What is KEV?
Short answer. KEV is the Known Exploited Vulnerabilities catalog, a list kept by CISA, the US government's cybersecurity agency. Each entry is a software flaw (a CVE) that CISA has evidence attackers have used in real attacks, with the vendor and product it affects.
KEV lists flaws CISA has such evidence for. It is not a complete list of every flaw attackers use. A product on it is a reason to review that item first.
How this tool uses it
It checks your inventory's vendor and product against KEV, and it raises the flag only for items that are also past or near end of life. It never checks versions, so a match means "needs review" and nothing more. The tool never says "vulnerable".
kev: false means no match under the tool's rules, not that the software is known safe.
What KEV does not tell you
- It is not a list of every flawed product.
- It is not a severity score.
- It does not say whether your version has the flaw.
Source and licence
The catalog is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog. The tool's KEV data is derived from it (CC0 1.0).
Federal directive note
CISA's current binding directive for US federal civilian agencies, BOD 26-04, superseded BOD 22-01 (source: CISA, BOD 26-04). It is a reference only. It binds federal civilian agencies only. This tool does not implement it or its deadlines.
How fresh is the KEV data?
A KEV snapshot older than 3 days gives a warning. Older than 7 days, the KEV overlay is reported as "not current". See How often is the data updated?
The exact rules
For a product matched by name but without a vendor and product pair, the tool compares the publisher and the full inventory name with KEV, exactly. The rules are under "KEV limits" in the README and in docs/usage.md. Reading a KEV item in a review is step 6 of docs/sop.md.