CISA KEV Catalog — Exploited Vulnerabilities & Forensic Triage

Export CISA's Known Exploited Vulnerabilities catalog into a consistent dataset: one row per matching CVE, with vendor, product, description, required action, CISA deadline, ransomware status, forensic triage flag, CWEs and source provenance. No API key or login is required.

The Actor reads the official CISA GitHub mirror of the public CC0 catalog. It validates the complete snapshot, applies your filters, sorts it and saves up to maxItems matching CVEs. Export the Apify dataset as JSON, CSV, Excel or XML, or connect it to your existing workflow.

What you can do

• Feed vendor-specific exploited-vulnerability records into a patch-management or SOC workflow.
• Check an exact CVE watchlist against the current KEV catalog.
• Track catalog additions or source deadlines within a reporting window.
• Preserve the source's ransomware and forensic-triage statuses for review.
• Keep auditable snapshots with the catalog version, release timestamp and SHA-256 of the downloaded JSON.

Quick start

Get five recent Microsoft entries:

{
  "vendor": "Microsoft",
  "maxItems": 5
}

Check an exact watchlist:

{
  "cveIds": ["CVE-2021-44228", "CVE-2023-34362"],
  "maxItems": 20
}

Combine filters for entries added in a fixed period:

{
  "dateAddedFrom": "2026-10-01",
  "dateAddedTo": "2026-10-31",
  "forensicTriage": "Yes",
  "sortBy": "dueDateAsc",
  "maxItems": 100
}

All supplied filters are combined with AND. Use separate runs if you need OR across different vendors. Within cveIds, any listed ID can match.

Input

Field	Default	Meaning
vendor	No filter	Case-insensitive substring of CISA's vendor/project name.
product	No filter	Case-insensitive substring of the source product.
cveIds	No filter	Up to 500 exact CVE IDs; case-insensitive, deduplicated. An empty array applies no CVE restriction.
cwe	No filter	Exact, case-sensitive CWE ID such as CWE-89.
dateAddedFrom, dateAddedTo	No filter	Inclusive YYYY-MM-DD range for catalog addition dates.
dueDateFrom, dueDateTo	No filter	Inclusive range for CISA-published due dates.
ransomware	all	all, Known or Unknown, matching the source status exactly.
forensicTriage	all	all, Yes or No, matching the optional source field exactly.
sortBy	dateAddedDesc	Newest additions first; or dueDateAsc for earliest deadlines. Ties use CVE ID.
maxItems	100	Hard maximum saved rows, 1–5,000, after filtering, sorting and deduplication.
requestIntervalMillis	1000	Minimum interval between HTTP attempts, 1,000–60,000 ms.
proxyConfiguration	{"useApifyProxy":false}	Optional Apify Proxy or HTTP(S) custom proxy URLs. Direct access normally suffices.

Dates must be valid calendar dates and range starts cannot exceed their ends. Unknown input fields, malformed CVE IDs and invalid limits fail before collection. Apify Proxy requires later account setup; custom proxies are supplied by you. Provider charges, if any, depend on that configuration. A stable proxy session is used; access denials are not retried with another identity.

Output

Each row contains the following fields. Text is preserved from CISA without AI rewriting or severity scoring.

Fields	Meaning
cveId, vendor, product, vulnerabilityName, description	CVE and source description of the affected product/issue.
dateAdded, dueDate, requiredAction	CISA dates and action text, preserved exactly.
knownRansomwareCampaignUse	Source string, usually Known or Unknown; null if absent. Unknown is not No.
forensicTriage	Optional source string, currently Yes or No; null when absent. It is never inferred.
cwes, notes	CWE array (empty when absent) and original notes (null when absent). Linked pages are not fetched.
nvdUrl	Reference link constructed from the CVE ID. NVD is not fetched or used to enrich results.
catalogVersion, catalogReleasedAt, retrievedAt	Publisher version/release time and this run's retrieval time. Release timestamp precision is preserved.
source, sourceUrl, catalogUrl, sourceSha256	Source identity, exact downloaded feed, canonical catalog page and hash of decoded UTF-8 JSON.
licence, attribution	CC0 licence link and source credit.

Illustrative shortened row (see SAMPLE_OUTPUT.json for the complete live example):

{
  "cveId": "CVE-2021-44228",
  "vendor": "Apache",
  "product": "Log4j2",
  "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "dateAdded": "2021-12-10",
  "dueDate": "2021-12-24",
  "knownRansomwareCampaignUse": "Known",
  "forensicTriage": "No",
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "licence": "https://creativecommons.org/publicdomain/zero/1.0/"
}

The RUN_SUMMARY key-value record includes status, stop reason (sourceExhausted, maxItems or budgetReached), source/matched/prepared/delivered counts, duplicate count, version/hash, requests/retries and active filters. Supplied watchlist IDs absent from the complete source appear in unmatchedCveIds. IDs present in KEV but excluded by another filter are not “unmatched.” These summary entries do not create paid dataset rows.

Pricing

Price: $1.00 per 1,000 results ($0.001 per saved CVE row / dataset item), no start fee. Billing uses Apify pay-per-event with the automatic apify-default-dataset-item event only. Five results cost $0.005; an empty result costs $0 in result fees. The price shown on the Actor page at the time of a run applies.

You pay only for CVE rows actually saved to the dataset: there is no start fee, no subscription and no charge for filtered-out records. If you set a maximum cost per run in Apify, the Actor checks the remaining budget before saving each row and stops cleanly when the limit is reached, so you are never charged beyond it. The underlying CC0 data is free; the fee covers maintained validation, normalization and Apify integration.

Repeated snapshots return and would bill the same matching CVEs again. There is no cross-run “only new” state. Use date filters and maxItems to control volume. Empty/zero platform charge-limit settings follow SDK unlimited semantics; they are not interpreted as a $0 budget. A positive finite charge limit remains enforced by the SDK.

Reliability and source coverage

• The official distribution is one complete JSON file. There are no API pages to paginate. The Actor verifies its declared count against the actual array and validates every record, including records outside maxItems.
• Identical duplicate CVEs are saved once; conflicting duplicates fail the run. A malformed or incomplete source fails visibly and produces no dataset rows.
• One concurrent request, 30-second network timeout, up to three retries (four total HTTP attempts), at least one second between attempts, exponential backoff and Retry-After support. A source request for more than two minutes of backoff stops the run for a later retry.
• Permanent rejections such as 401/403, unexpected redirects and invalid JSON fail without an access-control workaround.
• Collection and validation complete before any result is saved. Storage/delivery failures may leave partial output; inspect RUN_SUMMARY and the dataset. Use a fresh run rather than resurrecting or appending to an old dataset. Existing populated output datasets are rejected to prevent duplicate results and charges.
• CISA says its official mirror normally synchronizes within minutes of the canonical catalog. Delays, corrections and outages remain possible; check the release and retrieval timestamps.

Recommended schedule: daily on business days, or as needed. More frequent runs commonly return the same snapshot. Date filters select entries from the current catalog, not an archived historical state, and do not detect later edits to older entries.

FAQ

Does a CVE absent from KEV mean it is safe? No. KEV is a specific catalog, not all vulnerabilities. An unlisted watchlist ID appears only in the run summary, without a risk judgment.

Does a row mean my assets are vulnerable? No. You must determine affected versions, exposure, mitigations and applicability. The Actor does not inspect your systems.

Are the due dates my company's legal deadlines? They are CISA's published dates and action text. Applicability depends on the organization and relevant directives. The Actor does not calculate or interpret obligations.

Why do some rows have no forensic triage value? The field is optional. Older records can lack it. Missing is null, not No. New source status strings are preserved, and the exact-value filters match only their documented values.

Can I download the data for free elsewhere? Yes, directly from CISA's official mirror. This Actor adds validation, convenient filters, structured storage and workflow integration.

Does it fetch advisory links, NVD, CVSS or exploit code? It only downloads the catalog JSON. Links and source descriptions are retained; linked content is not collected.

Local development

Requires Node 22. All commands below run from this Actor directory:

npm ci
npm run check
npm test
npm run validate
npm run smoke -- live

The smoke script creates a fresh storage-smoke-* directory, writes a small input, runs the real SDK locally without inherited Apify credentials and validates the resulting dataset. live also independently checks every sampled source field and saves the sample at ../SAMPLE_OUTPUT2.json and SAMPLE_OUTPUT.json. Other modes: empty, budget, zero-limit, empty-limit, below-one-result, invalid-input. Tests use synthetic fixtures and no external services. Local simulated billing uses the SDK's $1/event test unit, not the actual $0.001 price, and spends no money.

For a manual run, put JSON input in a fresh storage directory:

mkdir -p storage/key_value_stores/default
cp examples/INPUT.json storage/key_value_stores/default/INPUT.json
APIFY_LOCAL_STORAGE_DIR=./storage CRAWLEE_STORAGE_DIR=./storage APIFY_PURGE_ON_START=false CRAWLEE_PURGE_ON_START=false node src/main.js

Choose a fresh storage directory for every later run. The optional CRAWLEE_LOCAL_PROCESS_METRICS=true setting uses local process memory metrics in restricted environments; cloud metrics keep the SDK default. Docker uses apify/actor-node:22, the committed lockfile and production dependencies.

Legal and attribution

Source: CISA Known Exploited Vulnerabilities Catalog, distributed through the official CISA GitHub mirror, under CC0 1.0. The complete source licence is included in SOURCE_LICENSE.txt. Third-party links retain their own terms; this Actor does not fetch those pages.

This is an independent tool, with no CISA or DHS endorsement. It uses no government logos or seals. It collects public software-vulnerability records, not person/contact profiles, credentials or private assets. Source data can change and should be verified for operational decisions. Recheck source terms before deploying or redistributing the Actor.