Ghost Defense · Which products carry the most confirmed-exploited vulnerabilities
TOOL 64 build 2026.08.26-F
Read this before quoting a number
This ranks the CISA Known Exploited Vulnerabilities catalog by vendor and product. KEV is the only public
dataset that attests exploitation actually observed in the wild, rather than predicting it — that is why it is the
spine here. But an entry count measures cataloged vulnerabilities, not exploitation volume, victim count, or
installed-base risk. A vendor rises on this board partly because its products are widely deployed and heavily
researched. Microsoft leading is not evidence that Microsoft is the worst-secured vendor; it is evidence that
Microsoft is the most examined. Use this to see where confirmed exploitation is concentrating, and pair it
with your own asset inventory before it drives a remediation decision.
Loading the KEV catalog…
Source: cisagov/kev-data on GitHub
View
White controls are yours to set. Everything below them is computed from the catalog.
Window (by catalog date)
Rank by
Filter
Output
Ghost Worker URL — used only for Shodan exposure lookups
Leave blank to use the build's default Worker; anything you save here overrides it for this
browser only. This is the Worker address, not an API key — the key stays inside the Worker.
Exposure lookups are
on demand, one row at a time — nothing is queried automatically, so opening this tool
spends no Shodan credits.
Leaderboard
Click any row for the underlying CVEs and the rule that assigned its class.
Provenance & methodSource: CISA Known Exploited Vulnerabilities catalog, fetched live from the cisagov/kev-data GitHub
repository. Catalog version and release timestamp are shown above; nothing is rehosted or cached server-side. Counting: one KEV record = one entry. Vendor and product strings are taken verbatim from the catalog and
only whitespace-normalized — no vendor consolidation is applied, so "SharePoint" and "SharePoint Server" remain
distinct rather than being merged on a guess. Class:inferred by an ordered rule table matching vendor and product names. Class
is derived, not evaluated; every assignment shows the rule that produced it. Records that no rule matches
are reported as Unclassified rather than forced into a bucket, and catalog entries reading "Multiple
Products" are held out as Product unspecified — they name no product and are not ranked as one. Ransomware: the KEV field records Known or Unknown. "Unknown" means CISA has not confirmed
ransomware campaign use — it is not a finding of absence, so the share shown is a floor. Historical entries: flagged where the CVE identifier year precedes the catalog date by two or more years.
This is approximate — it uses the CVE ID year, since KEV carries no CVE publication date.
This tool applies no CISA scoring methodology and is not a CISA product; it carries no CISA endorsement.