# How many vulnerabilities are in the CISA KEV catalog?

> **Short answer:** CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.

- URL: https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)
- Data: computed from CISA KEV catalog 2026.09.23 at build time (2026-10-20)

## Entries by year added

| Year added | Entries | Marked known ransomware use |
|---|---|---|
| 2021 | 311 | 84 |
| 2022 | 555 | 132 |
| 2023 | 187 | 43 |
| 2024 | 186 | 44 |
| 2025 | 245 | 31 |
| 2026 | 237 | 27 |
Table: KEV entries by year added, catalog 2026.09.23. 2026 is a partial year.

The catalog was created in November 2021; the first batch was added on November 3, 2021.

## Ransomware use

CISA marks each entry’s *knownRansomwareCampaignUse* field as “Known” or “Unknown”. 361 of 1,721 entries (21.0%) are marked “Known”.[^1] “Unknown” means CISA has not confirmed ransomware use, not that it has been ruled out.

## How these numbers are produced

Every figure on this page is computed from CISA’s KEV JSON feed[^1] when the site is built. The explanation around the numbers is verified by an editor; the numbers themselves change whenever CISA publishes a new catalog version.

## What this means for you

### Banks & credit unions

The catalog grows every month. A KEV remediation metric should count open entries that affect your assets, not the catalog’s total.

### Fintechs & payment firms

Use the additions in the last 30 days as your weekly review list: they are the entries most likely to be new to your environment.

### Developers & identity teams

The counts on this page are generated from CISA’s JSON feed at build time. Fetch the same feed to reproduce or monitor them.

## Follow-up questions

**How often does CISA add entries?**

Irregularly, often several times a week. The feed’s catalog version and release date show when it last changed.


## Sources

[^1]: Known Exploited Vulnerabilities catalog (JSON feed). CISA. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[^2]: Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Related questions

- [What is the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/)
- [Which vendors have the most CISA KEV entries?](https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/)
- [What does the due date in the CISA KEV catalog mean?](https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/)

## Cite

Cleartext. “How many vulnerabilities are in the CISA KEV catalog?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/

## Changelog

- 2026-09-24: First published. Numbers regenerate from the CISA feed on every build.