CISA KEV Scraper API — Known Exploited CVE Catalog

Search the current official CISA Known Exploited Vulnerabilities (KEV) Catalog for source-linked vulnerability-prioritization evidence. This paid API/scraper is useful for exposure-management queues, remediation-deadline review, security research, vulnerability intelligence, and vendor/product monitoring.

No API key, login, browser, proxy, or unofficial mirror is used. Empty input returns one newest CISA catalog entry, so the first run is deterministic and non-empty while the catalog is available.

Search inputs

• exact/partial CVE ID, vendor/project, product, vulnerability name, or broad keyword;
• CISA-reported known-ransomware-campaign-use value;
• CISA added-date and required-action due-date ranges;
• records overdue relative to the retrieval day;
• bounded maxCandidates catalog scan and total maxResults output cap.

{"cveId":"CVE-2026-20316","maxResults":1}

{"vendor":"Cisco","knownRansomwareCampaignUse":"Known","dateAddedFrom":"2026-01-01","maxCandidates":2000,"maxResults":25}

{"overdueOnly":true,"dueDateTo":"2026-12-31","maxResults":50}

Output

Each found record includes CISA's CVE ID, vendor/project, product, vulnerability name, added date, description, required action, due date, ransomware-use field, notes, CWEs, NVD CVE link, catalog version/release time, official feed URL, retrieval time, and bounded-query disclosure. NO_MATCH, INVALID_INPUT, and SOURCE_UNAVAILABLE are explicit dataset items.

Results sort deterministically by newest CISA dateAdded, then CVE ID. maxCandidates bounds the source entries inspected before filtering; broad searches can be incomplete when candidateScanBoundApplied=true.

Pricing and scope

Pricing is $0.0001 per start + $0.002 per dataset item. The one-row default costs at most $0.0021. Runtime reduces maxResults before retrieval if an Apify total-charge budget requires it.

The source is CISA's current JSON catalog: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

CISA KEV means CISA has evidence that a listed vulnerability has been exploited. It does not establish that every deployment is vulnerable, internet-exposed, unpatched, or compromised. The catalog is not a complete vulnerability inventory, a live asset scan, an incident determination, or a guarantee of remediation priority for a specific environment. Due dates and required actions are CISA catalog evidence and can change; confirm consequential operational decisions with current vendor, CISA, and environment-specific evidence.