Process and analysis
What is KEV?
CISA's Known Exploited Vulnerabilities catalogue: a public list of vulnerabilities confirmed to be exploited in real attacks.
The Known Exploited Vulnerabilities catalogue is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with reliable evidence of exploitation in the wild. US federal agencies must fix listed vulnerabilities by set deadlines.
Many other organisations use the KEV list as a prioritisation shortcut, because it answers the question CVSS does not: is anyone actually using this flaw?