# CISA KEV Catalog Export — Known Exploited CVEs (`resourcefully_dialect/cisa-kev-catalog`) Actor

Export validated CISA Known Exploited Vulnerabilities with vendor, product, ransomware status, forensic triage, dates and source provenance. No API key.

- **URL**: https://apify.com/resourcefully_dialect/cisa-kev-catalog.md
- **Developed by:** [Biosick Johnny](https://apify.com/resourcefully_dialect) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$1.00 / 1,000 kev results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV Catalog — Exploited Vulnerabilities & Forensic Triage

Export CISA's Known Exploited Vulnerabilities catalog into a consistent dataset: one row per matching CVE, with vendor, product, description, required action, CISA deadline, ransomware status, forensic triage flag, CWEs and source provenance. No API key or login is required.

The Actor reads the **official CISA GitHub mirror** of the public CC0 catalog. It validates the complete snapshot, applies your filters, sorts it and saves up to `maxItems` matching CVEs. Export the Apify dataset as JSON, CSV, Excel or XML, or connect it to your existing workflow.

### What you can do

- Feed vendor-specific exploited-vulnerability records into a patch-management or SOC workflow.
- Check an exact CVE watchlist against the current KEV catalog.
- Track catalog additions or source deadlines within a reporting window.
- Preserve the source's ransomware and forensic-triage statuses for review.
- Keep auditable snapshots with the catalog version, release timestamp and SHA-256 of the downloaded JSON.

### Quick start

Get five recent Microsoft entries:

```json
{
  "vendor": "Microsoft",
  "maxItems": 5
}
```

Check an exact watchlist:

```json
{
  "cveIds": ["CVE-2021-44228", "CVE-2023-34362"],
  "maxItems": 20
}
```

Combine filters for entries added in a fixed period:

```json
{
  "dateAddedFrom": "2026-10-01",
  "dateAddedTo": "2026-10-31",
  "forensicTriage": "Yes",
  "sortBy": "dueDateAsc",
  "maxItems": 100
}
```

All supplied filters are combined with AND. Use separate runs if you need OR across different vendors. Within `cveIds`, any listed ID can match.

### Input

| Field | Default | Meaning |
| --- | --- | --- |
| `vendor` | No filter | Case-insensitive substring of CISA's vendor/project name. |
| `product` | No filter | Case-insensitive substring of the source product. |
| `cveIds` | No filter | Up to 500 exact CVE IDs; case-insensitive, deduplicated. An empty array applies no CVE restriction. |
| `cwe` | No filter | Exact, case-sensitive CWE ID such as `CWE-89`. |
| `dateAddedFrom`, `dateAddedTo` | No filter | Inclusive `YYYY-MM-DD` range for catalog addition dates. |
| `dueDateFrom`, `dueDateTo` | No filter | Inclusive range for CISA-published due dates. |
| `ransomware` | `all` | `all`, `Known` or `Unknown`, matching the source status exactly. |
| `forensicTriage` | `all` | `all`, `Yes` or `No`, matching the optional source field exactly. |
| `sortBy` | `dateAddedDesc` | Newest additions first; or `dueDateAsc` for earliest deadlines. Ties use CVE ID. |
| `maxItems` | `100` | Hard maximum saved rows, 1–5,000, after filtering, sorting and deduplication. |
| `requestIntervalMillis` | `1000` | Minimum interval between HTTP attempts, 1,000–60,000 ms. |
| `proxyConfiguration` | `{"useApifyProxy":false}` | Optional Apify Proxy or HTTP(S) custom proxy URLs. Direct access normally suffices. |

Dates must be valid calendar dates and range starts cannot exceed their ends. Unknown input fields, malformed CVE IDs and invalid limits fail before collection. Apify Proxy requires later account setup; custom proxies are supplied by you. Provider charges, if any, depend on that configuration. A stable proxy session is used; access denials are not retried with another identity.

### Output

Each row contains the following fields. Text is preserved from CISA without AI rewriting or severity scoring.

| Fields | Meaning |
| --- | --- |
| `cveId`, `vendor`, `product`, `vulnerabilityName`, `description` | CVE and source description of the affected product/issue. |
| `dateAdded`, `dueDate`, `requiredAction` | CISA dates and action text, preserved exactly. |
| `knownRansomwareCampaignUse` | Source string, usually `Known` or `Unknown`; `null` if absent. **Unknown is not No.** |
| `forensicTriage` | Optional source string, currently `Yes` or `No`; `null` when absent. It is never inferred. |
| `cwes`, `notes` | CWE array (empty when absent) and original notes (`null` when absent). Linked pages are not fetched. |
| `nvdUrl` | Reference link constructed from the CVE ID. NVD is not fetched or used to enrich results. |
| `catalogVersion`, `catalogReleasedAt`, `retrievedAt` | Publisher version/release time and this run's retrieval time. Release timestamp precision is preserved. |
| `source`, `sourceUrl`, `catalogUrl`, `sourceSha256` | Source identity, exact downloaded feed, canonical catalog page and hash of decoded UTF-8 JSON. |
| `licence`, `attribution` | CC0 licence link and source credit. |

Illustrative shortened row (see `SAMPLE_OUTPUT.json` for the complete live example):

```json
{
  "cveId": "CVE-2021-44228",
  "vendor": "Apache",
  "product": "Log4j2",
  "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "dateAdded": "2021-12-10",
  "dueDate": "2021-12-24",
  "knownRansomwareCampaignUse": "Known",
  "forensicTriage": "No",
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "licence": "https://creativecommons.org/publicdomain/zero/1.0/"
}
```

The `RUN_SUMMARY` key-value record includes status, stop reason (`sourceExhausted`, `maxItems` or `budgetReached`), source/matched/prepared/delivered counts, duplicate count, version/hash, requests/retries and active filters. Supplied watchlist IDs absent from the complete source appear in `unmatchedCveIds`. IDs present in KEV but excluded by another filter are not “unmatched.” These summary entries do not create paid dataset rows.

### Pricing

**Price: $1.00 per 1,000 results ($0.001 per saved CVE row / dataset item), no start fee.** Billing uses Apify pay-per-event with the automatic `apify-default-dataset-item` event only. Five results cost $0.005; an empty result costs $0 in result fees. The price shown on the Actor page at the time of a run applies.

You pay only for CVE rows actually saved to the dataset: there is no start fee, no subscription and no charge for filtered-out records. If you set a maximum cost per run in Apify, the Actor checks the remaining budget before saving each row and stops cleanly when the limit is reached, so you are never charged beyond it. The underlying CC0 data is free; the fee covers maintained validation, normalization and Apify integration.

Repeated snapshots return and would bill the same matching CVEs again. There is no cross-run “only new” state. Use date filters and `maxItems` to control volume. Empty/zero platform charge-limit settings follow SDK unlimited semantics; they are not interpreted as a $0 budget. A positive finite charge limit remains enforced by the SDK.

### Reliability and source coverage

- The official distribution is one complete JSON file. **There are no API pages to paginate.** The Actor verifies its declared count against the actual array and validates every record, including records outside `maxItems`.
- Identical duplicate CVEs are saved once; conflicting duplicates fail the run. A malformed or incomplete source fails visibly and produces no dataset rows.
- One concurrent request, 30-second network timeout, up to three retries (four total HTTP attempts), at least one second between attempts, exponential backoff and Retry-After support. A source request for more than two minutes of backoff stops the run for a later retry.
- Permanent rejections such as 401/403, unexpected redirects and invalid JSON fail without an access-control workaround.
- Collection and validation complete before any result is saved. Storage/delivery failures may leave partial output; inspect `RUN_SUMMARY` and the dataset. Use a fresh run rather than resurrecting or appending to an old dataset. Existing populated output datasets are rejected to prevent duplicate results and charges.
- CISA says its [official mirror](https://github.com/cisagov/kev-data#update-schedule) normally synchronizes within minutes of the canonical catalog. Delays, corrections and outages remain possible; check the release and retrieval timestamps.

Recommended schedule: daily on business days, or as needed. More frequent runs commonly return the same snapshot. Date filters select entries from the **current catalog**, not an archived historical state, and do not detect later edits to older entries.

### FAQ

**Does a CVE absent from KEV mean it is safe?** No. KEV is a specific catalog, not all vulnerabilities. An unlisted watchlist ID appears only in the run summary, without a risk judgment.

**Does a row mean my assets are vulnerable?** No. You must determine affected versions, exposure, mitigations and applicability. The Actor does not inspect your systems.

**Are the due dates my company's legal deadlines?** They are CISA's published dates and action text. Applicability depends on the organization and relevant directives. The Actor does not calculate or interpret obligations.

**Why do some rows have no forensic triage value?** The field is optional. Older records can lack it. Missing is `null`, not `No`. New source status strings are preserved, and the exact-value filters match only their documented values.

**Can I download the data for free elsewhere?** Yes, directly from [CISA's official mirror](https://github.com/cisagov/kev-data). This Actor adds validation, convenient filters, structured storage and workflow integration.

**Does it fetch advisory links, NVD, CVSS or exploit code?** It only downloads the catalog JSON. Links and source descriptions are retained; linked content is not collected.

### Local development

Requires **Node 22**. All commands below run from this Actor directory:

```sh
npm ci
npm run check
npm test
npm run validate
npm run smoke -- live
```

The smoke script creates a fresh `storage-smoke-*` directory, writes a small input, runs the real SDK locally without inherited Apify credentials and validates the resulting dataset. `live` also independently checks every sampled source field and saves the sample at `../SAMPLE_OUTPUT2.json` and `SAMPLE_OUTPUT.json`. Other modes: `empty`, `budget`, `zero-limit`, `empty-limit`, `below-one-result`, `invalid-input`. Tests use synthetic fixtures and no external services. Local simulated billing uses the SDK's **$1/event test unit**, not the actual $0.001 price, and spends no money.

For a manual run, put JSON input in a fresh storage directory:

```sh
mkdir -p storage/key_value_stores/default
cp examples/INPUT.json storage/key_value_stores/default/INPUT.json
APIFY_LOCAL_STORAGE_DIR=./storage CRAWLEE_STORAGE_DIR=./storage APIFY_PURGE_ON_START=false CRAWLEE_PURGE_ON_START=false node src/main.js
```

Choose a fresh storage directory for every later run. The optional `CRAWLEE_LOCAL_PROCESS_METRICS=true` setting uses local process memory metrics in restricted environments; cloud metrics keep the SDK default. Docker uses `apify/actor-node:22`, the committed lockfile and production dependencies.

### Legal and attribution

Source: [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), distributed through the [official CISA GitHub mirror](https://github.com/cisagov/kev-data), under [CC0 1.0](https://github.com/cisagov/kev-data/blob/develop/LICENSE). The complete source licence is included in `SOURCE_LICENSE.txt`. Third-party links retain their own terms; this Actor does not fetch those pages.

This is an independent tool, with no CISA or DHS endorsement. It uses no government logos or seals. It collects public software-vulnerability records, not person/contact profiles, credentials or private assets. Source data can change and should be verified for operational decisions. Recheck source terms before deploying or redistributing the Actor.

# Actor input Schema

## `vendor` (type: `string`):

Case-insensitive substring in the source vendor/project, e.g. Microsoft. All filters are combined.

## `product` (type: `string`):

Case-insensitive substring in the source product name, e.g. Windows.

## `cveIds` (type: `array`):

Optional exact CVE IDs; case-insensitive and deduplicated. Empty means no CVE filter. Unlisted IDs appear only in the free run summary, never as paid rows or safety claims.

## `cwe` (type: `string`):

Exact source weakness ID, e.g. CWE-89.

## `dateAddedFrom` (type: `string`):

Inclusive source date, YYYY-MM-DD. Filters the current catalog; does not reconstruct a historical snapshot.

## `dateAddedTo` (type: `string`):

Inclusive source date, YYYY-MM-DD.

## `dueDateFrom` (type: `string`):

Inclusive source due date, YYYY-MM-DD. These are CISA-published federal deadlines; applicability depends on your organization.

## `dueDateTo` (type: `string`):

Inclusive source due date, YYYY-MM-DD.

## `ransomware` (type: `string`):

Exact source status. Unknown means unconfirmed, not No. Missing source values match only all.

## `forensicTriage` (type: `string`):

Exact optional source field. Missing values are preserved as null and match only all. This does not determine applicability to your assets.

## `sortBy` (type: `string`):

Sort the complete matching feed before applying maxItems. Ties are ordered by CVE ID.

## `maxItems` (type: `integer`):

Hard cap on saved rows after filtering, deduplication and sorting. Repeated runs return repeated snapshots and would be charged again.

## `requestIntervalMillis` (type: `integer`):

Minimum interval between source request attempts, including retries. The successful path requests one complete file.

## `proxyConfiguration` (type: `object`):

Direct access by default. Optional HTTP(S) custom proxies or Apify Proxy require your own later setup. Uses a stable session; no rotation or access-control bypass. Provider charges may apply.

## Actor input object example

```json
{
  "ransomware": "all",
  "forensicTriage": "all",
  "sortBy": "dateAddedDesc",
  "maxItems": 10,
  "requestIntervalMillis": 1000,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

Dataset items produced by the run.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("resourcefully_dialect/cisa-kev-catalog").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("resourcefully_dialect/cisa-kev-catalog").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call resourcefully_dialect/cisa-kev-catalog --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,resourcefully_dialect/cisa-kev-catalog"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/lEBqpspfa7szokXzK/builds/RXQ4ShCmjYc1CWi8y/openapi.json