CVE & CISA KEV Vulnerability Feed (NVD + EPSS, daily alerts)

CVE & CISA KEV Vulnerability Feed: New CVEs, Known Exploited Vulnerabilities & EPSS

A daily vulnerability-intelligence feed built only on official, free sources: newly published CVEs from the NIST National Vulnerability Database (NVD), newly added CISA Known Exploited Vulnerabilities (KEV), and FIRST EPSS exploit-probability scores, merged into one clean record per CVE. Filter by vendor, product, severity, CVSS, EPSS, CWE or keyword, and schedule it in new since last run mode to get only what changed.

No API keys, no logins, no scraping of private sites.

Who it's for

• Security and IT teams who want a morning list of new critical CVEs and newly exploited vulnerabilities for the vendors they actually run (Microsoft, Cisco, Fortinet, Ivanti, Citrix, VMware, Atlassian, Chrome, ...).
• MSPs / MSSPs building client advisories and patch-priority tickets.
• Vulnerability-management and GRC tools that need a clean, normalized CVE + KEV + EPSS feed via API, webhook or Google Sheets.
• Federal contractors and agencies tracking CISA KEV due dates (BOD 22-01 / BOD 26-04).
• Security newsletters, researchers and AI agents ("which actively exploited CVEs were added this week, and how likely is exploitation?") via the Apify API or MCP server.

What you get

• Three event types in one schema: newCves (published in the NVD), kevAdded (newly added to CISA KEV = confirmed exploitation in the wild), and optional updatedCves (older CVEs modified).
• Best available CVSS: NVD's own score when analyzed, otherwise the CNA's score, with cvssSource telling you which. CVSS v3.1 / v3.0 / v4.0 / v2 supported.
• KEV context on every record: inKev, date added, CISA due date, required action, vulnerability name and known ransomware campaign use.
• EPSS: probability of exploitation in the next 30 days and percentile (FIRST.org), free with every record.
• Vendors, products and CWEs from NVD CPE data and CNA affected-product data, plus references and the NVD link.
• Smart ordering: KEV additions first, then new CVEs most-severe first.
• New since last run: a schedule pays only for records it has not delivered before.

Quick start

1. Click Start with the default input: you get up to 15 recent CISA KEV additions (last 30 days) and the 15 most severe CVEs published in the last 2 days, enriched with EPSS. Takes about 20 seconds.
2. For a daily alert, create a Schedule with input like:

{
  "mode": "sinceLastRun",
  "eventTypes": ["newCves", "kevAdded"],
  "vendors": ["microsoft", "cisco", "fortinet", "ivanti", "citrix"],
  "minCvssScore": 7,
  "maxItems": 200,
  "stateKey": "my-stack"
}

3. Connect the run to Slack, email, Google Sheets, Jira or a webhook with Apify integrations.

More recipes

• Only actively exploited, ransomware-linked CVEs: {"eventTypes": ["kevAdded"], "ransomwareOnly": true, "kevLookbackDays": 90}
• High exploit probability among recent CVEs: {"eventTypes": ["newCves"], "lookbackDays": 7, "minEpss": 0.1}
• Web-app bug classes: {"cweIds": ["CWE-79", "CWE-89", "CWE-22"], "severities": ["CRITICAL", "HIGH"]}

Input

Field	Meaning
mode	window (default) or sinceLastRun (use for schedules)
eventTypes	newCves, kevAdded (default both), updatedCves (opt-in, high volume)
lookbackDays	Window for new/updated CVEs, default 2 (max 119)
kevLookbackDays	Window for KEV additions, default 30
vendors	Vendor or product substrings, e.g. microsoft, fortinet, wordpress
keywords	Words in the description, e.g. remote code execution
severities, minCvssScore	CRITICAL / HIGH / MEDIUM / LOW and a minimum base score
minEpss	Minimum EPSS probability (0-1)
cweIds	e.g. CWE-79, 89
onlyKev, ransomwareOnly	Known-exploited only; ransomware-linked only
includeEpss, includeUnscored, includeRejected	Enrichment and inclusion toggles
maxItems	Cap per run (also caps your spend), default 30
stateKey	One key per schedule in sinceLastRun mode

Output (example, a real record from Oct 31, 2026, trimmed)

{
  "cveId": "CVE-2026-111357",
  "eventType": "kevAdded",
  "published": "2026-10-15T21:17:13.190Z",
  "lastModified": "2026-10-31T04:18:16.040Z",
  "vulnStatus": "Analyzed",
  "description": "Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.",
  "cvssVersion": "3.1",
  "cvssScore": 7,
  "severity": "HIGH",
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvssSource": "CNA",
  "cwes": [
    "CWE-829"
  ],
  "vendors": [
    "ivanti"
  ],
  "products": [
    "connect_secure"
  ],
  "inKev": true,
  "kevDateAdded": "2026-10-30",
  "kevDueDate": "2026-11-02",
  "kevVulnerabilityName": "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability",
  "knownRansomwareUse": "Unknown",
  "kevVendorProject": "Ivanti",
  "kevProduct": "Connect Secure",
  "epss": 0.00316,
  "epssPercentile": 0.24569,
  "epssDate": "2026-10-30",
  "references": [
    "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935",
    "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-111357",
  "assigner": "mitre.org",
  "vendorRedacted": false,
  "firstSeenAt": "2026-10-31T09:07:53.730Z",
  "source": "NVD CVE API 2.0 + CISA KEV + FIRST EPSS"
}

Each run also writes a summary to the OUTPUT record (windows, KEV catalog version, counts per event, what filters dropped, source traffic).

Field notes:

• published / lastModified are UTC. kevDateAdded / kevDueDate are CISA's dates.
• epss is often empty for CVEs published in the last day; FIRST releases EPSS scores daily.
• vendors holds the CPE/CNA vendor identifier (usually a company, project or GitHub organisation). For plugin-marketplace CNAs (Wordfence, Patchstack, WPScan, VulDB) the vendor is often an individual developer's username, so it is withheld as [plugin developer withheld] and the ecosystem (wordpress) is shown instead; the plugin name stays in products. vendorRedacted flags this.

Data sources, timing and fair use

• NVD CVE API 2.0 (NIST). This product uses data from the NVD API but is not endorsed or certified by the NVD. Used without an API key and kept under the public rate limit (one request every 6.5 s; a default run makes 2-4 requests).
• CISA Known Exploited Vulnerabilities catalog (JSON feed, public domain). CISA usually adds entries on US business days.
• FIRST EPSS API (free; see first.org/epss). EPSS scores are estimates, not guarantees.
• NVD may lag CISA by hours for brand-new KEV entries; those records are delivered from KEV data alone (no CVSS yet) and OUTPUT.kevNvdLag counts them.
• This Actor is not affiliated with NIST, CISA or FIRST. Data is provided as published; always confirm with the vendor advisory.

Pricing

Pay per event (Apify takes care of billing; you only pay for what is delivered):

Event	Price	Charged
apify-actor-start	$0.005	once per run
cve-record	$0.003	per vulnerability record delivered (EPSS and KEV enrichment included)

A default test run (30 records) costs about $0.095. A daily vendor-filtered alert (~10 records/day) costs about $0.035/day. maxItems and Apify's max cost per run cap your spend; the Actor stops delivering when your budget is reached, so you are never charged for more than you set. No separate platform-usage charges: compute is included in the event prices.

FAQ

Do I need an NVD API key? No. The Actor uses the public, keyless NVD API politely.

How is this different from a CVE search Actor? It is a change feed: new CVEs, new KEV additions and (optionally) updated CVEs, with dedupe across runs, so a schedule only delivers what is new.

Can I watch only my tech stack? Yes, list vendors or products in vendors (and optionally minCvssScore or onlyKev).

How often should I schedule it? Daily is typical; hourly works too (sinceLastRun keeps state per stateKey).