CVE Exploit Check - CISA KEV + EPSS Lookup for AI Agents

Is this CVE being exploited, and how urgently should I patch it? Give CVE IDs, or search by vendor, product or keyword. For each CVE you get:

• CISA KEV status: whether it's in the Known Exploited Vulnerabilities catalog, the date added, the remediation due date, and known ransomware campaign use.
• FIRST EPSS: the probability of exploitation in the next 30 days, and its percentile (epss.first.org).
• A plain priority label, vendor, product, vulnerability name, CWEs, a short description and the NVD link.

Built for AI agents and MCP: short inputs, one compact JSON row per CVE.

Example output

{ "cve": "CVE-2021-44228", "inKev": true, "kevDateAdded": "2021-12-10", "kevDueDate": "2021-12-24", "knownRansomwareUse": true,
  "epss": 0.99999, "epssPercentile": 1, "priority": "exploited (patch by due date)", "vendor": "Apache", "product": "Log4j2" }

How to use

• Check specific CVEs: {"cves": ["CVE-2021-44228", "CVE-2024-3400"]}
• Search the KEV catalog: {"vendor": "Fortinet"}, {"product": "Exchange"} or {"keyword": "remote code execution", "maxResults": 20} returns matching KEV entries, newest first, each enriched with EPSS.

knownRansomwareUse is true (Known), false, or null when CISA lists it as Unknown.

How much does it cost?

$0.002 per CVE ($2 per 1,000). No subscription. Invalid IDs and CVEs with no KEV entry and no EPSS score are free. Set a maximum total charge per run and the Actor stops at your budget. EPSS is fetched in batches of 100 as CVEs are checked, so batches beyond your budget are never requested.

On Apify's free plan, the $5 monthly usage credit covers up to about 2,500 CVEs a month (less if you use other Apify Actors or services).

Data sources and freshness

• The CISA KEV JSON feed, downloaded once per run (public, no key). Each row includes the catalog version.
• The FIRST EPSS API, batched at 100 CVEs per request (public, no key). EPSS scores update daily.

CISA (US government) and FIRST (industry) publish these free. There's no scanning and no personal data. EPSS is a probability, not proof of exploitation, and KEV lists only exploitation that CISA has confirmed.

Data sources and attribution

CISA Known Exploited Vulnerabilities (KEV) catalog, cisa.gov/kev, CC0 1.0. EPSS scores from FIRST (first.org/epss), generated by Empirical Security. This Actor is not affiliated with or endorsed by CISA, DHS or FIRST. EPSS is a probability estimate, not proof of exploitation.

Every row has a rowId, stable per input item. In the rare case a dataset save times out after the row was stored, an uncharged error row with the same rowId follows; keep the non-error row for each rowId.

Use from AI agents (Apify MCP)

Add https://mcp.apify.com?tools=lentic_labs/cve-kev-epss-lookup to your MCP client, or call run-sync-get-dataset-items through the Apify API.

FAQ

Why isn't my CVE in KEV? Most CVEs are never known to be exploited. Use the EPSS score to prioritise those.

What's a high EPSS? It's relative. A score of 0.1 or more (10%) is usually in the top few percent of all CVEs; the epssPercentile field shows where it ranks.

Related

Domain email & TLS security check and Package vulnerability check by Lentic Labs.