CISA KEV + EPSS Scraper – Exploited CVEs

CISA KEV + EPSS scraper that downloads the CISA Known Exploited Vulnerabilities catalog and optionally enriches each CVE with FIRST EPSS exploit-prediction scores — for vulnerability prioritization without login.

What does it do?

• CVE ID, vendor, product and vulnerability name.
• Date added, due date, required action.
• Known ransomware campaign use flag.
• Optional EPSS score and percentile from FIRST.

Use cases

• Vulnerability management: prioritize KEV items by EPSS.
• Security alerts: feed SIEM / Slack bots.
• Compliance: evidence of KEV tracking.
• AI agents: ask an agent which KEVs matter this week.

Input

Field	Description
includeEpss	Call FIRST EPSS API for each CVE (batched).
vendorContains	Case-insensitive filter. Example: Microsoft
maxItems	Newest dateAdded first. Example: 100

Example input:

{
  "includeEpss": true,
  "vendorContains": "",
  "maxItems": 25
}

Output

Real output (first items of a run on 26 Oct 2026):

[
  {
    "cveId": "CVE-2026-109618",
    "vendorProject": "PHP Group",
    "product": "PHP",
    "vulnerabilityName": "PHP Memory Corruption Vulnerability",
    "dateAdded": "2026-10-26",
    "dueDate": "2026-10-29",
    "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "knownRansomwareCampaignUse": "Unknown",
    "epss": 0.99981,
    "epssPercentile": 0.99981,
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618"
  },
  {
    "cveId": "CVE-2026-109619",
    "vendorProject": "PHP Group",
    "product": "PHP",
    "vulnerabilityName": "PHP Stale Internal Request-State Vulnerability",
    "dateAdded": "2026-10-26",
    "dueDate": "2026-10-29",
    "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "knownRansomwareCampaignUse": "Unknown",
    "epss": 0.99997,
    "epssPercentile": 0.99989,
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619"
  }
]

Export the results as JSON, CSV or Excel, read them through the API, or send them to Google Sheets, Make, Zapier, n8n or webhooks. You can also run this Actor from AI agents through the Apify MCP server.

Pricing

Pay per event: $1.60 per 1,000 vulnerabilitys plus $0.00005 per run start. There is no extra platform usage charge.

FAQ

How fresh is KEV? CISA publishes catalog updates; this Actor fetches the live JSON feed.

What is EPSS? FIRST's Exploit Prediction Scoring System — probability a CVE will be exploited in the wild.

Personal data? None; CVE/product metadata only.

Do I need a login or API key? No. It uses the source's public API; you only need an Apify account.

Can AI agents use it? Yes. Call it through the Apify API, or from Claude, Cursor or any MCP client via the Apify MCP server.

Data source and license

Sources: CISA KEV catalog JSON (U.S. government work) and FIRST EPSS API ("makes the data freely and openly accessible via CSV and API"). Not affiliated with CISA or FIRST.

This Actor is not affiliated with or endorsed by the data source. You are responsible for using the data in line with the source's license and terms.