CISA Known Exploited Vulnerabilities — Attacked CVEs

The US government's catalogue of vulnerabilities known to be exploited in the wild, as flat rows — CVE, vendor, product, dates and ransomware use.

Source: CISA's Known Exploited Vulnerabilities catalogue. Free, no key.

What you get

vendor, product, name, dateAdded, dueDate, description, requiredAction, ransomwareUse, url, id.

Sample output

{ "id": "kev:CVE-2026-12345", "vendor": "Acme", "product": "Widget",
  "dateAdded": "2026-10-01", "dueDate": "2026-10-22", "ransomwareUse": "Known" }

Limitations — read before buying

• This is the SHORTLIST of vulnerabilities known to be exploited, not the whole vulnerability universe. Absence from KEV does not mean a flaw is unexploited — only that CISA has not confirmed it.
• It is US federal. The remediation due dates bind US federal agencies, not private industry.
• knownRansomwareCampaignUse is Known, Unknown or N/A — as a string, not a boolean.
• The catalogue is versioned (catalogVersion), so a snapshot is dated; this Actor returns the rows, not the version header.
• description and requiredAction are whitespace-normalised and truncated.

Pricing

Pay per result.

Fields

Field	Type	What it holds
vendor	string	Vendor this record relates to.
product	string	Product name or identifier as the source records it.
name	string	Display name as the source writes it.
dateAdded	string	Date the entry was added to the catalogue. Not the date the underlying fact changed.
dueDate	string	Date the required action is due. A deadline set by the source, and it passes.
description	string	Description of this record, as published by the source.
requiredAction	string	The action the source requires of affected parties, in its own words.
ransomwareUse	string	Whether the vulnerability is known to have been used in ransomware campaigns. Absence means it is not known to be, not that it is not.
url	string	The URL this row describes.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• CISA Known Exploited Vulnerabilities — Attacked CVEs declares all 9 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of CISA Known Exploited Vulnerabilities include vendor, product, name, dateAdded, dueDate and description.
• CISA Known Exploited Vulnerabilities needs no API key, login or account of any kind before its first run.
• Every one of CISA Known Exploited Vulnerabilities's 2 inputs is optional, so it runs with no configuration at all.
• CISA Known Exploited Vulnerabilities documents product as: Product name or identifier as the source records it.
• Every number published about CISA Known Exploited Vulnerabilities is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• CISA Known Exploited Vulnerabilities is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

FAQ

What does CISA Known Exploited Vulnerabilities return?

It returns 9 documented output fields — vendor, product, name, dateAdded, dueDate, description, requiredAction and ransomwareUse — each with a declared type and a written description. The full schema is below.

What does CISA Known Exploited Vulnerabilities require to run?

Nothing. All 2 inputs are optional and ship with working defaults.

Does CISA Known Exploited Vulnerabilities need an API key?

No. It reads only public data and asks for no account.

How is CISA Known Exploited Vulnerabilities billed?

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.