# CISA KEV Scraper - Exploited CVEs & Remediation Dates (`thirdwatch/cisa-kev-scraper`) Actor

Export CISA's Known Exploited Vulnerabilities catalog. Filter actively exploited CVEs by vendor, product, date, ransomware use, keywords, and remediation deadline.

- **URL**: https://apify.com/thirdwatch/cisa-kev-scraper.md
- **Developed by:** [Thirdwatch](https://apify.com/thirdwatch) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV Scraper

> Export actively exploited CVEs from CISA with vendors, products, ransomware status, required actions, and remediation dates.

### What you get

Turn the authoritative Known Exploited Vulnerabilities catalog into a filtered, schedulable dataset. Focus remediation work on vulnerabilities observed in the wild, monitor selected vendors or products, and retain CISA's required action and due date beside every CVE.

### Output fields

| Field | Description |
|---|---|
| `cve_id` | CVE identifier |
| `vendor` / `product` | Affected vendor and product |
| `vulnerability_name` | CISA vulnerability title |
| `date_added` | Date added to the KEV catalog |
| `short_description` | Published vulnerability summary |
| `required_action` | CISA remediation direction |
| `due_date` | Published remediation deadline |
| `known_ransomware_use` | Known or unknown ransomware-campaign use |
| `notes` | Additional CISA references or guidance |
| `cwes` | Related weakness identifiers |
| `catalog_version` / `catalog_released_at` | Feed version metadata |
| `source_url` / `source` | CISA lookup link and attribution |

### Example output

```json
{
  "cve_id": "CVE-2026-58644",
  "vendor": "Microsoft",
  "product": "SharePoint",
  "vulnerability_name": "Microsoft SharePoint Deserialization Vulnerability",
  "date_added": "2026-07-16",
  "due_date": "2026-07-19",
  "known_ransomware_use": "Unknown"
}
```

### Input parameters

| Parameter | Required | Description |
|---|---|---|
| `query` | No | Text matched across IDs, vendors, products, descriptions, actions, and notes. |
| `vendors` | No | Vendor-name filters. |
| `products` | No | Product-name filters. |
| `ransomwareOnly` | No | Keep only entries with known ransomware use. |
| `dateAddedFrom` | No | Earliest catalog-addition date. |
| `dateAddedTo` | No | Latest catalog-addition date. |
| `sort` | No | `newest` or `oldest`. |
| `maxResults` | No | Maximum KEV rows. Defaults to 10. |

### Use cases

- Vulnerability teams: prioritize actively exploited CVEs over unranked backlogs.
- Managed security providers: create vendor-specific remediation feeds.
- Compliance teams: track required actions and due dates with source evidence.
- Security leaders: build ransomware-exposure and remediation dashboards.

### Export the CISA KEV catalog without an API key

Collect the current federal catalog with vendor, product, ransomware, date, and keyword filters. Every result includes the remediation action and official catalog context needed for downstream review.

### Limitations

KEV is a prioritized catalog, not a complete vulnerability database. Absence from KEV does not mean a CVE is safe or unexploited. CISA deadlines are primarily tied to federal directives; other organizations should apply their own risk process and validate vendor guidance before remediation.

### Compared to alternatives

Compared with `compute-edge/cisa-kev-scraper`, this Actor combines keyword, vendor, product, ransomware, date, and sort filters with a low first-run cap. Compared with a broad NVD export, it focuses only on vulnerabilities CISA confirms have been exploited in the wild. Store pricing and features can change.

### FAQ

#### What qualifies for KEV?

CISA adds vulnerabilities with evidence of active exploitation and actionable remediation guidance.

#### Does ransomware-only include unknown entries?

No. It keeps only records CISA explicitly marks `Known`.

#### Can this replace vulnerability management?

No. Use it as a prioritization input alongside asset exposure, vendor advisories, scanning, and incident context.

Explore more at [thirdwatch.dev](https://thirdwatch.dev). Related Actors: [NVD CVE Scraper](https://apify.com/thirdwatch/nvd-cve-scraper), [OSV Vulnerability Scraper](https://apify.com/thirdwatch/osv-vulnerability-scraper), and [OFAC Sanctions Scraper](https://apify.com/thirdwatch/ofac-sanctions-scraper).

Last verified: 2026-07

# Actor input Schema

## `query` (type: `string`):

Optional text found in the CVE ID, vendor, product, vulnerability name, description, action, or notes.

## `vendors` (type: `array`):

Optionally keep vendors whose names contain one of these values.

## `products` (type: `array`):

Optionally keep products whose names contain one of these values.

## `ransomwareOnly` (type: `boolean`):

Return only vulnerabilities CISA marks as known to be used in ransomware campaigns.

## `dateAddedFrom` (type: `string`):

Optional earliest catalog-addition date in YYYY-MM-DD format.

## `dateAddedTo` (type: `string`):

Optional latest catalog-addition date in YYYY-MM-DD format.

## `sort` (type: `string`):

Order matching records by the date CISA added them.

## `maxResults` (type: `integer`):

Maximum number of matching KEV records to save.

## Actor input object example

```json
{
  "query": "Microsoft",
  "vendors": [],
  "products": [],
  "ransomwareOnly": false,
  "sort": "newest",
  "maxResults": 10
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "Microsoft",
    "sort": "newest",
    "maxResults": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("thirdwatch/cisa-kev-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "query": "Microsoft",
    "sort": "newest",
    "maxResults": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("thirdwatch/cisa-kev-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "Microsoft",
  "sort": "newest",
  "maxResults": 10
}' |
apify call thirdwatch/cisa-kev-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,thirdwatch/cisa-kev-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/iH3mFhHmuW1k7rKUx/builds/mJfHydNxmINMogQia/openapi.json