CVE Exploit Priority: CISA KEV + EPSS in one call
Pricing
from $2.00 / 1,000 cve checkeds
CVE Exploit Priority: CISA KEV + EPSS in one call
Paste CVE IDs or raw scanner text; get CISA KEV status (date added, due date, ransomware use) plus today's EPSS exploit probability, ranked P1/P2/P3 for patching. Built for agents and triage.
Pricing
from $2.00 / 1,000 cve checkeds
Rating
0.0
(0)
Developer
Blake Runckel
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
17 hours ago
Last modified
Categories
Share
Paste CVE IDs, or any raw text such as scanner output, an advisory or a ticket. For each CVE you get:
- CISA KEV status: whether the CVE is in the Known Exploited Vulnerabilities catalog, the date it was added, the federal remediation due date, known ransomware campaign use, vendor, product and required action.
- EPSS: today's probability that the CVE is exploited in the next 30 days, plus its percentile.
- A patch-priority tier:
P1-known-exploited(in KEV),P2-likely-exploited(EPSS ≥ your threshold),P3-monitor, orunscored(EPSS has no score for the ID).
Rows are sorted P1 first. This makes it a one-step triage tool for AI agents, SOC workflows and vulnerability-management scripts.
Input
| Field | Description |
|---|---|
cveIds | One CVE ID per line. |
text | Optional free text. Every CVE-YYYY-NNNN in it is extracted and de-duplicated. |
epssThreshold | Default 0.1. A common field convention. EPSS itself recommends no universal threshold. |
Output (per CVE)
cve, priority, inKev, kevDateAdded, kevDueDate, kevRansomwareUse, kevVendor, kevProduct, kevName, kevRequiredAction, epss, epssPercentile, epssDate, kevCatalogVersion, checkedAt, nvdUrl, attribution
Limits
- EPSS is a likelihood estimate, not a risk score. It knows nothing about your environment. FIRST advises that KEV takes precedence when a CVE is listed, and the tiers follow that advice.
- The tiers are a simple rule (KEV, then EPSS threshold). They are not advice for your environment.
- Both sources are read live on every run, and nothing is cached across runs. EPSS updates daily around 13:30 UTC.
Pricing
Pay per event: $0.002 per CVE checked (one dataset row), plus Apify's standard tiny Actor-start event.
Sources and terms
- CISA Known Exploited Vulnerabilities catalog JSON feed, published under CC0 1.0 (https://www.cisa.gov/sites/default/files/licenses/kev/license.txt). Use of the data does not imply endorsement by CISA or DHS.
- EPSS scores from FIRST (https://api.first.org/data/v1/epss), published freely with no registration. Attribution is requested: See EPSS at https://www.first.org/epss. The API is limited to 1000 requests/min, and this Actor batches 100 CVEs per request. Not affiliated with CISA, DHS or FIRST.
Built by Ledger.
