CISA KEV Patch Queue
Ranks the CISA Known Exploited Vulnerabilities catalog by ransomware use, due date and live EPSS, so security and IT teams see what to patch first, with a vendor exposure comparison and a bulk CVE checker.
The full catalog loads in your browser from CISA. Text you paste into the checker stays in this page; only the CVE IDs go to FIRST for EPSS.
Loading the newest KEV additions
Fetching the queue from the pwnsy data API and the full catalog from CISA.
Due dates in view (tap to filter)
KEV added per month
Nothing checked yet
Paste scanner output or a list of CVE IDs above, or try a sample. Each ID is matched against the KEV catalog with its EPSS score and a patch priority.
How the patch queue works
The queue starts with the 20 newest additions to the CISA Known Exploited Vulnerabilities (KEV) catalog from the pwnsy data API. Your browser then downloads the full catalog from CISA's kev-data repository, which unlocks the 30 and 90 day windows, the vendor comparison and the bulk checker, and fetches EPSS scores from FIRST for every entry in view.
Each entry gets a priority score out of 100:
- 35 points when CISA lists known ransomware use.
- 30 points when the CISA due date has passed, 25 when it is 0 to 3 days away, 15 when it is 4 to 7 days away.
- The EPSS probability multiplied by 35.
Opening a row loads the CVE record for CVSS, CWE and SSVC, then lists next steps built from those facts and the vendor advisory links CISA publishes.
How to read the result
- P1 (score 60 or more) usually means ransomware use plus a due date that has passed or a high EPSS. Patch these first. P2 is 35 or more, P3 is the rest.
- EPSS is the probability of exploitation activity in the next 30 days; the p number is its percentile across all scored CVEs. A KEV entry is already exploited, so EPSS ranks urgency inside the list.
- Due is CISA's federal deadline. Overdue entries are past it. Treat the date as a floor and confirm the fixed version with the vendor before you patch.
- In the checker, Not in KEV, EPSS high marks a CVE with an EPSS of 10% or more that CISA has not listed yet: a candidate for the watch list.
FAQ
How is the priority score calculated?
Each KEV entry gets up to 100 points: 35 if CISA lists known ransomware use, 30 if the CISA due date has passed (25 when it is 0 to 3 days away, 15 when it is 4 to 7 days away), plus the EPSS probability multiplied by 35. A score of 60 or more is P1, 35 or more is P2, and the rest are P3.
Where does the data come from?
The 20 newest KEV additions and the monthly counts come from the pwnsy data API. Your browser downloads the full catalog from CISA's kev-data repository on GitHub, EPSS scores from the FIRST API, and the CVSS, CWE and SSVC details from the CVE record service when you open a row.
What does the bulk CVE checker send anywhere?
It pulls up to 100 CVE IDs out of the text you paste and checks them against the KEV catalog already loaded in your browser. Only the CVE IDs are sent out, to FIRST for EPSS and to the CVE record service when you open a row. The last text you checked is kept in this browser so it is there next time, and Escape clears it.
Is the CISA due date my deadline?
The due dates are deadlines CISA sets for US federal civilian agencies under the binding operational directive cited in each entry (BOD 22-01, and BOD 26-04 for entries added since June 2026). For everyone else they work as a floor: confirm the fixed version in the vendor advisory and patch sooner when the system faces the internet.
What do the Newest 20, 30 days and 90 days windows show?
Newest 20 shows the latest additions from the pwnsy data API. Once the full catalog has loaded, 30 days and 90 days show every KEV entry added in that period and fetch an EPSS score for each one.
Sources: pwnsy data API, CISA KEV (cisagov/kev-data), FIRST EPSS, cve.org.