# CISA KEV Newly-Added Vulnerability Monitor (`bytehavenstudios/cisa-kev-monitor`) Actor Change-detection over the CISA Known Exploited Vulnerabilities (KEV) catalog. Diffs the feed run-to-run to emit only newly-added CVEs the moment CISA publishes them, normalized (dateAdded, dueDate, ransomware flag, CWEs) with vendor/product/since filters. Keyless, CC0. Not endorsed by CISA/DHS. - **URL**: https://apify.com/bytehavenstudios/cisa-kev-monitor.md - **Developed by:** [ByteHaven Studios](https://apify.com/bytehavenstudios) (community) - **Categories:** Developer tools, News, Other - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $10.00 / 1,000 kev returneds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## CISA KEV Newly-Added Vulnerability Monitor **First-seen change-detection over the CISA Known Exploited Vulnerabilities (KEV) catalog.** The KEV catalog is *the* authoritative "actively exploited in the wild" list every patch and vulnerability-management team tracks against BOD-mandated due dates. Farms dump the whole ~1,600-row catalog as a static scrape; nobody sells the **delta**. This Actor downloads the full single-file feed (`known_exploited_vulnerabilities.json`, ~1.5 MB), snapshots the seen `cveID` set in the key-value store, and diffs it run-to-run to emit only **newly-added** CVEs the moment CISA publishes them — normalized (`dateAdded`, `dueDate`, `knownRansomwareCampaignUse`, `cwes[]`) and filterable by vendor/product or date-added-since. A full-file catalog becomes an operational "what's new to patch, for my stack" alert stream. Plain HTTPS download of one static JSON feed — no browser, no proxy, no login, no API key required. **Data source: CISA KEV catalog, CC0 1.0 Universal (public-domain-equivalent).** > This product uses data from the Cybersecurity and Infrastructure Security Agency (CISA) Known > Exploited Vulnerabilities catalog. Use of this information does not authorize use of the CISA Logo or > DHS Seal, nor should such use be interpreted as an endorsement by CISA or DHS. > **Status: complete (v0.1, unpublished by design).** The Actor is fully built — `.actor/` > (actor.json + input_schema.json + Dockerfile), `package.json`, the runtime layers (`src/kev.js`, > `src/diff.js`, `src/filters.js`, `src/main.js`), the offline test suite (`test/`), `COMPLIANCE.md`, > and `docs/PRICING.md`. This Actor is **built, never published** — no `apify push`, no on-platform > pricing (the intended `kev-returned` price is documented in `docs/PRICING.md`, owner-gated). See > `CHANGELOG.md` for the slice history. --- ### What it will do For each run it downloads the full KEV catalog, parses the JSON envelope (`{title, catalogVersion, dateReleased, count, vulnerabilities[]}`), normalizes every vulnerability into one flat `kev` shape, loads the prior run's seen-`cveID` set from the Actor's key-value store, and emits one dataset item per CVE not previously seen. - **The delta, not the blob** (the moat): vuln-management teams must re-screen against the KEV catalog continuously, and the pain is spotting *what's new to patch*. This emits exactly the additions — first-seen CVEs — over a corpus everyone else republishes whole. - **Normalized + filterable**: parsed fields (`dateAdded`, `dueDate`, `knownRansomwareCampaignUse`, `cwes[]`); filter by vendor/project, product, ransomware-campaign use, or date-added-since. - **Change monitor**: `monitorNewOnly` persists the seen-`cveID` set and, on the next scheduled run, emits only CVEs added since. A first run seeds the baseline (emits nothing). - **No PII** — the KEV catalog is a plain public vulnerability catalog keyed on `cveID`; there is no personal data, so none of the snapshot/PII machinery of the LEIE monitor applies here. ### Inputs | Input | Type | Notes | |---|---|---| | `vendorProjects` | string[] | Optional `vendorProject` exact-match (e.g. `Microsoft`). Empty = all | | `products` | string[] | Optional `product` substring (e.g. `Windows`). Empty = all | | `addedSince` | string | Lower bound on `dateAdded` for newly-added CVEs (YYYY-MM-DD). Empty = all | | `knownRansomwareOnly` | boolean | Emit only `knownRansomwareCampaignUse = "Known"`. Default: all | | `monitorNewOnly` | boolean | Diff vs the stored seen-`cveID` set; emit only the delta. Default: on | | `maxResults` | integer | Cap total newly-added records returned (0 = no cap) | | `proxyConfiguration` | object | Optional; the feed is open and needs no proxy. Default: none | ### Output — one record per newly-added CVE (intended shape) ```json { "cveID": "CVE-2026-12345", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Privilege Escalation Vulnerability", "dateAdded": "2026-07-07", "shortDescription": "Microsoft Windows contains an unspecified vulnerability that allows for privilege escalation.", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "dueDate": "2026-07-28", "knownRansomwareCampaignUse": "Known", "notes": "https://example.com/advisory", "cwes": ["CWE-269"], "catalogVersion": "2026.07.07", "attribution": "This product uses data from the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog. Use of this information does not authorize use of the CISA Logo or DHS Seal, nor should such use be interpreted as an endorsement by CISA or DHS.", "fetchedAt": "2026-07-10T14:00:00.000Z" } ```` `cveID` is the dedupe key (globally unique). Absent optional fields (`notes`, empty `cwes`) are `null` / `[]` as the source provides. Every record carries the courtesy `attribution` no-endorsement string. #### Control records (not charged) Three non-CVE records may be pushed to signal run state. None triggers a `kev-returned` charge: | Record | When | Shape | |---|---|---| | `_baseline` | First run (empty prior snapshot): the full seen-`cveID` set is snapshotted as the baseline and no change events are emitted | `{ "_baseline": true, "filters": {...}, "snapshotSize": N, "catalogVersion": "...", "message": "...", "fetchedAt": "..." }` | | `_noData` | A subsequent run whose delta is empty (no new CVEs matched the filters) | `{ "_noData": true, "filters": {...}, "message": "...", "fetchedAt": "..." }` | | `_error` | The download failed after retries, or the JSON envelope drifted / parse threw | `{ "_error": true, "filters": {...}, "message": "...", "fetchedAt": "..." }` | `_baseline`/`_noData` keep a zero-delta run green and auditable rather than pushing a silent empty dataset. A first run (empty prior snapshot) seeds the baseline and reports `_baseline` — subsequent runs report only true additions, or `_noData` when there were none. ### Pricing (pay-per-event) One **`kev-returned`** event will be charged per newly-added CVE record pushed to the dataset. Cost scales with the size of the delta, not runtime or file size. Use `vendorProjects` / `products` / `knownRansomwareOnly` / `addedSince` / `maxResults` to keep spend proportional to signal. The intended price band and the reasoning behind the single-event model are in `docs/PRICING.md` — **documented-only; the live `$/event` value is owner-gated / DEFERRED** and no on-platform pricing is set in this build. (Live price shown on the Store page once published.) ### Data source & attribution The KEV catalog is distributed under **Creative Commons CC0 1.0 Universal** (public-domain-equivalent; commercial reuse explicit). No key and no attribution are required; we carry the CISA/DHS no-endorsement string on every record as a courtesy and a licence-condition reminder, and we do **not** use the CISA Logo or DHS Seal. Full compliance record: `COMPLIANCE.md`. ### Maintenance notes - **No query API — a full-file client-side diff.** The KEV catalog has no "changes since date X" endpoint. The whole ~1.5 MB feed is downloaded each run and diffed against the prior seen-`cveID` set in the KV store. The file is small, so the whole-file diff is cheap. - **Stable dedupe key.** `cveID` is globally unique — no composite-key gymnastics (unlike the LEIE monitor). New CVEs are simply `cveID`s absent from the seen set. - **Very stable envelope.** `{title, catalogVersion, dateReleased, count, vulnerabilities[]}`; the header is asserted each run and a drift throws (surfaced as an `_error` control record). Watch for occasional new per-entry fields (`cwes[]` was a later addition — tolerate unknown keys). - **Add-cadence.** The catalog updates on CISA's cadence (roughly weekly / on-add); `catalogVersion` and `dateReleased` move together. The snapshot persists across runs and the diff tolerates a skipped run. The new snapshot is written **only** after a fully successful, untruncated pass so a partial download can never poison the baseline. - **`dateAdded` watermark.** In addition to the seen-set diff, `addedSince` filters on `dateAdded` for targeted runs; `dueDate` is relayed for BOD due-date tracking (informational, no parse dependency). - **Courtesy `User-Agent`** — sent on every request (`USER_AGENT` const). # Actor input Schema ## `vendorProjects` (type: `array`): Optional. Restrict to these vendors/projects (the vendorProject field, e.g. "Microsoft", "Apache", "Cisco"). Case-insensitive exact match. Empty = all vendors. ## `products` (type: `array`): Optional. Restrict to these products (the product field, case-insensitive substring, e.g. "Windows", "Exchange Server"). Empty = all products. ## `addedSince` (type: `string`): Optional. Only emit newly-added CVEs whose catalog add-date (dateAdded) is on/after this date. Leave empty for no lower bound (emit every newly-seen CVE). ## `knownRansomwareOnly` (type: `boolean`): If on, emit only CVEs flagged as used in known ransomware campaigns (knownRansomwareCampaignUse = "Known"). Default: emit all newly-added CVEs. ## `monitorNewOnly` (type: `boolean`): Persist the set of seen cveIDs in the Actor's key-value store and, on the next run, emit only CVEs not in that set (newly-added to the KEV catalog). The first run with an empty snapshot seeds the baseline and emits nothing (or the full catalog — see README). Turns this Actor into a KEV change monitor. When off, the Actor emits the current full normalized catalog without diffing. ## `maxResults` (type: `integer`): Cap the total number of newly-added CVE records emitted this run. 0 = no cap. ## `proxyConfiguration` (type: `object`): Optional. The KEV feed is a clean, open, public static JSON file and needs NO proxy. You may enable Apify Proxy only if your network requires an egress. Default: no proxy. ## Actor input object example ```json { "vendorProjects": [], "products": [], "addedSince": "2026-06-01", "knownRansomwareOnly": false, "monitorNewOnly": true, "maxResults": 0, "proxyConfiguration": { "useApifyProxy": false } } ``` # Actor output Schema ## `vulnerabilities` (type: `string`): One newly-added (or listed) CVE from the CISA Known Exploited Vulnerabilities catalog. Rendered as the Vulnerabilities table (see the dataset schema). # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "vendorProjects": [], "products": [] }; // Run the Actor and wait for it to finish const run = await client.actor("bytehavenstudios/cisa-kev-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "vendorProjects": [], "products": [], } # Run the Actor and wait for it to finish run = client.actor("bytehavenstudios/cisa-kev-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "vendorProjects": [], "products": [] }' | apify call bytehavenstudios/cisa-kev-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=bytehavenstudios/cisa-kev-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "CISA KEV Newly-Added Vulnerability Monitor", "description": "Change-detection over the CISA Known Exploited Vulnerabilities (KEV) catalog. Diffs the feed run-to-run to emit only newly-added CVEs the moment CISA publishes them, normalized (dateAdded, dueDate, ransomware flag, CWEs) with vendor/product/since filters. Keyless, CC0. Not endorsed by CISA/DHS.", "version": "0.1", "x-build-id": "idIVHcSxaDFUDz5VH" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/bytehavenstudios~cisa-kev-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-bytehavenstudios-cisa-kev-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/bytehavenstudios~cisa-kev-monitor/runs": { "post": { "operationId": "runs-sync-bytehavenstudios-cisa-kev-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/bytehavenstudios~cisa-kev-monitor/run-sync": { "post": { "operationId": "run-sync-bytehavenstudios-cisa-kev-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "vendorProjects": { "title": "Vendor / project to watch", "type": "array", "description": "Optional. Restrict to these vendors/projects (the vendorProject field, e.g. \"Microsoft\", \"Apache\", \"Cisco\"). Case-insensitive exact match. Empty = all vendors.", "items": { "type": "string" } }, "products": { "title": "Products to watch", "type": "array", "description": "Optional. Restrict to these products (the product field, case-insensitive substring, e.g. \"Windows\", \"Exchange Server\"). Empty = all products.", "items": { "type": "string" } }, "addedSince": { "title": "Added on/after (YYYY-MM-DD)", "type": "string", "description": "Optional. Only emit newly-added CVEs whose catalog add-date (dateAdded) is on/after this date. Leave empty for no lower bound (emit every newly-seen CVE)." }, "knownRansomwareOnly": { "title": "Known ransomware-campaign use only", "type": "boolean", "description": "If on, emit only CVEs flagged as used in known ransomware campaigns (knownRansomwareCampaignUse = \"Known\"). Default: emit all newly-added CVEs.", "default": false }, "monitorNewOnly": { "title": "Only emit the delta since the last run", "type": "boolean", "description": "Persist the set of seen cveIDs in the Actor's key-value store and, on the next run, emit only CVEs not in that set (newly-added to the KEV catalog). The first run with an empty snapshot seeds the baseline and emits nothing (or the full catalog — see README). Turns this Actor into a KEV change monitor. When off, the Actor emits the current full normalized catalog without diffing.", "default": true }, "maxResults": { "title": "Max records per run", "minimum": 0, "type": "integer", "description": "Cap the total number of newly-added CVE records emitted this run. 0 = no cap.", "default": 0 }, "proxyConfiguration": { "title": "Proxy configuration", "type": "object", "description": "Optional. The KEV feed is a clean, open, public static JSON file and needs NO proxy. You may enable Apify Proxy only if your network requires an egress. Default: no proxy.", "default": { "useApifyProxy": false } } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```