KEV catalog missing 88 percent of exploits

New research from Miggo Security suggests that CISA’s Known Exploited Vulnerabilities (KEV) catalog now reflects only a small slice of real-world exploit risk in open source, and it raises questions about how the industry should be using KEV going forward. Using open source code speeds innovation but expands the attack surface with every imported library and dependency. The result is a growing catalog of vulnerabilities, each one a potential entry point for attackers. To help organizations focus on verified threats, the US Cybersecurity and Infrastructure Security Agency (CISA) introduced the (KEV) catalog in 2021. The KEV list is meant to… [Continue Reading]