Actively exploited vulnerabilities — CISA KEV

The Known Exploited Vulnerabilities catalog is maintained by the US Cybersecurity and Infrastructure Security Agency and updated as exploitation is confirmed. Being listed raises the priority of a fix; not being listed is never read as safe. Patcharo reads the feed at every synchronisation, keeps the due date and the ransomware flag exactly as CISA publishes them, and shows them next to the vendor's fixed releases so that the two questions, is it exploited and which release fixes it, are answered together.