cisa-kev:global
Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.
1756 records in the last complete source scope · Current verified scope
Generation identity
2026-10-24T10:27:30.8908525+00:00
Security coverage
Source scope, completed generations and read health are separate evidence. A recent successful poll does not by itself establish a complete catalog.
Public advisory archives
Enabledcve-program
Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records
413884 records in the last complete source scope · Current verified scope
Generation identity
cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-c6a8234687801ee57ab2aeb77d20947f334a6cc2941ea8b25213d5a7dcebf0ce
first-epss:nuget
FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.
1093 records in the last complete source scope · Current verified scope
Generation identity
2026-10-24T10:27:30.8908525+00:00
osv:NuGet
Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only
1965 records in the last complete source scope · Current verified scope
Generation identity
nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2
Microsoft operations context
7677 retained CVE/release rows and 390 Microsoft KEV entries. These release and selected-vendor populations have different scope from the global CVE Program catalog.
Microsoft releases, fixing KBs and known issues · All source health · NuGet assessment
Exact package matching currently supports NuGet. Other vendor and ecosystem ranges are retained as source evidence and are not guessed by a generic version comparer. CVE Program records can exist without package-version evidence; an OSV archive does not cover every possible vulnerability. Withdrawals, rejection and missing records remain distinct.