How often is the data updated?
The CISA KEV check runs daily and publishes a data release when the data changed. The end-of-life job runs weekly and opens a pull request; the new dates reach users in the next daily release after the maintainer merges it. The project is maintained as time allows, so a run can be late.
| Data | Schedule | What happens |
|---|---|---|
| CISA KEV | Daily, 07:41 UTC | A new data release is published when the data changed. |
| End-of-life dates (endoflife.date) | Weekly, Mondays 08:23 UTC | The job opens a pull request. The dates reach users in the next daily release after the maintainer merges it. |
These are the scheduled times. The project is maintained as time allows, so a run can be late, and GitHub can pause scheduled jobs after 60 days with no repository activity. Check the snapshot dates in data/manifest.json to see how old your copy is. Not found on this page by design: current snapshot dates, because they change.
Where the data comes from
- End-of-life dates derive from the endoflife.date product files (MIT). Product descriptions are not included.
- KEV data derives from the CISA Known Exploited Vulnerabilities catalog (CC0 1.0).
Attribution is in THIRD-PARTY.md.
Staleness rules
- A KEV snapshot older than 3 days gives a warning. Older than 7 days, the KEV overlay is reported as "not current".
- An end-of-life snapshot older than 30 days gives a warning.
Using a different data release
Point --data at any directory that holds a verified data release. The verify-data command runs only the SHA-256 manifest check. That check does not prove who made the files. The attestation is checked online; see Supply chain.
Release names
Data releases are named data-YYYY.MM.DD.N. They are never changed or re-tagged. A fix is a new, higher release.
Where next
- What is KEV?
- What is an SBOM? This is a different thing.
- Supply chain
- Is this for you, and how to start
- Check data/manifest.json on GitHub