# CVE Exploit Check - CISA KEV + EPSS Lookup for AI Agents (`lentic_labs/cve-kev-epss-lookup`) Actor

Is this CVE exploited in the wild? Look up CVE IDs or search by vendor/product/keyword and get CISA KEV status, date added, due date, ransomware use, plus the FIRST EPSS exploit probability and percentile. Compact JSON for AI agents and MCP. $2 per 1,000 CVEs.

- **URL**: https://apify.com/lentic_labs/cve-kev-epss-lookup.md
- **Developed by:** [Lentic Labs](https://apify.com/lentic_labs) (community)
- **Categories:** Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 cves

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Exploit Check - CISA KEV + EPSS Lookup for AI Agents

**Is this CVE being exploited, and how urgently should I patch it?** Give CVE IDs, or search by vendor, product or keyword. For each CVE you get:

- **CISA KEV status**: whether it's in the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), the date added, the remediation due date, and known ransomware campaign use.
- **FIRST EPSS**: the probability of exploitation in the next 30 days, and its percentile ([epss.first.org](https://www.first.org/epss/)).
- A plain `priority` label, vendor, product, vulnerability name, CWEs, a short description and the NVD link.

Built for **AI agents and MCP**: short inputs, one compact JSON row per CVE.

### Example output

```json
{ "cve": "CVE-2021-44228", "inKev": true, "kevDateAdded": "2021-12-10", "kevDueDate": "2021-12-24", "knownRansomwareUse": true,
  "epss": 0.99999, "epssPercentile": 1, "priority": "exploited (patch by due date)", "vendor": "Apache", "product": "Log4j2" }
```

### How to use

- **Check specific CVEs**: `{"cves": ["CVE-2021-44228", "CVE-2024-3400"]}`
- **Search the KEV catalog**: `{"vendor": "Fortinet"}`, `{"product": "Exchange"}` or `{"keyword": "remote code execution", "maxResults": 20}` returns matching KEV entries, newest first, each enriched with EPSS.

`knownRansomwareUse` is `true` (Known), `false`, or `null` when CISA lists it as Unknown.

### How much does it cost?

**$0.002 per CVE ($2 per 1,000).** No subscription. Invalid IDs and CVEs with no KEV entry and no EPSS score are free. Set a maximum total charge per run and the Actor stops at your budget. EPSS is fetched in batches of 100 as CVEs are checked, so batches beyond your budget are never requested.

On Apify's free plan, the $5 monthly usage credit covers up to about 2,500 CVEs a month (less if you use other Apify Actors or services).

### Data sources and freshness

- The CISA KEV JSON feed, downloaded once per run (public, no key). Each row includes the catalog version.
- The FIRST EPSS API, batched at 100 CVEs per request (public, no key). EPSS scores update daily.

CISA (US government) and FIRST (industry) publish these free. There's no scanning and no personal data. EPSS is a probability, not proof of exploitation, and KEV lists only exploitation that CISA has confirmed.

### Data sources and attribution

CISA Known Exploited Vulnerabilities (KEV) catalog, [cisa.gov/kev](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CC0 1.0. EPSS scores from FIRST ([first.org/epss](https://www.first.org/epss/)), generated by Empirical Security. This Actor is not affiliated with or endorsed by CISA, DHS or FIRST. EPSS is a probability estimate, not proof of exploitation.

Every row has a `rowId`, stable per input item. In the rare case a dataset save times out after the row was stored, an uncharged `error` row with the same `rowId` follows; keep the non-error row for each `rowId`.

### Use from AI agents (Apify MCP)

Add `https://mcp.apify.com?tools=lentic_labs/cve-kev-epss-lookup` to your MCP client, or call `run-sync-get-dataset-items` through the Apify API.

### FAQ

**Why isn't my CVE in KEV?** Most CVEs are never known to be exploited. Use the EPSS score to prioritise those.

**What's a high EPSS?** It's relative. A score of 0.1 or more (10%) is usually in the top few percent of all CVEs; the `epssPercentile` field shows where it ranks.

### Related

[Domain email & TLS security check](https://apify.com/lentic_labs/domain-email-tls-check) and [Package vulnerability check](https://apify.com/lentic_labs/package-vulnerability-check) by Lentic Labs.

# Actor input Schema

## `cves` (type: `array`):

CVE IDs to check, e.g. CVE-2021-44228. Case and stray spaces are fixed automatically.

## `vendor` (type: `string`):

Optional: return KEV entries whose vendor contains this text, e.g. 'Microsoft', 'Citrix', 'Fortinet'. Newest first.

## `product` (type: `string`):

Optional: return KEV entries whose product contains this text, e.g. 'Exchange', 'FortiOS'.

## `keyword` (type: `string`):

Optional: search KEV vulnerability names and descriptions, e.g. 'remote code execution'.

## `maxResults` (type: `integer`):

Cap on CVEs returned from the vendor/product/keyword search (listed CVE IDs are always checked).

## Actor input object example

```json
{
  "cves": [
    "CVE-2021-44228",
    "CVE-2023-4966",
    "CVE-2024-3400",
    "CVE-2019-0708"
  ],
  "maxResults": 50
}
```

# Actor output Schema

## `results` (type: `string`):

Default dataset, overview view.

## `summary` (type: `string`):

Counts: CVEs checked, how many are in KEV, catalog version.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cves": [
        "CVE-2021-44228",
        "CVE-2023-4966",
        "CVE-2024-3400",
        "CVE-2019-0708"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("lentic_labs/cve-kev-epss-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "cves": [
        "CVE-2021-44228",
        "CVE-2023-4966",
        "CVE-2024-3400",
        "CVE-2019-0708",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("lentic_labs/cve-kev-epss-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cves": [
    "CVE-2021-44228",
    "CVE-2023-4966",
    "CVE-2024-3400",
    "CVE-2019-0708"
  ]
}' |
apify call lentic_labs/cve-kev-epss-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,lentic_labs/cve-kev-epss-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/UIRR0I8B3EmgSkh7J/builds/v0lllls7Ivn91Vgnj/openapi.json