CanaryObservatory
 
Infrastructure & cyber · Instrument dossier

Exploited Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog: software flaws with reliable evidence of active exploitation. Each observation is one flaw on the day CISA added it. A burst of newly confirmed exploited flaws means attackers are actively using more ways in, often against widely used products.

Current reading

0 newly confirmed exploited vulnerabilities in the last 24 hours, against an expected count of about 1.2.

Reading time:

Global (software, not places).

Collector availability
Live
Collection freshness
Last successful collection .

Historical comparison

Not enough data yet to draw a series in this range. History begins when collection begins.

Interpretation

The latest assessed reading is within the detector’s expected pattern. This does not establish that real-world conditions are safe.

What movement could mean
  • A wave of exploitation of widely used products
  • CISA clearing a backlog

Not established. KEV records confirmed exploitation after the fact; it is not a forecast. Source-reported severity, statistical deviation and real-world risk are different questions. This reading does not independently support a hypothesis about intent or cause.

Evidence and limitations

Cadence and latency
Collection is scheduled every 30 minutes. Collection cadence is not source latency; no measured end-to-end latency is provided here. Source publication and revisions can delay what is visible.
Known false-positive patterns
  • Batch additions of older flaws
  • Holiday gaps followed by catch-up
Coverage and blind spots
  • dateAdded is a day, not a time; additions are dated at noon UTC.
  • CISA adds in batches on working days, so weekends read as zero.
  • Inclusion reflects CISA's evidence threshold and US government focus, not every exploited flaw.
Technical detail
Measurement definition
Count of CVEs added to the KEV catalog per UTC day. Flaws CISA marks as used in ransomware carry that as the source severity.
Raw metric
daily_count_kev
Method
Every run reads the full KEV catalog and stores each flaw added in the last 120 days once, keyed by CVE ID and dated by CISA's dateAdded. The watched number is additions in the trailing 24 hours against at least 14 earlier days.
Stored observations
135

Normal versus unusual

Current
0
Expected (mean)
1.2
Std. deviation
1.5
z-score
-0.75

Trailing-24h count vs. mean/std of completed UTC days (std floored at √mean) · 32 samples · rolling-z/1.0 · computed

Source severity

The label the publishing agency assigns (e.g. NWS 'Severe'). Shown verbatim.

Statistical anomaly

How far today's value sits from this signal's own history. Says nothing about consequences.

Real-world risk

A judgment the observatory does not make. Consult official sources for safety decisions.

Observations in range

Recent collection runs

  • · success · 135 stored
  • · success · 135 stored
  • · success · 135 stored

How this works

Every 30 minutes we read CISA's public list of software flaws confirmed to be exploited by attackers. Each flaw is stored once, dated the day CISA added it.

The number we watch is flaws added in the last 24 hours. "Normal" is the daily pattern over the previous two weeks or more.

Limits: CISA works in batches on weekdays, and it lists only flaws it has evidence for. There is no map point because a flaw affects software everywhere.

FAQ

Does a spike mean I'm being hacked?
No. It means more flaws were confirmed as exploited somewhere. Check whether you use the listed products.