Critical Severity
Published: Nov 8, 2026
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
# Known Exploited Vulnerabilities (KEV) Detector
**KEV finds known exploited vulnerabilities on internet-facing systems in one scan.**
It is an Ostorlab agent group that combines five open-source scanners:
- **Agent Nuclei** — verified Nuclei templates for known exploited vulnerabilities.
- **Agent Tsunami** — Google Tsunami detectors for common exposed services.
- **Agent Nmap** — port and service discovery.
- **Agent Asteroid** — Ostorlab's remote CVE scanner.
- **Agent Metasploit** — auxiliary checks for selected vulnerabilities.
The group runs read-only detection checks. A finding means the target matches a
known-vulnerable condition. The group does not exploit, upload payloads, change
configuration or authenticate. A clean scan does not prove a target is patched.
| Coverage | Count |
| --- | ---: |
| CVEs in KEV's existing coverage | 893 |
| Additional CVEs detected by the current Agent Asteroid release | 203 |
| **Unique CVEs covered by the agent group** | **1096** |
| Non-CVE exposure checks in the KEV table | 25 |
| Agent Asteroid offline-inventory CVEs (manual, not run by this group) | 85 |
_Coverage snapshot: 8 November 2026._
CISA KEV entries that cannot be checked safely or remotely remain listed in
[docs/coverage-status.md](docs/coverage-status.md). At this snapshot, 1,205
entries are not detected and 1 is in progress.
## What it detects
- **Actively exploited vulnerabilities** from the CISA KEV catalog, when a safe
remote check exists.
- **Common exposed services** covered by Google Tsunami, such as exposed Docker
APIs, Jenkins, Jupyter, Kubernetes, Redis and Spring Boot Actuator.
- **Agent Asteroid's 371 remote CVE checks**, including web applications, VPNs,
firewalls, mail servers, databases and network appliances.
- **Selected Metasploit auxiliary checks** where a Nuclei template is not
available.
The coverage table also includes the **2026-11-07 Nuclei backlog import**: 255
CVEs with exact source paths, hashes and registrations in