CISA KEV Inventory Match & Change Monitor

Read the official CISA Known Exploited Vulnerabilities (KEV) JSON feed, return normalized catalog records, monitor catalog changes, or compare KEV entries with a supplied software inventory. The Actor uses the fixed CISA JSON endpoint—no browser, scraping, arbitrary URLs, login, or proxy.

Modes

• full — returns normalized current KEV entries with catalog provenance.
• delta — compares the current feed with KEV_BASELINE, emits ADDED, UPDATED, and REMOVED records, then saves the complete current baseline. A first run creates state and emits no catalog-wide false alert.
• inventory-match — matches inventory by exact CVE, exact normalized vendor+product, or optional conservative fuzzy vendor+product similarity.

{
  "mode": "inventory-match",
  "inventory": [
    { "assetId": "edge-fw-01", "cveIds": ["CVE-2026-20349"] },
    { "assetId": "analytics-01", "vendor": "Metabase", "product": "Metabase", "version": "1.2.3" }
  ],
  "fuzzyMatching": false,
  "fuzzyThreshold": 0.88,
  "maxResults": 1000,
  "requestTimeoutSecs": 30,
  "maxRequestRetries": 3
}

Inventory items require a stable assetId. Exact CVE matches take precedence. Vendor/product matching requires both terms; fuzzy matching is off by default, enforces separate vendor and product similarity floors, rejects very short product descriptions, and reports confidence plus matchedTerms. An inventory match means only that supplied identifiers or names correspond to a KEV catalog entry. It does not establish that a particular installed version is affected or exploitable.

Output and provenance

Rows use recordType values KEV, KEV_CHANGE, or INVENTORY_MATCH. CISA-provided fields—including dateAdded, dueDate, requiredAction, and knownRansomwareCampaignUse—are preserved without adding CVSS values, affected-version claims, or exploitability scores. Every record includes source authority, catalog name, fixed feed URL, catalog version, and release timestamp. Delta updates include deterministic before, after, and changedFields evidence.

maxResults caps output rows, not persisted delta state. Requests use bounded timeout and exponential retries only for timeouts, network errors, HTTP 408/429, and 5xx responses. Permanent errors are surfaced directly and also emitted as disclaimer-bearing ERROR rows. Every data, match, change, and error row carries a factual/legal disclaimer. A REMOVED delta is only an observation that an entry is no longer present in the current catalog; it does not mean fixed, remediated, not vulnerable, or deleted elsewhere.

Safe demo and local test

With no Actor input, src/main.js defaults to bundled demoMode, which reads a three-entry fixture sanitized from the public CISA feed and performs no network request. Run:

npm ci
npm test
npm start

Security, privacy, and legal notice

• Do not place secrets, credentials, personal data, or unnecessary internal details in assetId, vendor, product, or version fields. Actor inputs, datasets, and state may be retained according to your Apify storage settings.
• This is defensive prioritization support, not a vulnerability scanner, penetration-testing tool, guarantee of compromise, or substitute for vendor advisories and validated asset/version analysis.
• CISA's KEV fields are represented as source assertions; no claim is made beyond what the catalog states.
• Catalog absence is not a remediation, exploitability, affected-version, or legal conclusion.
• Use, retain, and redistribute public-source and inventory-derived data only as permitted by applicable law, organizational policy, source terms, and CISA usage guidance. The Actor is independent and is not endorsed by CISA.