Skip to content
feed: live
0dayNews
$ kev-catalogs --diff --since baseline

KEV change log

CISA updates entries in its Known Exploited Vulnerabilities catalog in place: ransomware flags flip, notes and due dates change, names get corrected. CISA's raw files are versioned in itskev-data GitHub mirror, but not as a readable list of what changed, and ENISA and CIRCL keep no public history at all. 0dayNews checks all three catalogs every hour and records every addition, removal and field change here, field by field.

changes JSON (90 days)API docscatalog comparison

Tracking since October 21, 2026. Last checked 2026-10-21 21:13 UTC.

Added
0
Edited in place
0
Removed
0
No changes recorded since tracking began. The first run records each catalog as it stands; only changes after that show up here.

Method: each hour the live CISA KEV JSON feed and the ENISA and CIRCL catalog APIs are compared field by field with the previous check. A fetch that drops more than 10% of a catalog at once is treated as a bad response and skipped rather than logged as removals. Entries already listed when tracking began have no observed-addition time. Free to reuse with credit to 0dayNews.