Data
The dataset behind this page
Everything on the exploitation window is derived from one dataset: a per-CVE record for every entry in CISA's Known Exploited Vulnerabilities catalogue, paired with that CVE's NVD publication date. This page publishes the same records the tool renders, as plain files, so a reader can check the numbers or build something else on top of them without scraping the page.
Fields
| Field | Description |
|---|---|
| id | CVE identifier, as CISA KEV's cveID. |
| vendor | Normalised vendor key used to group rows on the tool page — a lower-case slug with known synonyms merged (e.g. both "F5" and "F5 Networks" resolve to f5). Not an official identifier. |
| vendorProject | The raw vendor/project string exactly as KEV publishes it, before normalisation. |
| product | KEV's product name, verbatim. |
| name | KEV's vulnerability name, verbatim. |
| published | NVD publication date, YYYY-MM-DD, UTC. Empty if NVD has no record yet for this CVE. |
| kevAdded | Date CISA added the entry to the KEV catalogue, YYYY-MM-DD, UTC. |
| daysToKev | Whole days from published to kevAdded. Unclamped: can be negative when CISA catalogued exploitation before NVD published the CVE (an in-the-wild zero-day). Empty when published is empty. The tool's own medians clamp this to zero; this export does not. |
| ransomware | true when CISA's knownRansomwareCampaignUse field is Known, else false. |
| edgeProduct | true when product is classified as enterprise perimeter/edge kit — VPN, firewall, gateway or WAN-edge appliance. Derived per-record from the product name, not a hand-picked vendor list; see the methodology note on the main page. |
Licence & attribution
Source data is CISA's Known Exploited Vulnerabilities catalogue and NIST's NVD API 2.0 — both free and public, and neither requires a licence to reuse. This export adds no restriction of its own beyond what CISA and NIST already apply to their own data; if you need the specifics, see cisa.gov and nvd.nist.gov directly. If you use this data, a link back to the exploitation window is appreciated but not required.
Changelog
There isn't a separate changelog — the git history is the changelog. This dataset is
rebuilt nightly, and every rebuild that changes the underlying records is its own dated,
diffable commit to
the
commit history of data/kev.json in the source repository. Compare any
two dates directly there rather than relying on a summary of what changed.
Schema stability
This is a minimum viable export: the same fields already on every record, reformatted as JSON and CSV, nothing added. A versioned, more complete schema — including nullable fields for data not collected yet (EPSS, CVSS, public-PoC timelines) — is planned but not built; treat the field set above as subject to change without a version number attached to it yet.