# Cisa Known Exploited Vulns Scraper (`b2b_lead_generation/cisa-known-exploited-vulns-scraper`) Actor

Extract public CISA Known Exploited Vulnerabilities data by full catalog or custom filter. Export clean CVE rows directly as JSON, CSV, or Excel from your dataset.

- **URL**: https://apify.com/b2b_lead_generation/cisa-known-exploited-vulns-scraper.md
- **Developed by:** [B2B Lead Generation](https://apify.com/b2b_lead_generation) (community)
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.99 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### CISA Known Exploited Vulns Scraper

This CISA known exploited vulns scraper reads the public catalog and writes one row per CVE. You do not need an account or proxy configuration to get started. Choose between the full catalog or a local filter, set your item cap, and export your dataset as JSON, CSV, or Excel from Apify.

This actor pulls from the official public feed and organizes vulnerability tracking cleanly for security teams, patch management, and research workflows.

### Use cases

- **Patch queues**: Pull newly cataloged CVEs and sort them quickly by due date.
- **Vendor watch**: Keep tabs on Microsoft, Apache, or any other vendor without manually downloading large files.
- **Ransomware triage**: Filter specifically for rows marked as associated with known ransomware campaign use.
- **Keyword search**: Find specific product names or bug classes inside vulnerability titles and descriptions.
- **Scheduled export**: Automatically drop the dataset into your preferred storage or alerting pipeline when the catalog updates.

### What data does this actor extract?

The actor operates in two modes within a single request:

- **`full_catalog`**: Downloads the feed once and emits every vulnerability up to your specified item cap.
- **`filter`**: Uses the same underlying file and keeps only the rows matching your selected vendor, keyword, date added threshold, and ransomware criteria.

The feed is structured as a single document with no page or offset parameters. The actor handles delays, retries on temporary hiccups, and gracefully handles any network interruptions, returning a clean error record instead of crashing the run if something fails.

### Input

| Parameter | Type | Default | Description |
| --- | --- | --- | --- |
| `mode` | string | `full_catalog` | Choose between pulling the full catalog or applying local filters. |
| `vendors` | array | `["Microsoft"]` | Vendor or project names for filter mode (case-insensitive match). |
| `keyword` | string | `""` | Substring search on vulnerability name and short description. |
| `addedSince` | string | `""` | Keep records added on or after YYYY-MM-DD. |
| `ransomwareOnly` | boolean | `false` | Keep entries flagged for known ransomware campaign use. |
| `maxItems` | integer | `100` | Maximum vulnerability rows to save (between 1 and 1000). |
| `requestDelaySecs` | number | `1` | Pause before making the catalog request. |
| `timeoutSecs` | integer | `300` | Stop the run after this many seconds (max 3600). |
| `requestTimeoutSecs` | integer | `30` | Per-request timeout limit. |
| `proxyConfiguration` | object | `useApifyProxy: false` | Optional proxy settings. Leave off unless needed. |

#### Example input

```json
{
  "mode": "filter",
  "vendors": ["Microsoft"],
  "keyword": "spoofing",
  "addedSince": "2026-01-01",
  "ransomwareOnly": false,
  "maxItems": 100,
  "requestDelaySecs": 1,
  "timeoutSecs": 300,
  "requestTimeoutSecs": 30,
  "proxyConfiguration": { "useApifyProxy": false }
}

```

### Output

Results are pushed directly to the default dataset. A standard vulnerability record looks like this:

```json
{
  "cveID": "CVE-2015-5477",
  "vendorProject": "ISC",
  "product": "BIND",
  "vulnerabilityName": " ISC BIND Data Processing Errors Vulnerability",
  "dateAdded": "2026-10-08",
  "shortDescription": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
  "requiredAction": "Apply mitigations per vendor instructions.",
  "dueDate": "2026-10-11",
  "knownRansomwareCampaignUse": "Unknown",
  "cwes": ["CWE-19"],
  "notes": "[https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)",
  "source_url": "[https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)",
  "scraped_at": "2026-10-12T00:00:00Z"
}

```

### Pricing

This actor is free to run on Apify outside of standard platform usage.

### FAQ

- **Can I export CSV or Excel?** Yes, Apify natively supports exporting datasets as JSON, CSV, or Excel.
- **What happens if a request fails?** You will receive a structured error row containing the status and message rather than an abrupt run failure.
- **How many CVEs can one run save?** The `maxItems` parameter defaults to 100 and can be adjusted up to 1000.

### Is web scraping legal?

Collecting publicly available catalog data is generally permissible. This actor operates strictly on public data without attempting to bypass access controls or authentication mechanisms. *Note: This is not formal legal advice. For more details, see [Apify's guide on web scraping legality](https://blog.apify.com/is-web-scraping-legal/).*

# Actor input Schema

## `mode` (type: `string`):

full_catalog returns every KEV row up to the cap. filter keeps rows that match vendor, keyword, date, and ransomware settings.

## `vendors` (type: `array`):

Vendor or project names to keep in filter mode. Matching is case-insensitive against vendorProject. Leave empty to skip the vendor filter.

## `keyword` (type: `string`):

Case-insensitive substring matched against vulnerabilityName and shortDescription. Used in filter mode. Leave blank to skip.

## `addedSince` (type: `string`):

In filter mode, keep entries whose dateAdded is on or after this date. Use YYYY-MM-DD. Leave blank to skip the date filter.

## `ransomwareOnly` (type: `boolean`):

In filter mode, keep only rows where knownRansomwareCampaignUse is Known.

## `maxItems` (type: `integer`):

Maximum vulnerability rows to save this run. Hard cap is 1000. Error rows do not count toward this limit.

## `requestDelaySecs` (type: `number`):

Seconds to wait before each catalog request. The public feed is one JSON file, so this is a polite pause, not a page delay.

## `userAgent` (type: `string`):

User-Agent sent on every request. Include an app name and a contact so the host can identify the client.

## `timeoutSecs` (type: `integer`):

Stop the run after this many seconds and keep rows already collected. Default 300. Maximum 3600.

## `requestTimeoutSecs` (type: `integer`):

How long to wait for the KEV catalog response before treating the call as failed. Default 30 seconds.

## `proxyConfiguration` (type: `object`):

Optional proxy for the catalog request. Leave useApifyProxy off unless the host blocks your IP.

## Actor input object example

```json
{
  "mode": "full_catalog",
  "vendors": [
    "Microsoft"
  ],
  "keyword": "",
  "addedSince": "2026-01-01",
  "ransomwareOnly": false,
  "maxItems": 100,
  "requestDelaySecs": 1,
  "userAgent": "BigiByteActorResearch/1.0 (contact: research@bigibyte.com)",
  "timeoutSecs": 300,
  "requestTimeoutSecs": 30,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `overview` (type: `string`):

CVE, vendor, product, name, dates, summary, required action, and source URL.

## `errors` (type: `string`):

Failed catalog requests with URL, HTTP status, and message.

## `dataset` (type: `string`):

Every row from the run, without a table view applied.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "vendors": [
        "Microsoft"
    ],
    "proxyConfiguration": {
        "useApifyProxy": false
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("b2b_lead_generation/cisa-known-exploited-vulns-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "vendors": ["Microsoft"],
    "proxyConfiguration": { "useApifyProxy": False },
}

# Run the Actor and wait for it to finish
run = client.actor("b2b_lead_generation/cisa-known-exploited-vulns-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "vendors": [
    "Microsoft"
  ],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}' |
apify call b2b_lead_generation/cisa-known-exploited-vulns-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,b2b_lead_generation/cisa-known-exploited-vulns-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/XdmwXdIpwje02nXUM/builds/L55bPMSwaUi4aXCt1/openapi.json