CISA Known Exploited Vulnerabilities (KEV) Scraper

Scrape the official CISA Catalog of Known Exploited Vulnerabilities (KEV) into clean, structured JSON — one record per CVE, with the federal remediation due date, ransomware-campaign flag, vendor, product, CWEs and reference URLs. No API key required.

Why this actor is different

CISA KEV is not "another CVE feed". It is the U.S. government's authoritative list of vulnerabilities that are confirmed exploited in the wild right now — and every entry carries a legally-mandated must-patch-by date under Binding Operational Directive (BOD) 22-01. That combination — actually exploited plus remediate-by deadline — is the unique signal you cannot get from a generic CVE database. If a CVE is on KEV, attackers are already using it and there is an official clock ticking.

This is distinct from our other security data actors. Use whichever matches your question:

• EPSS Scores Scraper — probability a CVE will be exploited (predictive).
• GitHub Advisories Scraper — vulnerability advisories for open-source packages.
• NIST CPE Scraper — the product/platform dictionary (CPE).
• Exploit-DB Scraper — public proof-of-concept exploit code.

KEV vs CVSS vs EPSS in two sentences: CVSS tells you how severe a vulnerability could be and EPSS estimates the probability it will be exploited, but both are forecasts. CISA KEV is ground truth — it lists only CVEs that are already being exploited in the wild, and it adds a remediation deadline, so it is the single best list for "patch these first".

Use cases

• Patch prioritisation — feed KEV into your vuln scanner / ticketing so exploited CVEs jump the queue.
• SOC triage — enrich alerts: is this CVE on KEV, and is it ransomware-linked?
• Compliance with BOD 22-01 — U.S. federal agencies (and many contractors) must remediate KEV entries by the due date; export the catalog and track your overdue items.
• Risk scoring — combine KEV (confirmed exploited) with EPSS (probability) and CVSS (severity) for a defensible risk model.

Input

Field	Type	Default	Description
mode	select	vulnerabilities	Full KEV catalog with the filters below applied.
vendorFilter	string	—	Keep only entries whose vendor contains this text (e.g. Microsoft).
ransomwareOnly	boolean	false	Keep only CVEs used in known ransomware campaigns.
cveFilter	string	—	Keep only entries whose CVE ID contains this substring (e.g. CVE-2024).
addedSinceDays	integer	—	Keep only entries added in the last N days.
maxItems	integer	2000	Max records after filtering (cap 5000).

Example input

{
  "mode": "vulnerabilities",
  "vendorFilter": "Microsoft",
  "ransomwareOnly": true,
  "maxItems": 500
}

Output

One item per vulnerability:

{
  "cve_id": "CVE-2024-1234",
  "vendor": "Microsoft",
  "product": "Windows",
  "vulnerability_name": "Windows Kernel Elevation of Privilege Vulnerability",
  "description": "…",
  "required_action": "Apply mitigations per vendor instructions …",
  "date_added": "2024-01-10",
  "due_date": "2024-01-31",
  "days_to_remediate": 21,
  "is_overdue": true,
  "known_ransomware": true,
  "ransomware_raw": "Known",
  "cwes": ["CWE-269"],
  "cwe_count": 1,
  "notes_urls": ["https://…", "https://nvd.nist.gov/vuln/detail/CVE-2024-1234"],
  "catalog_version": "2026.08.10",
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1234",
  "source": "cisa-kev",
  "scraped_at": "2026-08-11T00:00:00Z"
}

Pricing

Roughly ~$0.50 per 1,000 records on the Apify platform (a single run of the full catalog is one cheap request). Data itself is free and public.

Source

Official CISA feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Disclaimer

Public U.S. government data (CISA KEV). Provided as-is for security and research use.