← all corpora

cisa-kev

backlog row · status withdrawn · domain SEC (Security and vulnerabilities) · lane A · refresh daily · tags US · ADVISORIES · VULNERABILITIES · SECURITY · KEV

What an agent uses it for

an agent triaging findings queries this for whether a CVE is known-exploited in the wild, with ransomware-use and due-date fields

Withdrawn
Merged into cisa. Use that corpus.

Sources and pins

sourcepinlicencesizereview note
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json recipe?curated pack CC0 1.0: VERIFIED verbatim from the licence file the catalog page links (Akamai-gated for non-browser clients): "The KEV database is distributed under the Creative Commons 0 1.0 License." Mirror xerj-org/corpus-cisa-kev @1c09ebebd1e9: 1,734 per-CVE files (catalogVersion 2026.10.04), raw feed kept in source/ for verification; canonical CC0 text + provenance in LICENSE.

0 B across 0 files. Added n/a.

People behind this corpus

Curated by

The hub maintainers maintain this registry entry; its sources are not GitHub repositories with an owner to credit, so the original publishers are the ones listed under Sources and pins.

XERJ Corpus Hub maintainers@xerj-org · curator

All contributors.

Rights

?. See per-source review blocks. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.

Retrieval spot-check (G7)

4.0/5 relevant. Graded .

Q: log4j log4shell what remediation does CISA require
expect: corpus-cisa-kev/kev/CVE-2021-44228.txt
top-5: corpus-cisa-kev/kev/CVE-2021-44228.txt / corpus-cisa-kev/kev/CVE-2023-43208.txt / corpus-cisa-kev/LICENSE / corpus-cisa-kev/kev/CVE-2022-0185.txt / corpus-cisa-kev/kev/CVE-2023-33107.txt
grade: pass
Q: citrixbleed netscaler mitigation required action
expect: corpus-cisa-kev/kev/CVE-2023-4966.txt
top-5: corpus-cisa-kev/kev/CVE-2026-88771.txt / corpus-cisa-kev/kev/CVE-2026-19490.txt / corpus-cisa-kev/kev/CVE-2026-88772.txt / corpus-cisa-kev/kev/CVE-2026-8452.txt / corpus-cisa-kev/kev/CVE-2026-88779.txt
grade: miss
Q: zerologon what is the vulnerability
expect: corpus-cisa-kev/kev/CVE-2020-1472.txt
top-5: corpus-cisa-kev/kev/CVE-2020-1472.txt / corpus-cisa-kev/kev/CVE-2023-43208.txt / corpus-cisa-kev/README.md:38 / corpus-cisa-kev/kev/CVE-2020-28949.txt / corpus-cisa-kev/LICENSE
grade: pass
Q: confluence OGNL RCE 2022 what should agencies do
expect: corpus-cisa-kev/kev/CVE-2022-26134.txt
top-5: corpus-cisa-kev/kev/CVE-2022-26134.txt / corpus-cisa-kev/kev/CVE-2021-44228.txt / corpus-cisa-kev/kev/CVE-2023-43208.txt / corpus-cisa-kev/LICENSE / corpus-cisa-kev/kev/CVE-2025-20362.txt
grade: pass
Q: newest Citrix NetScaler memory buffer denial of service
expect: corpus-cisa-kev/kev/CVE-2026-88779.txt
top-5: corpus-cisa-kev/kev/CVE-2026-88779.txt / corpus-cisa-kev/kev/CVE-2026-8452.txt / corpus-cisa-kev/kev/CVE-2026-88772.txt / corpus-cisa-kev/kev/CVE-2026-19490.txt / corpus-cisa-kev/kev/CVE-2026-88771.txt
grade: pass

Agent score

From structured reviews that AI agents send after they use this corpus: through xerj hub pull, MCP queries, or the xerj_corpus_feedback tool. Each review rates usefulness 1–5, whether the answer was found, and freshness. This is not the human hub star count shown above. The two are never mixed.

Loading agent reviews…

Score = Bayesian mean of usefulness (prior 3.0 with weight 5), so a few reviews cannot swing it. One voice per installation per corpus per week; abnormal-volume reviewers are dropped. Coverage gaps appear only once 3 or more agents report the same one. How it works.

Traffic

Traffic stats load from /api/hub-traffic when this page runs JavaScript.

Views: visits to this page (search-engine crawlers excluded). Unique: distinct visitors per day, by a hash salted with the day, so the 14-day unique figure adds up daily uniques. Pulls: growth of the GitHub release download count of this corpus’s pack (xerj hub pull downloads from there; includes our own pack-verification downloads). Searches: hosted-hub queries for this corpus. Referring sites appear after 3 views. What is collected.

Agent usage

Usage stats load from /api/hub-usage when this page runs JavaScript.

Counted: requests agents send to the hosted hub API (hub.xerj.org/api/v1/code, /def) for this corpus. Queries on your own node (xerj code, xerj ask with a local pack, the MCP tools) never leave your machine and are not counted. Templates replace identifiers, versions, paths, numbers and quoted text with placeholders; one is shown only once it has been seen 3 times in 30 days, and any word asked fewer than 3 times shows as <term>. Raw queries are never published. What is collected.