriptionvarchar	0%	1,789	—	Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit h9 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.6 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any 5
cwesvarchar	0%	307	—	175 CWE-7895 CWE-2092
date_addedvarchar	0%	457	—	2021-11-03287 2022-03-0395 2022-03-2566
due_datevarchar	0%	589	—	2022-05-03189 2021-11-1798 2022-03-2468
days_since_addedbigint	0%	508	0 → 1,763median 1,358
days_to_duebigint	0%	492	-1,749 → 26median -1,337	18 outside 1st–99th percentile
overdue_flagbigint	0%	2	0 → 1median 1
ransomware_flagbigint	0%	2	0 → 1median 0
forensic_triagevarchar	0%	2	—	No1,658 Yes65
required_actionvarchar	0%	45	—	Apply updates per vendor instructions.893 Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use o323 Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.260
notesvarchar	0%	2,277	—	Apply mitigations per vendor instructions. Absent mitigating instructions from the vendor, discontinue use of the produc1 CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: htt1 CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457 ; Additional References: 1
kev_catalog_versionvarchar	0%	1	—	2026.09.241,723
kev_date_releasedvarchar	0%	1	—	2026-09-24T19:00:55.0481Z1,723
kev_source_urlvarchar	0%	1	—	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json1,723
epssdouble	0%	1,500	0.0023 → 1median 0.4887	18 outside 1st–99th percentile
epss_percentiledouble	0%	1,098	0.1262 → 1median 0.9884	36 outside 1st–99th percentile
epss_datevarchar	0%	1	—	2026-09-24T12:00:20Z1,723
epss_tiervarchar	0%	4	—	low874 critical459 high259
epss_missingbigint	0%	1	0 → 0median 0
epss_source_urlvarchar	0%	1	—	https://epss.empiricalsecurity.com/epss_scores-current.csv.gz1,723
priority_scoredouble	0%	1,056	33.21 → 97.58median 65.49	36 outside 1st–99th percentile
priority_tiervarchar	0%	3	—	p21,216 p1465 p342
exploit_rankbigint	0%	1,981	1 → 1,723median 862	36 outside 1st–99th percentile

Point any LLM at the metadata endpoint — the documentation above is machine-readable too (JSON-LD + Croissant).

cURL

curl "https://datazimuts.com/v1/datasets/kev_priority_signals/kev_exploit_priority_monthly" | jq '{title, rows, columns_count, license}'

Python

import requests

ds = requests.get("https://datazimuts.com/v1/datasets/kev_priority_signals/kev_exploit_priority_monthly").json()
print(ds["title"], ds["rows"], "rows")

# Sample rows for an LLM context window
for row in ds.get("sample_rows", [])[:5]:
    print(row)

API endpoint: https://datazimuts.com/v1/datasets/kev_priority_signals/kev_exploit_priority_monthly

Tip: fetch /llms.txt for the full machine-readable catalog.

Cite this snapshot

Pinned to snapshot 20260925T055636Z-97be826fdeeb and its content hash, so readers get exactly the data you used.

APA

CISA KEV exploit-priority intelligence (agent-curated). (2026). CISA KEV exploit-priority ranking (monthly) [Data set, snapshot 20260925T055636Z-97be826fdeeb, sha256 97be826fdeeb]. Datazimuts. Retrieved 2026-09-25, from https://datazimuts.com/en/datasets/kev_priority_signals/kev_exploit_priority_monthly?snapshot=20260925T055636Z-97be826fdeeb

BibTeX

@misc{dz_kev_priority_signals_kev_exploit_priorit_97be826f,
  title        = {{CISA KEV exploit-priority ranking (monthly)}},
  author       = {{CISA KEV exploit-priority intelligence (agent-curated)}},
  year         = {2026},
  publisher    = {Datazimuts},
  howpublished = {\url{https://datazimuts.com/en/datasets/kev_priority_signals/kev_exploit_priority_monthly?snapshot=20260925T055636Z-97be826fdeeb}},
  note         = {Snapshot 20260925T055636Z-97be826fdeeb, sha256 97be826fdeebeb2f9769a7695c371a373779c0c6d067b929a4c90f4685977209; accessed 2026-09-25}
}

Embed a table or a chart

Paste this into any page. The embed is pinned to the same snapshot, follows the reader's light or dark setting, and always shows the source, license and a link back.

Type

X axis

Value

Aggregate

Theme

HTML

<iframe src="https://datazimuts.com/embed/chart?dataset=kev_priority_signals%2Fkev_exploit_priority_monthly&lang=en&theme=auto&snapshot=20260925T055636Z-97be826fdeeb&x=date_added&y=days_since_added&agg=avg" title="CISA KEV exploit-priority ranking (monthly)" width="100%" height="380" style="border:0" loading="lazy"></iframe>

CISA KEV exploit-priority ranking (monthly)

Follow this dataset

Cite this snapshot

Embed a table or a chart

Use your own AI key