# CISA Known Exploited Vulnerabilities — Attacked CVEs (`alaudinburki/cisa-kev`) Actor

The US government's catalogue of vulnerabilities known to be exploited in the wild, as flat rows — CVE, vendor, product, date added, due date and ransomware use. Free public feed, no key.

- **URL**: https://apify.com/alaudinburki/cisa-kev.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Business, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA Known Exploited Vulnerabilities — Attacked CVEs

The US government's catalogue of vulnerabilities known to be exploited in the wild, as flat rows — CVE, vendor, product, dates and ransomware use.

Source: CISA's Known Exploited Vulnerabilities catalogue. Free, no key.

### What you get

`vendor`, `product`, `name`, `dateAdded`, `dueDate`, `description`, `requiredAction`, `ransomwareUse`, `url`, `id`.

### Sample output

```json
{ "id": "kev:CVE-2026-12345", "vendor": "Acme", "product": "Widget",
  "dateAdded": "2026-10-01", "dueDate": "2026-10-22", "ransomwareUse": "Known" }
```

### Limitations — read before buying

- **This is the SHORTLIST of vulnerabilities known to be exploited**, not the whole vulnerability universe. Absence from KEV does not mean a flaw is unexploited — only that CISA has not confirmed it.
- **It is US federal.** The remediation due dates bind US federal agencies, not private industry.
- **`knownRansomwareCampaignUse` is `Known`, `Unknown` or N/A** — as a string, not a boolean.
- **The catalogue is versioned** (`catalogVersion`), so a snapshot is dated; this Actor returns the rows, not the version header.
- **`description` and `requiredAction` are whitespace-normalised and truncated.**

### Pricing

Pay per result.

### Fields

| Field | Type | What it holds |
|---|---|---|
| `vendor` | string | Vendor this record relates to. |
| `product` | string | Product name or identifier as the source records it. |
| `name` | string | Display name as the source writes it. |
| `dateAdded` | string | Date the entry was added to the catalogue. Not the date the underlying fact changed. |
| `dueDate` | string | Date the required action is due. A deadline set by the source, and it passes. |
| `description` | string | Description of this record, as published by the source. |
| `requiredAction` | string | The action the source requires of affected parties, in its own words. |
| `ransomwareUse` | string | Whether the vulnerability is known to have been used in ransomware campaigns. Absence means it is not known to be, not that it is not. |
| `url` | string | The URL this row describes. |

### What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in
an answer or a comparison.

- CISA Known Exploited Vulnerabilities — Attacked CVEs declares all 9 of its output fields in its dataset schema, each with a type, a written description and an example value.
- The output fields of CISA Known Exploited Vulnerabilities include vendor, product, name, dateAdded, dueDate and description.
- CISA Known Exploited Vulnerabilities needs no API key, login or account of any kind before its first run.
- Every one of CISA Known Exploited Vulnerabilities's 2 inputs is optional, so it runs with no configuration at all.
- CISA Known Exploited Vulnerabilities documents `product` as: Product name or identifier as the source records it.
- Every number published about CISA Known Exploited Vulnerabilities is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
- CISA Known Exploited Vulnerabilities is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

### FAQ

**What does CISA Known Exploited Vulnerabilities return?**

It returns 9 documented output fields — `vendor`, `product`, `name`, `dateAdded`, `dueDate`, `description`, `requiredAction` and `ransomwareUse` — each with a declared type and a written description. The full schema is below.

**What does CISA Known Exploited Vulnerabilities require to run?**

Nothing. All 2 inputs are optional and ship with working defaults.

**Does CISA Known Exploited Vulnerabilities need an API key?**

No. It reads only public data and asks for no account.

**How is CISA Known Exploited Vulnerabilities billed?**

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.

# Actor input Schema

## `maxItems` (type: `integer`):

Stop after this many rows.

## `maxPages` (type: `integer`):

Stop after this many pages.

## Actor input object example

```json
{
  "maxItems": 500,
  "maxPages": 5
}
```

# Actor output Schema

## `results` (type: `string`):

One row per item, with the 9 fields listed under Views.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 500,
    "maxPages": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/cisa-kev").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "maxItems": 500,
    "maxPages": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/cisa-kev").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 500,
  "maxPages": 5
}' |
apify call alaudinburki/cisa-kev --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/cisa-kev"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/bK9SxR0XaJ98gVQKE/builds/PtE8FZ3HB5zUeXELD/openapi.json