CISA KEV & EPSS Vulnerability Vendor Impact Monitor

Turn the official CISA Known Exploited Vulnerabilities catalog into vendor-focused, dated JSON and CSV records enriched with FIRST EPSS. Use it for defensive vulnerability triage, vendor watchlists, security dashboards, Clay enrichment and n8n workflows. No source API key, browser, proxy or login is required.

What you get

One row per unique CVE, with CISA vendor/project, product, vulnerability name, KEV addition date, catalog due date, required action, EPSS probability, EPSS percentile, actual score date, source links and UTC retrieval time. Source text is preserved; results are sorted by KEV addition date descending and then CVE descending. This is a fresh snapshot each run, not a historical change detector or a scan of your systems.

KEV and EPSS answer different questions. CISA lists CVEs with evidence of exploitation in the wild. FIRST EPSS forecasts the probability that exploitation activity for a CVE will be observed in the next 30 days, as of the score date. A percentile is a relative ranking, not an exploitation probability. A low EPSS score does not undo the evidence behind KEV inclusion. Scores are population-level estimates, not a prediction for your organization.

Vendor or product matches are text matches only. They are not proof that a customer's system contains a vulnerable version, is affected, was exploited or is compromised. Confirm asset inventory, version, configuration, exposure and vendor advisories separately.

Due-date scope. due_date is copied from CISA's catalog dueDate without recalculation. CISA's current KEV guidance refers to BOD 26-04 for federal civilian executive branch (FCEB) remediation requirements. Applicable timelines can depend on asset exposure and other directive conditions. A catalog date alone is not a computed asset-specific compliance deadline. It is not a universal private-sector legal obligation. Always consult the current directive and the source entry, including notes and any forensic triage guidance.

Input

{"vendor":"Microsoft","product":"Windows","minEpssScore":0.1,"addedWithinDays":0,"maxResults":20,"maxCostUsd":0.10}

Field	Default	Meaning
vendor	empty	Case-insensitive literal substring of vendorProject
product	empty	Case-insensitive literal substring of product; AND with vendor
minEpssScore	0	Inclusive probability threshold from 0 to 1, not percentile
addedWithinDays	0	Inclusive UTC calendar-day KEV addition cutoff; 0 disables
maxResults	20	Unique CVE output cap, 1–5,000
maxCostUsd	1	Total per-run event-cost cap, $0–$25; whole events rounded down

Empty vendor/product strings match all values. Aliases, fuzzy matching, CPE/version analysis and asset scans are not performed. maxResults is an upper bound, not a promise of that many matches. Broad text filters can match several product families. Newest KEV additions appear first; results are not ranked by EPSS.

Missing EPSS is null, never zero. With minEpssScore=0, missing scores remain in the output; positive thresholds exclude them because they cannot satisfy a known minimum. A successful empty API response can represent missing scores. HTTP, timeout, malformed data, schema and inconsistent score-date errors fail the run rather than silently becoming nulls. FIRST may publish yesterday's score; epss_score_date records the actual returned date, never the fetch date. The first nonempty batch establishes a score date, pinned for all later batches.

Output fields

Field	Meaning
cve_id	Exact CVE join key
vendor_project	CISA vendorProject
product_name	CISA product
vulnerability_name	CISA vulnerabilityName
date_added_kev	CISA dateAdded, YYYY-MM-DD
due_date	Unmodified CISA dueDate; scope explained above
epss_probability_score	Number 0–1, or null
epss_percentile	Number 0–1, or null
required_action	Unmodified CISA requiredAction
epss_score_date	Actual FIRST score date, or null
source_url	Official CISA JSON catalog URL
fetched_at	UTC time after the relevant EPSS response
epss_source_url	FIRST per-CVE query, with score date when known
is_known_exploited	true: listed by CISA, not proof of local compromise

The SUMMARY key-value record includes catalog version/release date, candidates, returned count, prior CVEs on resume, EPSS date, request count and elapsed seconds. Empty results are a successful run with an empty Dataset and a summary, not an error row.

Clay, n8n and API exports

Run the Actor, then download its Dataset as JSON or CSV. Output links are exposed in the Output tab. In Clay, import the CSV or use HTTP API enrichment; in n8n, call the Actor and fetch Dataset items after it succeeds. Keep your Apify API token in the integration's secret storage.

POST https://api.apify.com/v2/acts/ACTOR_ID/runs?maxTotalChargeUsd=0.10
Authorization: Bearer YOUR_APIFY_TOKEN
Content-Type: application/json

{"vendor":"Apache","product":"Log4j","maxResults":10,"maxCostUsd":0.05}

GET https://api.apify.com/v2/datasets/DATASET_ID/items?format=json&clean=true
GET https://api.apify.com/v2/datasets/DATASET_ID/items?format=csv&clean=true

JSON preserves null explicitly; CSV exports represent nulls as empty cells. Check run status and SUMMARY before consuming results from a failed or aborted run, which can contain an incomplete set of already delivered rows.

Price and limits

$0.005 per successful unique CVE delivered — $5 per 1,000 CVEs. One custom cve-returned event per saved row. No paid Actor-start, source-request, retry, empty-result or duplicate event. Standard-run platform usage is included in this price. The per-run bill is limited by maxResults, maxCostUsd and the user's Apify maxTotalChargeUsd spending limit. The lowest cap wins. For example, 20 rows cost $0.10; a $0.017 budget allows 3 rows ($0.015).

Deduplication is by CVE ID within a run, including reading existing Dataset IDs when the same run is resumed/resurrected. Source request retries do not emit rows or charges. A newly started run is a new snapshot and bills its delivered CVEs again. Storage/export operations outside the Actor follow Apify's platform rules.

HTTP requests use 20-second timeouts, up to 4 attempts for transient errors, bounded exponential backoff and Retry-After handling. EPSS batches keep the comma-separated CVE parameter below 1,800 characters, safely below FIRST's documented 2,000-character maximum; requests are sequential with at least 250ms spacing, far below the documented 1,000 public requests/minute. No parallel fan-out. The source-processing deadline is 210 seconds, with a 240-second default run timeout. Runs fail explicitly on exhausted sources. No numeric CISA feed quota was found in the reviewed official documentation; the Actor fetches the catalog once per run and respects 429 responses. Prefer scheduled snapshots over rapid polling.

Sources, attribution and terms

• CISA official JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA JSON Schema: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities_schema.json
• Catalog and entry context: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Current federal directive: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• CISA's official mirror documents CC0/public-domain use, identical to the canonical KEV license: https://github.com/cisagov/kev-data and https://www.cisa.gov/sites/default/files/licenses/kev/license.txt
• EPSS data and attribution: FIRST EPSS Special Interest Group; scores generated by Empirical Security. https://www.first.org/epss/data.html and https://www.first.org/epss/faq
• FIRST public EPSS API, response schema and parameter reference: https://api.first.org/epss/ ; general API/rate limits: https://api.first.org/
• FIRST states EPSS scores are freely published via CSV/API without registration and requests attribution in products/publications. Source data is publicly available for free; this Actor charges for retrieval, filtering, joining, normalization, dated provenance and Apify delivery, not exclusive access to the underlying data. No endorsement by CISA, FIRST or Empirical Security is implied.
• FIRST's current daily bulk alternative, not used by this Actor: https://epss.empiricalsecurity.com/epss_scores-current.csv.gz (gzip CSV: cve, epss, percentile, with score/model date in the comment header).

Source/API terms checked 2026-11-02. Upstream availability, schemas, publication schedules and policies may change. This product is a defensive information workflow, not a vulnerability scanner, exploit tool, compliance determination or guarantee of completeness.