Every AI Product on CISA's KEV List: All Fourteen of Them

"The AI stack is under attack" is easy to write and hard to size. So we counted. Our database holds 2,459 accepted CVE records that name a product in the AI stack — orchestration frameworks, model servers, agent platforms, notebook runtimes, the libraries that glue them together. Fourteen of those CVEs have ever been added to CISA's Known Exploited Vulnerabilities catalog, the closest thing the industry has to an official "this is being used against people right now" list. This is the complete ledger, with the dates, and with the part nobody puts in a headline: what is exploited but not listed.

The ledger

Thirteen of those products are in our AI-stack list directly. The fourteenth, Starlette, is a general-purpose Python web framework — we count it because the Host-header flaw is what bypasses the path-based auth checks in the LiteLLM chain it sits under. If you prefer a strict definition, the number is thirteen; the argument for including it is the reason it got exploited.

What the dates say

One entry in 2025. Thirteen in 2026, seven of them between July 7 and September 2 — a nine-week stretch that accounts for half the entire list. The median time from CVE publication to KEV listing across the fourteen is 23 days, but the spread is what matters: LiteLLM's SQL-injection bug (CVE-2026-42208) entered KEV the same day it was published, MLflow's SSRF took two days, and Ray's DNS-rebinding RCE took 264. A short time-to-KEV is not a severity measure; it means somebody was already using it when the record appeared.

Six of fourteen are Langflow, across five separate bug classes: unauthenticated code injection, a CORS misconfiguration leading to token hijack, an auto-login bypass, an exec_globals RCE, and an IDOR. That is not a product having one bad week. It is one codebase that exposes code execution as a feature and keeps finding new ways to leave the door open — and 173 Langflow CVE records in our database, 163 of them published in 2026, say the discovery rate has not slowed.

The bigger number: exploited, but not on the list

KEV is a floor, not a census — it records what CISA can confirm, mostly through federal-sector telemetry. Our own exploit tracking flags 137 AI-stack CVEs as having exploit evidence (a public PoC, a Metasploit module, observed use). 134 of those are not in KEV. Another 11 sit above a 50% EPSS probability with no KEV entry at all:

Flowise appears four times here and zero times on KEV. MLflow appears three times here and once on KEV. If your prioritisation rule is "patch what's on KEV", these eleven are invisible to you, and four of them are a straight CVSS 9.8–10.0 unauthenticated RCE in software people point at their own model endpoints.

The outlier we are not going to headline

One name dominates the raw counts and appears nowhere in the ledger: OpenClaw, with 1,055 accepted CVE records in our database — all published between February 1 and August 6, 2026, none in KEV, and 465 of them carrying no CVSS score at all. Before anyone turns that into "the most vulnerable AI product ever shipped", three caveats we cannot resolve for you: the bucket includes third-party projects that merely carry the name (openclaw-cn, openclaw-android, community dashboards and forks), a large share arrives as GHSA advisories rather than CNA-assigned CVEs, and a platform with a public, high-volume advisory process will always out-count a closed one. A thousand records is a statement about disclosure practice at least as much as about code. We are keeping the number in the ledger and out of the headline.

How this list was built

Every row comes from our merged CVE database (CVE.org, NVD, GHSA and BDU records reconciled into one record per CVE), not from a vendor roundup. Products are matched by name against the affected-product records — which is crude, and worth saying out loud: a supply-chain advisory that lists hundreds of npm packages will land in whichever bucket its package list happens to touch, and we dropped two such records from this ledger by hand after reading them. CVSS is the NVD score where one exists. EPSS is today's value, not the value at the time of listing — EPSS moves, sometimes long after the exploitation does. KEV dates are CISA's.

Ledger current as of 2026-09-21live record →