CISA KEV CVE Batch Lookup

What can this tool do?

Compare an existing list of CVE identifiers with a dated snapshot of CISA's Known Exploited Vulnerabilities catalog. Receive a traceable JSON/CSV row per unique input identifier.

How to use it

{"cves":["CVE-2021-44228","CVE-2017-0144"],"maxAgeDays":14,"maxResults":20,"maxRequests":1}

Accepts up to 100 syntactically valid CVE identifiers. Case differences and duplicate identifiers are normalized. A malformed identifier rejects the input before a source request.

The catalog is downloaded once per run from CISA's own official GitHub mirror. Each row contains matched or not_in_catalog status, available vendor/product/date and required-action text from the source, catalog version/date, check time, source URL, license and a SHA256 checksum. hashScope explicitly identifies the checksum as JSON.stringify of the parsed source object.

not_in_catalog does not mean safe, not exploited or applicable to your assets. It does not establish that the supplied CVE exists. This is a catalog lookup, not an asset scanner, security certification, severity score, remediation decision or exploit retrieval tool. No input CVE list is sent to the source; the run downloads the catalog and compares locally.

Freshness and failure

The default maximum catalog age is 14 days, configurable from 1 to 30. A stale, future-dated, inconsistent or unavailable catalog stops the run rather than returning false absence. The official mirror can lag the canonical CISA catalog. This is not real-time monitoring. A resumed run can read a newer snapshot; omit CHECKPOINT to recheck all identifiers.

Pricing

$1.00 per 1,000 completed CVE lookups ($0.001 each), plus $0.00005 when a run starts at the supported 256–512 MB memory range. Both matched and not_in_catalog are completed lookups and have the same fee. A source failure produces no lookup rows; the start fee can still apply. Set a spending limit before running.

Is it legal?

Official mirror and its CC0 license: https://github.com/cisagov/kev-data

Linked third-party material has its own terms and is not fetched. This independent tool is not endorsed by CISA or DHS.

What data does it return?

Results are written to the Apify dataset. OUTPUT reports whether the export completed and why it stopped. RESULTS_CSV contains the rows delivered in this run. CHECKPOINT can continue with the same source inputs; omit it for a fresh export.

Requests are sequential within a run, restricted to the documented source, and bounded by timeout, response size, request count and output count. There are no automatic retries, proxy rotations or redirect fallbacks. Source failures are reported separately from an empty or absent result.

Continuation is best effort. A crash between delivery and checkpoint persistence can repeat rows; the source can change between runs. This is not an immutable snapshot, exactly-once delivery or monitoring. CSV text that could be interpreted as a spreadsheet formula is prefixed with an apostrophe.

FAQ

Can I use the original source for free? Yes. The Actor fee pays for the packaged batch workflow and Apify delivery, not exclusive access to the public source.

Does a completed export prove the source is complete or correct? No. Read the stated coverage, status, source dates and limitations before relying on a row.

Feedback

Use the Actor's Issues tab for a reproducible problem. Include a small public example, OUTPUT and the expected result. Do not post tokens, confidential inventories or customer data in a public issue. Report upstream data errors to the original provider.