CISA KEV Known Exploited Vulnerabilities Scraper

Here is one real result, with every field the actor returns:

{
  "cveID": "CVE-2021-44228",
  "vendorProject": "Apache",
  "product": "Log4j2",
  "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "shortDescription": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
  "requiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
  "dateAdded": "2021-12-10",
  "dueDate": "2021-12-24",
  "daysToDueDate": -1696,
  "isOverdue": true,
  "knownRansomwareCampaignUse": "Known",
  "isRansomware": true,
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "ageInDays": 1710,
  "catalogVersion": "2026.08.14",
  "epssScore": 0.99999,
  "epssPercentile": 1,
  "epssDate": "2026-08-15",
  "exploitationLikelihood": "Very High",
  "priority": "Critical",
  "nvdCvssBaseScore": 10,
  "nvdCvssSeverity": "CRITICAL",
  "nvdCvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "nvdCwes": ["CWE-917", "CWE-20", "CWE-400", "CWE-502"],
  "nvdCpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"],
  "aiRemediationGuidance": "CVE-2021-44228 (Log4Shell) is a critical remote code execution flaw in Apache Log4j2 where attacker-controlled JNDI lookups let an unauthenticated attacker run arbitrary code. It is urgent because it is actively exploited in ransomware campaigns, carries a CVSS 10.0 and an EPSS near 1.0, and its federal remediation deadline has passed. Remediate now: upgrade Log4j2 to 2.17.1 or later, or remove affected assets from the network; where patching is blocked, remove the JndiLookup class and disable message lookups, then hunt for exploitation in logs.",
  "observedAt": "2026-08-16T11:24:32.034Z",
  "error": null
}

The most complete CISA KEV scraper for known exploited vulnerabilities and actively-exploited CVE threat intelligence. It returns every field the CISA Known Exploited Vulnerabilities catalog exposes for each actively exploited CVE, enriches each CVE with its EPSS exploitation-probability score and percentile, adds derived urgency fields (isOverdue, daysToDueDate, isRansomware, exploitationLikelihood, priority), and gives you ten filters to target exactly the vulnerabilities you need. Two optional paid add-ons go further: NVD CVSS v3.1 scoring plus affected-product CPE enrichment, and AI-written plain-English remediation guidance for each CVE.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Use cases
• Quickstart
• Input reference
• Output reference
• Example output record
• Run via API and CLI
• Fetch results
• Billing and limits
• FAQ and troubleshooting

What it does

The actor downloads the authoritative CISA Known Exploited Vulnerabilities (KEV) catalog, the official list of CVEs that are being actively exploited in the wild and that carry US federal remediation deadlines. It applies the filters you pass as input, then writes one normalized record per matching CVE to the run's dataset.

Each record keeps every native KEV field (cveID, vendorProject, product, vulnerabilityName, shortDescription, requiredAction, dateAdded, dueDate, knownRansomwareCampaignUse, cwes, notes) and adds derived fields so you can prioritize without extra parsing: daysToDueDate (negative when overdue), isOverdue, isRansomware, ageInDays, and a combined priority label (Critical / High / Medium / Low).

When includeEpss is on (the default), the actor enriches each CVE with its EPSS score from FIRST.org: epssScore (0 to 1 probability of exploitation in the next 30 days), epssPercentile, epssDate, and an exploitationLikelihood label (Very High / High / Moderate / Low).

This is the actively-exploited priority subset of all CVEs. For the full CVE database with CVSS scoring, see the NVD CVE Scraper.

Optional paid add-ons

• NVD CVSS + CPE enrichment (nvdEnrich): for each KEV CVE the actor makes an extra call to the official NVD API and adds the full CVSS v3.1 base score, severity and vector string, the NVD CWE weakness list, and the affected-product CPE match criteria that the KEV feed itself does not include. Fields: nvdCvssBaseScore, nvdCvssSeverity, nvdCvssVector, nvdCwes, nvdCpes.
• AI remediation guidance (aiSummary): an AI model reads the CVE context (exploitation status, ransomware use, federal due date, CVSS and EPSS) and writes a concise, plain-English aiRemediationGuidance paragraph covering what the vulnerability is, why it is urgent, and concrete patch or mitigation steps.

Both add-ons are opt-in (default off), billed only when they genuinely produce data, and disabled for free Apify users.

Use cases

• Build an actively-exploited vulnerability feed for a SIEM, SOAR or threat-intelligence platform.
• Prioritize patch management and remediation against the CISA KEV known exploited vulnerabilities list with federal due dates.
• Track ransomware-linked CVEs and BlueKeep, Log4Shell and ProxyShell style remote code execution threats.
• Enrich vulnerability tickets with CVSS v3.1 scores, severity and affected-product CPEs for risk scoring.
• Generate plain-English remediation guidance for security awareness reports and executive briefings.
• Monitor a specific vendor or product (Microsoft, Cisco, Apache, Fortinet, VMware) for newly exploited CVEs.
• Feed compliance and audit workflows that must evidence remediation of known exploited vulnerabilities.
• Alert on overdue federal remediation deadlines and upcoming due dates across your asset inventory.

Quickstart

Open the actor, paste this into the input, and press Run. It returns the 10 newest KEV entries used in ransomware campaigns, enriched with EPSS.

{
  "ransomwareOnly": true,
  "includeEpss": true,
  "sortBy": "priority",
  "maxResults": 10
}

Every input field is optional. With an empty input the actor returns the most recently added KEV entries (newest first), enriched with EPSS.

Input reference

Field	Type	Required	Default	Description
vendor	string	no	(empty)	Filter by vendor or project, case-insensitive contains match on vendorProject, for example Microsoft, Cisco, Apache.
product	string	no	(empty)	Filter by product, case-insensitive contains match on product, for example Windows, Exchange Server, Log4j.
cveId	string[]	no	(empty)	One or more exact CVE IDs, for example ["CVE-2021-44228"]. Returns only these CVEs if present in the KEV catalog.
cwe	string	no	(empty)	Keep only CVEs whose weakness list contains this CWE, for example CWE-502.
ransomwareOnly	boolean	no	false	Only include CVEs known to be used in ransomware campaigns (knownRansomwareCampaignUse = Known).
addedFrom	string	no	(empty)	Include CVEs added to the catalog on or after this date (YYYY-MM-DD).
addedTo	string	no	(empty)	Include CVEs added to the catalog on or before this date (YYYY-MM-DD).
dueBefore	string	no	(empty)	Include CVEs with a federal remediation due date on or before this date (YYYY-MM-DD). Useful for overdue or upcoming deadlines.
includeEpss	boolean	no	true	Enrich each CVE with its EPSS score, percentile and likelihood label.
nvdEnrich	boolean	no	false	Paid add-on ($0.012/CVE). Extra NVD API call adding CVSS v3.1 base score, severity, vector, CWE list and affected-product CPEs. Charged only when NVD returns the CVE. Disabled for free users.
aiSummary	boolean	no	false	Paid AI add-on ($0.012/CVE). Writes a plain-English remediation guidance paragraph per CVE. Charged only on usable AI output. Disabled for free users.
sortBy	enum	no	dateAdded	Sort order: dateAdded (newest first), dueDate (soonest first), epssScore (highest first), or priority (highest first).
maxResults	integer	no	50	Maximum number of CVEs to collect. Free Apify plans are capped at 10 per run.
proxyConfiguration	object	no	(none)	Standard Apify proxy configuration. Not required; the sources are open and not bot protected.

Filters combine with logical AND. With no filters, the actor returns the whole catalog sorted newest first (subject to maxResults).

Output reference

One dataset item per CVE. Types: string, number, boolean, string[], or null when the value is absent.

Field	Type	Description
cveID	string	CVE identifier, for example CVE-2021-44228.
vendorProject	string	Vendor or project name.
product	string	Affected product.
vulnerabilityName	string	CISA's name for the vulnerability.
shortDescription	string	Short description of the vulnerability.
requiredAction	string	The remediation action CISA requires.
dateAdded	string	Date the CVE was added to the KEV catalog (YYYY-MM-DD).
dueDate	string	Federal remediation due date (YYYY-MM-DD), or null.
daysToDueDate	number	Days from today to the due date. Negative means overdue.
isOverdue	boolean	True when the due date is in the past.
knownRansomwareCampaignUse	string	Raw KEV value, Known or Unknown.
isRansomware	boolean	True when knownRansomwareCampaignUse is Known.
cwes	string[]	CWE weakness identifiers associated with the CVE.
notes	string	Reference URLs or notes from CISA.
ageInDays	number	Days since the CVE was added to the catalog.
catalogVersion	string	Version of the KEV catalog this record came from.
epssScore	number	EPSS probability of exploitation (0 to 1). Present when includeEpss is on and EPSS has the CVE.
epssPercentile	number	EPSS percentile rank (0 to 1).
epssDate	string	Date the EPSS score was computed.
exploitationLikelihood	string	Label derived from epssScore: Very High (>= 0.9), High (>= 0.5), Moderate (>= 0.1), else Low.
priority	string	Combined urgency label from ransomware use, overdue status and EPSS: Critical, High, Medium, Low.
nvdCvssBaseScore	number	NVD add-on: CVSS v3.1 base score (0 to 10). Present when nvdEnrich is on and NVD scores the CVE.
nvdCvssSeverity	string	NVD add-on: CVSS v3.1 severity (LOW, MEDIUM, HIGH, CRITICAL).
nvdCvssVector	string	NVD add-on: CVSS v3.1 vector string.
nvdCwes	string[]	NVD add-on: CWE weakness identifiers from NVD.
nvdCpes	string[]	NVD add-on: affected-product CPE match criteria.
aiRemediationGuidance	string	AI add-on: plain-English remediation guidance paragraph. Present when aiSummary is on and the model returns usable output.
observedAt	string	ISO timestamp when the record was produced.
error	string	Error message for the record, or null.

Example output record

{
  "cveID": "CVE-2019-0708",
  "vendorProject": "Microsoft",
  "product": "Remote Desktop Services",
  "vulnerabilityName": "Microsoft Remote Desktop Services Remote Code Execution Vulnerability",
  "shortDescription": "Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.",
  "requiredAction": "Apply updates per vendor instructions.",
  "dateAdded": "2021-11-03",
  "dueDate": "2022-05-03",
  "daysToDueDate": -1566,
  "isOverdue": true,
  "knownRansomwareCampaignUse": "Known",
  "isRansomware": true,
  "cwes": ["CWE-416"],
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-0708",
  "ageInDays": 1747,
  "catalogVersion": "2026.08.14",
  "epssScore": 0.99999,
  "epssPercentile": 0.99999,
  "epssDate": "2026-08-15",
  "exploitationLikelihood": "Very High",
  "priority": "Critical",
  "observedAt": "2026-08-16T11:24:32.034Z",
  "error": null
}

Run via API and CLI

Start a run with the Apify API:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~cisa-kev-exploited-vulns-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vendor":"Microsoft","ransomwareOnly":true,"sortBy":"priority","maxResults":25}'

Run with the Apify CLI:

apify call scrapers_lat/cisa-kev-exploited-vulns-scraper \
  --input='{"cveId":["CVE-2021-44228"],"includeEpss":true}'

Fetch results

Every run writes to its own dataset. Fetch the items as JSON:

$curl "https://api.apify.com/v2/datasets/DATASET_ID/items?clean=true&format=json&token=YOUR_APIFY_TOKEN"

Swap format=csv or format=xlsx for spreadsheet output. The run response and the console both give you the dataset id.

Billing and limits

• Billing is pay per result. You are charged for each CVE record written to the dataset, at the price shown on the actor's pricing page.
• Optional NVD add-on (nvd_enrich, $0.012 per CVE): opt-in, off by default. Charged only when the extra NVD API call genuinely returns CVSS or CPE data for the CVE. Disabled for free users.
• Optional AI add-on (ai_summary, $0.012 per CVE): opt-in, off by default. Uses AI to write remediation guidance and is charged only when the model returns usable output. Disabled for free users.
• Free Apify plans are capped at 10 results per run, and both paid add-ons are disabled for free users. Upgrade for larger pulls and add-ons.
• No charge on failure. If the KEV download fails, no billable results are produced.
• EPSS enrichment is best effort and fails open: if the EPSS API is unavailable, you still get the full KEV records, just without the epssScore, epssPercentile, epssDate and exploitationLikelihood fields.
• A spend guard honors your maxTotalChargeUsd setting and stops emitting billable results once the limit is reached.

FAQ and troubleshooting

How is this different from a full CVE scraper? The KEV catalog is the small, authoritative subset of CVEs that CISA has confirmed are being actively exploited in the wild, each with a federal remediation deadline. It is the priority-patch list, not the full CVE database.

What is EPSS? The Exploit Prediction Scoring System (from FIRST.org) estimates the probability that a CVE will be exploited in the next 30 days. epssScore is that probability (0 to 1); epssPercentile ranks it against all scored CVEs.

How current is the data? The catalog carries a catalogVersion and CISA updates it regularly. Each record includes the version it came from and an observedAt timestamp.

Why is a CVE missing an EPSS score? Either includeEpss was off, or EPSS has no score for that CVE yet. The KEV fields are still returned.

Can I get only overdue vulnerabilities? Set dueBefore to today's date; every returned record with a dueDate will be at or before it, and isOverdue will be true for past deadlines.

More scrapers at scrapers.lat

• NVD CVE Scraper for the full CVE database with CVSS scoring.