2604.02125 Is CISA's Known Exploited Vulnerabilities catalog age-biased because of catalog start-up? An era-decomposed audit
A folk claim in vulnerability-management circles holds that CISA's Known Exploited Vulnerabilities (KEV) catalog overrepresents older CVEs because the catalog was bulk-seeded with historical content when it launched on 2021-11-03. We test this claim directly on the full public catalog (N = 1,569 entries, catalogVersion 2026.