# CVE & CISA KEV Vulnerability Feed (NVD + EPSS, daily alerts) (`moment-data/cve-kev-vulnerability-feed`) Actor

New CVEs from the NVD plus newly added CISA Known Exploited Vulnerabilities (KEV), enriched with CVSS, CWE, vendor/product and FIRST EPSS exploit probability. Filter by vendor, severity, CVSS, EPSS, CWE or keyword. 'New since last run' mode for daily alerts.

- **URL**: https://apify.com/moment-data/cve-kev-vulnerability-feed.md
- **Developed by:** [Luke Miller](https://apify.com/moment-data) (community)
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE & CISA KEV Vulnerability Feed: New CVEs, Known Exploited Vulnerabilities & EPSS

A daily vulnerability-intelligence feed built only on **official, free sources**: newly published CVEs from the **NIST National Vulnerability Database (NVD)**, newly added **CISA Known Exploited Vulnerabilities (KEV)**, and **FIRST EPSS** exploit-probability scores, merged into one clean record per CVE. Filter by vendor, product, severity, CVSS, EPSS, CWE or keyword, and schedule it in *new since last run* mode to get only what changed.

No API keys, no logins, no scraping of private sites.

### Who it's for

- **Security and IT teams** who want a morning list of new critical CVEs and newly exploited vulnerabilities for the vendors they actually run (Microsoft, Cisco, Fortinet, Ivanti, Citrix, VMware, Atlassian, Chrome, ...).
- **MSPs / MSSPs** building client advisories and patch-priority tickets.
- **Vulnerability-management and GRC tools** that need a clean, normalized CVE + KEV + EPSS feed via API, webhook or Google Sheets.
- **Federal contractors and agencies** tracking CISA KEV due dates (BOD 22-01 / BOD 26-04).
- **Security newsletters, researchers and AI agents** ("which actively exploited CVEs were added this week, and how likely is exploitation?") via the Apify API or MCP server.

### What you get

- **Three event types in one schema:** `newCves` (published in the NVD), `kevAdded` (newly added to CISA KEV = confirmed exploitation in the wild), and optional `updatedCves` (older CVEs modified).
- **Best available CVSS:** NVD's own score when analyzed, otherwise the CNA's score, with `cvssSource` telling you which. CVSS v3.1 / v3.0 / v4.0 / v2 supported.
- **KEV context on every record:** `inKev`, date added, CISA due date, required action, vulnerability name and **known ransomware campaign use**.
- **EPSS:** probability of exploitation in the next 30 days and percentile (FIRST.org), free with every record.
- **Vendors, products and CWEs** from NVD CPE data and CNA affected-product data, plus references and the NVD link.
- **Smart ordering:** KEV additions first, then new CVEs most-severe first.
- **New since last run:** a schedule pays only for records it has not delivered before.

### Quick start

1. Click **Start** with the default input: you get up to 15 recent CISA KEV additions (last 30 days) and the 15 most severe CVEs published in the last 2 days, enriched with EPSS. Takes about 20 seconds.
2. For a daily alert, create a **Schedule** with input like:

```json
{
  "mode": "sinceLastRun",
  "eventTypes": ["newCves", "kevAdded"],
  "vendors": ["microsoft", "cisco", "fortinet", "ivanti", "citrix"],
  "minCvssScore": 7,
  "maxItems": 200,
  "stateKey": "my-stack"
}
```

3. Connect the run to **Slack, email, Google Sheets, Jira or a webhook** with Apify integrations.

#### More recipes

- Only actively exploited, ransomware-linked CVEs: `{"eventTypes": ["kevAdded"], "ransomwareOnly": true, "kevLookbackDays": 90}`
- High exploit probability among recent CVEs: `{"eventTypes": ["newCves"], "lookbackDays": 7, "minEpss": 0.1}`
- Web-app bug classes: `{"cweIds": ["CWE-79", "CWE-89", "CWE-22"], "severities": ["CRITICAL", "HIGH"]}`

### Input

| Field | Meaning |
|---|---|
| `mode` | `window` (default) or `sinceLastRun` (**use for schedules**) |
| `eventTypes` | `newCves`, `kevAdded` (default both), `updatedCves` (opt-in, high volume) |
| `lookbackDays` | Window for new/updated CVEs, default 2 (max 119) |
| `kevLookbackDays` | Window for KEV additions, default 30 |
| `vendors` | Vendor or product substrings, e.g. `microsoft`, `fortinet`, `wordpress` |
| `keywords` | Words in the description, e.g. `remote code execution` |
| `severities`, `minCvssScore` | CRITICAL / HIGH / MEDIUM / LOW and a minimum base score |
| `minEpss` | Minimum EPSS probability (0-1) |
| `cweIds` | e.g. `CWE-79`, `89` |
| `onlyKev`, `ransomwareOnly` | Known-exploited only; ransomware-linked only |
| `includeEpss`, `includeUnscored`, `includeRejected` | Enrichment and inclusion toggles |
| `maxItems` | Cap per run (also caps your spend), default 30 |
| `stateKey` | One key per schedule in `sinceLastRun` mode |

### Output (example, a real record from Oct 31, 2026, trimmed)

```json
{
  "cveId": "CVE-2026-111357",
  "eventType": "kevAdded",
  "published": "2026-10-15T21:17:13.190Z",
  "lastModified": "2026-10-31T04:18:16.040Z",
  "vulnStatus": "Analyzed",
  "description": "Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.",
  "cvssVersion": "3.1",
  "cvssScore": 7,
  "severity": "HIGH",
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvssSource": "CNA",
  "cwes": [
    "CWE-829"
  ],
  "vendors": [
    "ivanti"
  ],
  "products": [
    "connect_secure"
  ],
  "inKev": true,
  "kevDateAdded": "2026-10-30",
  "kevDueDate": "2026-11-02",
  "kevVulnerabilityName": "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability",
  "knownRansomwareUse": "Unknown",
  "kevVendorProject": "Ivanti",
  "kevProduct": "Connect Secure",
  "epss": 0.00316,
  "epssPercentile": 0.24569,
  "epssDate": "2026-10-30",
  "references": [
    "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935",
    "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-111357",
  "assigner": "mitre.org",
  "vendorRedacted": false,
  "firstSeenAt": "2026-10-31T09:07:53.730Z",
  "source": "NVD CVE API 2.0 + CISA KEV + FIRST EPSS"
}
```

Each run also writes a summary to the `OUTPUT` record (windows, KEV catalog version, counts per event, what filters dropped, source traffic).

Field notes:

- `published` / `lastModified` are UTC. `kevDateAdded` / `kevDueDate` are CISA's dates.
- `epss` is often empty for CVEs published in the last day; FIRST releases EPSS scores daily.
- `vendors` holds the CPE/CNA vendor identifier (usually a company, project or GitHub organisation). For plugin-marketplace CNAs (Wordfence, Patchstack, WPScan, VulDB) the vendor is often an individual developer's username, so it is withheld as `[plugin developer withheld]` and the ecosystem (`wordpress`) is shown instead; the plugin name stays in `products`. `vendorRedacted` flags this.

### Data sources, timing and fair use

- **NVD CVE API 2.0** (NIST). *This product uses data from the NVD API but is not endorsed or certified by the NVD.* Used without an API key and kept under the public rate limit (one request every 6.5 s; a default run makes 2-4 requests).
- **CISA Known Exploited Vulnerabilities catalog** (JSON feed, public domain). CISA usually adds entries on US business days.
- **FIRST EPSS API** (free; see [first.org/epss](https://www.first.org/epss)). EPSS scores are estimates, not guarantees.
- NVD may lag CISA by hours for brand-new KEV entries; those records are delivered from KEV data alone (no CVSS yet) and `OUTPUT.kevNvdLag` counts them.
- This Actor is not affiliated with NIST, CISA or FIRST. Data is provided as published; always confirm with the vendor advisory.

### Pricing

Pay per event (Apify takes care of billing; you only pay for what is delivered):

| Event | Price | Charged |
|---|---|---|
| `apify-actor-start` | $0.005 | once per run |
| `cve-record` | $0.003 | per vulnerability record delivered (EPSS and KEV enrichment included) |

A default test run (30 records) costs about $0.095. A daily vendor-filtered alert (~10 records/day) costs about $0.035/day. `maxItems` and Apify's *max cost per run* cap your spend; the Actor stops delivering when your budget is reached, so you are never charged for more than you set. No separate platform-usage charges: compute is included in the event prices.

### FAQ

**Do I need an NVD API key?** No. The Actor uses the public, keyless NVD API politely.

**How is this different from a CVE search Actor?** It is a change feed: new CVEs, new KEV additions and (optionally) updated CVEs, with dedupe across runs, so a schedule only delivers what is new.

**Can I watch only my tech stack?** Yes, list vendors or products in `vendors` (and optionally `minCvssScore` or `onlyKev`).

**How often should I schedule it?** Daily is typical; hourly works too (`sinceLastRun` keeps state per `stateKey`).

# Actor input Schema

## `mode` (type: `string`):

window (default): everything in the lookback windows, no saved state. sinceLastRun: only records not delivered before for this State key; use this for daily or hourly schedules.

## `eventTypes` (type: `array`):

newCves: CVEs newly published in the NVD. kevAdded: CVEs newly added to the CISA Known Exploited Vulnerabilities catalog (actively exploited). updatedCves: older CVEs modified in the window (re-scored, new references, KEV flag), can be high volume.

## `lookbackDays` (type: `integer`):

Window for newCves / updatedCves (NVD publishes ~300-600 CVEs per day). Also the first-run window in sinceLastRun mode.

## `kevLookbackDays` (type: `integer`):

Window for kevAdded (CISA adds roughly 5-40 CVEs per month).

## `vendors` (type: `array`):

Only CVEs whose vendor or product contains one of these (case-insensitive), e.g. microsoft, cisco, fortinet, apache, ivanti, wordpress, chrome. Matched against NVD CPE data, CNA affected-product data, KEV vendor/product and the description.

## `keywords` (type: `array`):

e.g. remote code execution, authentication bypass, SQL injection.

## `severities` (type: `array`):

Empty = all. KEV records without a score yet are kept.

## `minCvssScore` (type: `number`):

0 = no minimum. Uses NVD's score, or the CNA's score if NVD has not scored it yet (see cvssSource).

## `minEpss` (type: `number`):

Optional, e.g. 0.1 = 10% probability of exploitation in the next 30 days (FIRST EPSS). Brand-new CVEs often have no EPSS score until the next daily EPSS release. KEV records always pass.

## `cweIds` (type: `array`):

e.g. CWE-79, CWE-89, 787. Empty = all.

## `onlyKev` (type: `boolean`):

Only known-exploited vulnerabilities (also applies to newCves and updatedCves).

## `ransomwareOnly` (type: `boolean`):

Only CVEs CISA marks as used in ransomware campaigns.

## `includeEpss` (type: `boolean`):

Adds FIRST EPSS probability and percentile to each record (free, no extra charge).

## `includeUnscored` (type: `boolean`):

Many new CVEs are published before anyone scores them.

## `includeRejected` (type: `boolean`):

CVE IDs marked REJECTED by their CNA.

## `maxItems` (type: `integer`):

Hard cap on delivered records (also caps your spend). When several event types are on, KEV additions get a fair share first. Default is small so a first run is quick and cheap.

## `stateKey` (type: `string`):

Name of the saved feed for sinceLastRun mode. Use one key per schedule.

## Actor input object example

```json
{
  "mode": "window",
  "eventTypes": [
    "newCves",
    "kevAdded"
  ],
  "lookbackDays": 2,
  "kevLookbackDays": 30,
  "minCvssScore": 0,
  "onlyKev": false,
  "ransomwareOnly": false,
  "includeEpss": true,
  "includeUnscored": true,
  "includeRejected": false,
  "maxItems": 30,
  "stateKey": "default"
}
```

# Actor output Schema

## `vulnerabilities` (type: `string`):

One record per CVE event (new CVE, KEV addition, update).

## `summary` (type: `string`):

Windows covered, KEV catalog version, counts, filters dropped.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("moment-data/cve-kev-vulnerability-feed").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("moment-data/cve-kev-vulnerability-feed").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call moment-data/cve-kev-vulnerability-feed --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,moment-data/cve-kev-vulnerability-feed"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1ocOci9ljCACVUr9H/builds/leSODqFj52ig7Gcv6/openapi.json