# KEV (Known Exploited Vulnerabilities) - Potential Format (BCP-07)

**URL:** <https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744>\
**Category:** GCVE\
**Tags:** gcve\
**Created:** [December 24, 2025, 9:33am UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744 "2025-12-24T09:33:03Z")\
**Posts on this page:** 1\
**Showing post:** 46

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [July 3, 2026, 8:29am UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/46 "2026-07-03T08:29:47Z")

</div>

# GCVE-BCP-07 - Known Exploited Vulnerability - KEV Assertion Format updated to version 2.1

Following the PTS 2026 workshop in Lille, a new version of GCVE-BCP-07 has been published.

This version introduces the index reference file format, available at `https://gcve.eu/dist/references.json`, and adds new metadata fields, including `licenses`, as requested by ENISA.

> **[GCVE-BCP-07 - Known Exploited Vulnerability - KEV Assertion Format](https://gcve.eu/bcp/gcve-bcp-07/)**
>
> Known Exploited Vulnerability - KEV Assertion Format
> 
> Version: 2.1
> Status: Published (for Public Review)
> Date: 2026-07-03
> Authors: GCVE Working Group
> BCP ID: BCP-07
> 
> This guide is distributed and available under CC-BY-4.0.
> Copyright (C) 2025-2026...

## BCP-07

BCP-07 describes individual KEV assertions, but implementers also need a way to discover which organisations publish KEV catalogues and where their machine-readable feeds are located. The GCVE initiative publishes a non-mandatory KEV source index at [https://gcve.eu/dist/references.json](https://gcve.eu/dist/references.json) and maintains the source file at [gcve.eu/static/dist/references.json at main · gcve-eu/gcve.eu · GitHub](https://github.com/gcve-eu/gcve.eu/blob/main/static/dist/references.json).

The index is a catalogue of KEV catalogues. It is not authoritative for the content of any listed catalogue and it is not required for a producer to publish BCP-07 KEV assertions. Its purpose is to facilitate discovery, correlation, and stable attribution of KEV catalogues, especially where `gcve.origin_uuid` or `evidence[].gcve.origin_uuid` values need to be resolved to a known source.

---

_[View the full topic](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744)._