Exploited Right Now Screensaver
The Exploited Right Now screensaver shows cISA's catalogue of vulnerabilities actually being exploited in the wild, gathered key-less by the pipeline. It's free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Exploited Right Now screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
CISA's catalogue of vulnerabilities actually being exploited in the wild, gathered key-less by the pipeline. Far shorter than the site's CVE feed, which lists everything disclosed: here exploitation has been observed, and US federal agencies must remediate each by a stated date.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
What the KEV catalogue is
The Known Exploited Vulnerabilities (KEV) catalogue is maintained by CISA, the US Cybersecurity and Infrastructure Security Agency. It was established under Binding Operational Directive 22-01, issued on 3 November 2021, which set remediation timelines for federal civilian agencies. CISA’s page says BOD 26-04, issued 10 June 2026, now carries forward the KEV criteria, and CISA strongly recommends that state, local, tribal and territorial governments and private organisations also prioritise KEV remediation, though they are not bound by it.
The criteria are narrow. A flaw must have an assigned CVE ID, there must be reliable evidence of active exploitation in the wild, and a clear remediation action, such as a vendor update, must exist. Scanning, security research and proof-of-concept code do not count on their own, but attempted exploitation does. So the catalogue is small compared with the total number of published CVEs, which is its point: it separates problems that attackers are using from those that are merely possible.
Inclusion says nothing about how widely a product is deployed or how many organisations were hit. Equally, absence does not mean a flaw is safe, since exploitation may simply be unobserved or unreported.
A worked example
CISA's catalogue of vulnerabilities actually being exploited in the wild, gathered key-less by the pipeline. Far shorter than the site's CVE feed, which lists everything disclosed: here exploitation has been observed, and US federal agencies must remediate each by a stated date.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes — free, no download, in your browser.
- Does being listed mean my organisation was attacked?
- No. It means exploitation has been seen somewhere. Whether your systems are affected depends on whether you run the product and version concerned.
- What is the due date on each entry?
- It is the remediation deadline that applies to US federal civilian agencies. Others are not bound by it but can use it as a rough priority signal.
- What does a flaw need to be added to KEV?
- A CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action such as a vendor update.