CISA KEV Record Change Monitor

Monitor one exact CVE in the U.S. Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. Repeated checks return a baseline, unchanged result, or exact before/after changes to vendor, product, vulnerability name, dates, description, required action, ransomware-campaign use, notes, and CWEs.

Built for vulnerability-management and SOC teams that already have a CVE watchlist and need durable per-record change history. It does not scan systems, determine exposure, rank risk, or remediate anything. CISA's catalog is public and CC0; use the official feed directly if you do not need this monitoring workflow. QuietDataTools is not affiliated with CISA. Demand and profitability are not established.

Input

{"cveId":"CVE-2021-44228","monitorName":"default","includeUnchanged":true}

Keep monitorName stable to continue history. A new name starts a baseline. Save the input as an Apify Task and attach a Schedule for recurring checks; this Actor does not create schedules.

Output

Every successful check emits a dataset row by default with changeStatus BASELINE, CHANGED, or UNCHANGED and exact previous/current values. Change types include VENDOR_CHANGED, PRODUCT_CHANGED, NAME_CHANGED, DATE_ADDED_CHANGED, DESCRIPTION_CHANGED, REQUIRED_ACTION_CHANGED, DUE_DATE_CHANGED, RANSOMWARE_USE_CHANGED, NOTES_CHANGED, CWE_ADDED, and CWE_REMOVED. Warnings can include KNOWN_RANSOMWARE_CAMPAIGN_USE and REMEDIATION_DUE_DATE_PASSED.

Set includeUnchanged false to suppress unchanged dataset rows. OUTPUT is still written and the successful check is still charged. Missing target CVEs fail rather than being interpreted as removal. Incomplete, duplicate, or unsupported source records fail closed.

History and failures

History is isolated by user, Actor, CVE ID, and monitor name. Source and delivery failures retain the last committed snapshot. Dataset and OUTPUT delivery happen before charging; history commits only after a successful charge. A five-minute best-effort lease rejects overlapping checks, but storage is not an atomic lock. Run the same monitor sequentially. If a process stops after charging but before commit, a retry may repeat output and charges. Platform retention or deleting history starts a new baseline.

Pricing and limits

$0.01 per successful CVE check, including baseline and unchanged checks. Platform usage is included; no start or per-row charge. Failed checks are not charged. Set maximum run charge to at least $0.01. Defaults: 256 MB, 60 seconds, $0.05 maximum charge, restart off, standby off. One exact CVE per run; fixed official JSON feed only; response at most 5 MB; 20-second deadline; at most three same-origin redirects and 10,000 catalog records. No accounts, tokens, proxies, arbitrary URLs, or paid services.

Official feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Catalog information: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Official public mirror and transparent history: https://github.com/cisagov/kev-data

Treat output as source metadata, not security advice. A KEV entry shows evidence of active exploitation but does not determine exposure in your environment. Review CISA guidance and your own asset inventory. Historical corrections can appear as changes.

Support and implementation

Use Issues with the CVE ID, monitor name, and run ID. No credentials. Node.js 22, Apify SDK 3.7.2, pinned lockfile, native HTTPS, no cookies or response cache. Production audit and cloud build reported zero known vulnerabilities on October 8, 2026. Forty built-in tests cover normalization, tracked changes, corrupt/incomplete data, delivery ordering, failed-source history preservation, and network bounds. Owner release checks are not customer usage.