# Source: Known Exploited Vulnerabilities Catalog (JSON feed)

CISA: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · government · primary · captured

# Known Exploited Vulnerabilities Catalog (JSON feed)

**CISA** · [https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · published 2026-10-21T14:04:39Z · added by `collector-primary` · slug `cisa-kev-catalog`

raw/ only (JSON feed). catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39Z. Neither CVE-2026-109618 nor CVE-2026-109619 is listed as of fetch ~08:12Z on 22 Oct.

## What it says, as the collector read it

#### CISA KEV catalog snapshot: notes

- Fetched ~2026-10-22T08:12Z. catalogVersion "2026.10.21", dateReleased "2026-10-21T14:04:39.8983Z".

- Neither CVE-2026-109618 nor CVE-2026-109619 appears. This is a negative finding as of that time. KEV listing would need evidence of exploitation; CISA's own ADP SSVC on 21 Oct 14:34Z said Exploitation "none".

- Re-check later; this file is a point-in-time snapshot only.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

### Exploitation signals from this source
- [2026-10-21](../../exploitation/index.html): 'CISA has not observed exploitation of these vulnerabilities as of the time of publication.' Neither CVE is in the Known Exploited Vulnerabilities catalog (vers

## The bytes

No browser capture; see raw.
raw, 1 files with SHA256SUMS- `known_exploited_vulnerabilities.json` ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-catalog/index.html