Four exploited flaws in KEV: a work queue, not a severity score

The number is four additions to CISA's Known Exploited Vulnerabilities catalog. What makes a small number worth reading is the membership test behind it: CISA describes the KEV catalog as the authoritative source of vulnerabilities that have been exploited in the wild ^[1], and tells organisations to use it as an input to their vulnerability management prioritisation framework ^[2]. It is a list of things attackers have already used, not a list of things that score badly.

One limit up front. The catalog page supplied here carries the catalog's description, a nomination prompt and a list of publication formats, and does not name individual entries ^[3], so what follows is about the mechanism rather than the four specific products.

Two features of that mechanism decide how much the figure is worth. First, coverage is partly crowd-fed: CISA openly asks whether readers know of an actively exploited vulnerability not included in the catalog ^[4]. Absence from KEV is therefore not evidence of safety. Second, the catalog ships as CSV, JSON and a print view ^[5], with a JSON schema last updated 06-25-2024 ^[6]. Ingestion is a scheduled job, not a reading exercise.

The cost lands on matching, and that is where lineage tooling is thinner than it looks. In a DVC project, configuration lives in dvc.yaml, which uses the YAML 1.2 format ^[7] and is deliberately kept small enough to version in Git alongside code ^[8]. An artifact entry can declare path, type, desc, labels and meta, of which only path is mandatory ^[9]; path may be relative to the repository root or a full path in external storage such as S3 ^[10]. Anything you park in meta is ignored by DVC and will not appear in the model registry ^[11]. So the file tells you where a model object sits, not which runtime, image or library serves it. Cross-referencing four KEV entries against that inventory stays manual unless someone has already written down the serving stack in a field the tooling actually reads.

Watch the machine-readable feeds rather than the announcement: the CSV and JSON exports ^[5] are what let a defender turn four entries into four asset queries, and the nomination channel ^[4] is the honest reminder that the count is a floor.