# CISA KEV Known Exploited Vulnerabilities Scraper (`ninhothedev/cisa-kev-scraper`) Actor

$1/1K 🔥 CISA KEV Feed! Grab every Known Exploited Vulnerability with CVE, dates & ransomware flags. No key. JSON, CSV, Excel or API in seconds. Prioritize patching and feed your SOC threat intel ⚡

- **URL**: https://apify.com/ninhothedev/cisa-kev-scraper.md
- **Developed by:** [ninhothedev](https://apify.com/ninhothedev) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CISA Known Exploited Vulnerabilities (KEV) Scraper

Scrape the official **CISA Catalog of Known Exploited Vulnerabilities (KEV)** into clean, structured JSON — one record per CVE, with the **federal remediation due date**, **ransomware-campaign flag**, vendor, product, CWEs and reference URLs. **No API key required.**

### Why this actor is different

CISA KEV is not "another CVE feed". It is the U.S. government's authoritative list of vulnerabilities that are **confirmed exploited in the wild right now** — and every entry carries a legally-mandated **must-patch-by date** under Binding Operational Directive (BOD) 22-01. That combination — *actually exploited* **plus** *remediate-by deadline* — is the unique signal you cannot get from a generic CVE database. If a CVE is on KEV, attackers are already using it and there is an official clock ticking.

This is distinct from our other security data actors. Use whichever matches your question:

- **[EPSS Scores Scraper](https://apify.com/ninhothedev/epss-scores-scraper)** — *probability* a CVE will be exploited (predictive).
- **[GitHub Advisories Scraper](https://apify.com/ninhothedev/github-advisories-scraper)** — vulnerability advisories for open-source packages.
- **[NIST CPE Scraper](https://apify.com/ninhothedev/nist-cpe-scraper)** — the product/platform dictionary (CPE).
- **[Exploit-DB Scraper](https://apify.com/ninhothedev/exploit-db-scraper)** — public proof-of-concept exploit code.

**KEV vs CVSS vs EPSS in two sentences:** CVSS tells you how *severe* a vulnerability *could* be and EPSS estimates the *probability* it will be exploited, but both are forecasts. CISA KEV is *ground truth* — it lists only CVEs that are **already being exploited in the wild**, and it adds a remediation deadline, so it is the single best list for "patch these first".

### Use cases

- **Patch prioritisation** — feed KEV into your vuln scanner / ticketing so exploited CVEs jump the queue.
- **SOC triage** — enrich alerts: is this CVE on KEV, and is it ransomware-linked?
- **Compliance with BOD 22-01** — U.S. federal agencies (and many contractors) must remediate KEV entries by the due date; export the catalog and track your overdue items.
- **Risk scoring** — combine KEV (confirmed exploited) with EPSS (probability) and CVSS (severity) for a defensible risk model.

### Input

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| `mode` | select | `vulnerabilities` | Full KEV catalog with the filters below applied. |
| `vendorFilter` | string | — | Keep only entries whose vendor contains this text (e.g. `Microsoft`). |
| `ransomwareOnly` | boolean | `false` | Keep only CVEs used in known ransomware campaigns. |
| `cveFilter` | string | — | Keep only entries whose CVE ID contains this substring (e.g. `CVE-2024`). |
| `addedSinceDays` | integer | — | Keep only entries added in the last N days. |
| `maxItems` | integer | `2000` | Max records after filtering (cap 5000). |

#### Example input

```json
{
  "mode": "vulnerabilities",
  "vendorFilter": "Microsoft",
  "ransomwareOnly": true,
  "maxItems": 500
}
```

### Output

One item per vulnerability:

```json
{
  "cve_id": "CVE-2024-1234",
  "vendor": "Microsoft",
  "product": "Windows",
  "vulnerability_name": "Windows Kernel Elevation of Privilege Vulnerability",
  "description": "…",
  "required_action": "Apply mitigations per vendor instructions …",
  "date_added": "2024-01-10",
  "due_date": "2024-01-31",
  "days_to_remediate": 21,
  "is_overdue": true,
  "known_ransomware": true,
  "ransomware_raw": "Known",
  "cwes": ["CWE-269"],
  "cwe_count": 1,
  "notes_urls": ["https://…", "https://nvd.nist.gov/vuln/detail/CVE-2024-1234"],
  "catalog_version": "2026.08.10",
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1234",
  "source": "cisa-kev",
  "scraped_at": "2026-08-11T00:00:00Z"
}
```

### Pricing

Roughly **~$0.50 per 1,000 records** on the Apify platform (a single run of the full catalog is one cheap request). Data itself is free and public.

### Source

Official CISA feed: `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`

### Disclaimer

Public U.S. government data (CISA KEV). Provided as-is for security and research use.

# Actor input Schema

## `mode` (type: `string`):

What to scrape. 'vulnerabilities' returns the full CISA KEV catalog (with the filters below applied).

## `vendorFilter` (type: `string`):

Optional. Keep only entries whose vendor/project contains this text (case-insensitive), e.g. 'Microsoft', 'Cisco', 'Apple'. Leave empty for all vendors.

## `ransomwareOnly` (type: `boolean`):

Optional. If true, keep only CVEs that CISA has flagged as used in known ransomware campaigns (knownRansomwareCampaignUse == 'Known').

## `cveFilter` (type: `string`):

Optional. Keep only entries whose CVE ID contains this substring (case-insensitive), e.g. 'CVE-2024' for a whole year or a full ID like 'CVE-2024-1234'.

## `addedSinceDays` (type: `integer`):

Optional. Keep only entries added to the KEV catalog within the last N days (based on dateAdded). Useful for monitoring newly-listed threats.

## `maxItems` (type: `integer`):

Maximum number of records to output after filtering. Default 2000, hard cap 5000 (the catalog currently holds ~1600+ entries).

## Actor input object example

```json
{
  "mode": "vulnerabilities",
  "vendorFilter": "Microsoft",
  "ransomwareOnly": false,
  "cveFilter": "CVE-2024",
  "addedSinceDays": 30,
  "maxItems": 2000
}
```

# Actor output Schema

## `vulnerabilities` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("ninhothedev/cisa-kev-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("ninhothedev/cisa-kev-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call ninhothedev/cisa-kev-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ninhothedev/cisa-kev-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Oc9bKGUxuMxAcUmP6/builds/Vp8DmhcuDGzgn7JM9/openapi.json