Why cross-reference five KEV catalogs?

Not every known exploited vulnerability appears in every catalog. CISA's KEV is the list most organizations track, but ENISA, CIRCL, Previdian, and VulnCheck each publish their own, built from different sources against different inclusion criteria. A CVE can be flagged as exploited in one catalog weeks before it reaches another — or never reach it at all. This page puts all five side by side, one row per CVE, so those gaps are visible at a glance.

The five catalogs

CISA KEV — the US federal catalog, and the one that sets binding remediation deadlines for federal civilian agencies.
ENISA EUVD — the EU Vulnerability Database's exploited list. This column counts only ENISA's own EU-specific findings, not the entries it mirrors from CISA.
CIRCL — the Luxembourg CSIRT's catalog, likewise filtered to its own original curation rather than the much larger set it mirrors from others.
Previdian (formerly KEVIntel) — a threat-intelligence-sourced catalog that frequently lists exploitation earliest.
VulnCheck KEV — the broadest of the five, with coverage reaching back to 1999 and often listing a CVE well before CISA does.

How to read the table

First Listed is the earliest date any included catalog added the CVE, and the bold date marks which catalog got there first. Days counts from the CVE's publication to that first listing; a negative value means a catalog flagged exploitation before the CVE record itself was published. Every ✓ links directly to that catalog's own page for the CVE, so each claim here is one click from its source. CVSS scores come from the official CVE Program record and EPSS from FIRST.org, shown with its percentile and recent trend.

Catalog data refreshes every three hours and EPSS once daily. Filter, sort, and column choices are encoded in the address bar, so any view you build can be shared as a link, and Export CSV writes exactly the rows currently showing.