CISA KEV Exploited Vulnerabilities: CVEs by Vendor & Due Date

The US Cybersecurity and Infrastructure Security Agency keeps a public catalog of vulnerabilities that are known to be exploited in the wild (KEV). This actor downloads that catalog on every run and hands you the part you asked for: filtered by vendor, product, CVE id, keyword, weakness code, date added or remediation deadline, with daysUntilDue, an overdue flag, the ransomware marking, the CWE codes and the advisory links already parsed out of the notes field. Watchlist mode turns it around — paste the CVE ids from a scanner report and get one row per id saying whether the catalog lists it.

No API key, no login, no proxy, no browser: one public JSON file from cisa.gov, filtered in memory. Made by Yadroo.

Use cases

• Monthly patch round — addedWithinDays: 30 gives everything the publisher added since your last review, newest first, with the deadline attached.
• One estate, one vendor list — vendors: ["Microsoft", "VMware", "Fortinet"] narrows ~1.7k entries to the software you actually run.
• Ransomware threat brief — ransomwareOnly: true keeps the entries the publisher links to ransomware campaigns (360 of 1717 today).
• Audit backlog — overdueOnly: true with the remediation view lists every entry whose federal deadline has passed, with how many days it is overdue.
• Next patch window — dueWithinDays: 14 answers "what must be fixed in the next fortnight", earliest deadline first.
• Triage a scanner export — mode: "watchlist" with your CVE ids: each id comes back with inCatalog: true/false, so nothing on your list is left unanswered.
• Daily job for a ticket queue or an agent — schedule it with onlyNew: true and each run reports only the CVEs it has not reported before.

Input

Every field is optional. With the defaults (and the prefilled vendor) a run returns the 50 newest Microsoft entries.

Field	Type	Default	Allowed values / notes
mode	string	catalog	catalog = one row per matching catalog entry. watchlist = one row per id in cveIds, listed or not; the other filters are then ignored and the run says so.
cveIds	string[]	—	Required in watchlist, a filter in catalog. CVE-2021-44228, cve 2021 44228 and 2021-44228 are all read as the same id.
vendors	string[]	prefill ["Microsoft"]	Case-insensitive substring of the vendor/project name, several values OR-ed. See Vendors.
products	string[]	—	Same matching against the product name, e.g. ["Exchange Server", "SharePoint"].
searchWords	string[]	—	Phrase that must appear in the vulnerability name, the short description or the product. The phrase that matched is returned in matchedWord.
cwes	string[]	—	Weakness codes, exact match. 78, cwe 78 and CWE-78 all mean CWE-78. See CWE codes.
ransomwareOnly	boolean	false	Keep only entries marked as known ransomware campaign use.
forensicTriageOnly	boolean	false	Keep only entries flagged for forensic triage (a recent field: 59 entries today).
addedWithinDays	integer	—	1–3650. Window on dateAdded, counted back from the start of the run in UTC. Ignored when addedFrom is set.
addedFrom	string	—	Window start, inclusive, as 2026-01-01 (UTC, ISO order only).
addedTo	string	—	Window end, inclusive, as 2026-03-31. Empty = the day the run starts.
dueWithinDays	integer	—	0–3650. Deadlines from today up to N days ahead. Cannot be combined with overdueOnly.
overdueOnly	boolean	false	Only entries whose deadline is already past (daysUntilDue is negative).
onlyNew	boolean	false	Report only CVE ids this actor has not reported before (see Monitoring).
sortBy	string	dateAddedDesc	dateAddedDesc, dateAddedAsc, dueDateAsc, dueDateDesc, vendorAsc, cveIdAsc. Applied before maxItems.
maxItems	integer	50	1–2000. The whole catalog is one download, so a bigger number costs rows, not time.
fields	string[]	all	Keep only these output fields, in this order. cveId is always included.

Filters are combined with AND, values inside one filter with OR. A value that matches nothing in the catalog is either corrected to the publisher's spelling ("Microsft" → "Microsoft", reported in the log, the status message and SUMMARY) or named as unmatched — the search is never quietly widened, and a filter whose every value is unknown fails the run with a message instead of returning an empty dataset.

Reference

What the catalog is

One JSON file published by CISA: every vulnerability the agency has confirmed as exploited, with the action US federal agencies must take and the date by which they must take it. 1717 entries on 2026-09-21, first added 2021-11-03. Entries are added on publication days (usually several times a week) and effectively never removed, so the file grows. Each run reports the catalogVersion and catalogReleasedAt of the file it read.

Vendors in the catalog

The 60 most frequent vendor/project names, with their entry count (2026-09-21). Spelling is the publisher's — match on a fragment if you are unsure ("paloalto" will not match Palo Alto Networks, "palo alto" will).

Microsoft (388), Cisco (99), Apple (94), Adobe (81), Google (75), Oracle (46), Apache (40), Ivanti (35), Linux (31), Fortinet (30), D-Link (26), VMware (26), Citrix (24), SonicWall (19), Synacor (19), Android (17), Palo Alto Networks (15), Samsung (15), SAP (14), Zyxel (13), Mozilla (13), Atlassian (13), Trend Micro (12), Qualcomm (12), SolarWinds (11), Roundcube (11), QNAP (11), Red Hat (9), Progress (9), Arm (9), Zoho (9), IBM (8), Juniper (8), NETGEAR (8), F5 (7), Mitel (7), Sophos (7), Jenkins (6), TP-Link (6), GitLab (5), N-able (5), PaperCut (5), Broadcom (5), WordPress (5), Langflow (5), Drupal (5), GNU (5), RARLAB (5), DrayTek (5), Exim (5), ConnectWise (4), JFrog (4), MikroTik (4), Sangoma (4), JetBrains (4), SimpleHelp (4), Ubiquiti (4), Kentico (4), Craft CMS (4), WatchGuard (4).

283 vendor names occur in total. To get the current list yourself, run once with no filters, maxItems: 2000 and fields: ["cveId", "vendor"], then count the vendor column.

Products

695 distinct product names. The frequent ones: Windows (172), Multiple Products (80), Chromium V8 (41), Internet Explorer (36), Kernel (34), Flash Player (33), Office (29), Win32k (25), Exchange Server (17), Zimbra Collaboration Suite (ZCS) (16), ColdFusion (16), IOS and IOS XE Software (14). Substring matching makes ["windows"] cover Windows, Windows Server and Windows Kernel alike.

CWE codes in the catalog

185 distinct codes. The 30 most frequent: CWE-20 (118, input validation), CWE-78 (110, OS command injection), CWE-787 (104, out-of-bounds write), CWE-416 (93, use after free), CWE-119 (85, memory buffer), CWE-22 (78, path traversal), CWE-502 (71, deserialization), CWE-94 (70, code injection), CWE-287 (47, authentication), CWE-306 (42, missing authentication), CWE-843 (38, type confusion), CWE-284 (36, access control), CWE-79 (33, cross-site scripting), CWE-89 (32, SQL injection), CWE-122 (32, heap overflow), CWE-264 (31), CWE-77 (30, command injection), CWE-200 (25, information exposure), CWE-434 (23, unrestricted upload), CWE-918 (22, SSRF), CWE-288 (21), CWE-269 (18), CWE-399 (18), CWE-863 (17), CWE-59 (17), CWE-125 (17, out-of-bounds read), CWE-190 (16), CWE-121 (12, stack overflow), CWE-362 (12), CWE-862 (12). 175 entries — the older ones — carry no code at all and are therefore dropped by a cwes filter.

The two flag fields

Field	Values in the feed	Output
knownRansomwareCampaignUse	Known (360), Unknown (1357)	ransomwareUse keeps the wording, ransomware is true only for Known. Unknown means the publisher has no confirmation — not that no crew uses the bug.
forensicTriage	Yes (59), No (1658)	forensicTriage is true/false; null on entries that do not carry the field at all.

Monitoring with onlyNew

The CVE ids a run reported are stored in a named key-value store in your account (kev-seen, or kev-seen-<task id> when the run comes from a task, so two schedules with different filters do not blind each other). The next run with onlyNew: true skips them, which makes a daily schedule report only what the publisher added. The first run emits everything that matches, so start it with a maxItems you are happy to pay for. Delete the store to start over.

Examples

Everything added in the last 30 days

{ "mode": "catalog", "addedWithinDays": 30, "sortBy": "dateAddedDesc", "maxItems": 25 }

Exploited Microsoft vulnerabilities

{ "mode": "catalog", "vendors": ["Microsoft"], "sortBy": "dateAddedDesc", "maxItems": 20 }

VPN and edge appliances

{ "mode": "catalog", "vendors": ["Ivanti", "Fortinet", "Citrix", "Palo Alto Networks", "SonicWall"], "sortBy": "dateAddedDesc", "maxItems": 20 }

Remediation backlog for an audit

{ "mode": "catalog", "overdueOnly": true, "sortBy": "dueDateDesc", "maxItems": 20 }

Deadlines in the next two weeks, ransomware-linked first

{ "mode": "catalog", "dueWithinDays": 14, "ransomwareOnly": true, "sortBy": "dueDateAsc", "maxItems": 20 }

Check a scanner's CVE list

{ "mode": "watchlist", "cveIds": ["CVE-2021-44228", "CVE-2023-4966", "CVE-2017-0144", "CVE-2019-11510"], "fields": ["cveId", "inCatalog", "vendor", "product", "dueDate", "ransomware"] }

Daily job: only what is new, command-injection bugs

{ "mode": "catalog", "cwes": ["CWE-78", "CWE-77"], "onlyNew": true, "sortBy": "dateAddedDesc", "maxItems": 50 }

Output

One row per vulnerability. A real row from the cloud run 40VccPAfEDyvZ2BsC (input {"vendors": ["Microsoft"], "maxItems": 50}, 2026-09-21; the two long texts are trimmed with …):

{
  "cveId": "CVE-2026-81963",
  "inCatalog": true,
  "vendor": "Microsoft",
  "product": "Windows",
  "vulnerabilityName": "Microsoft Windows Link Following Vulnerability",
  "shortDescription": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's \"Forensics Triage Requirements\" (see URL in Notes). …",
  "dateAdded": "2026-09-08",
  "dueDate": "2026-09-22",
  "daysUntilDue": 1,
  "overdue": false,
  "ransomware": false,
  "ransomwareUse": "Unknown",
  "forensicTriage": false,
  "cwes": ["CWE-59", "CWE-284"],
  "references": [
    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963",
    "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
    "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-81963"
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963",
  "notes": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triag…",
  "cveYear": 2026,
  "matchedWord": null,
  "catalogVersion": "2026.09.21",
  "catalogReleasedAt": "2026-09-21T18:46:35.087Z",
  "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "fetchedAt": "2026-09-21T22:10:36.232Z"
}

Field	Type	Meaning / when it is empty
cveId	string	CVE identifier, always present.
inCatalog	boolean	true for catalog rows; false only in watchlist mode, for an id the catalog does not list.
vendor	string	Vendor or project, the publisher's spelling. null on a not-listed watchlist row.
product	string	Affected product. Multiple Products when the entry covers a family.
vulnerabilityName	string	Short title of the vulnerability.
shortDescription	string	The publisher's description, one paragraph.
requiredAction	string	What US federal agencies must do by the deadline.
dateAdded	string	UTC date the entry was added to the catalog (YYYY-MM-DD).
dueDate	string	UTC date by which the required action must be done.
daysUntilDue	integer	Whole UTC days from the day the run started to dueDate; negative when the deadline has passed.
overdue	boolean	true when daysUntilDue is negative. 1708 of 1717 entries today.
ransomware	boolean	true when the publisher marks known ransomware campaign use.
ransomwareUse	string	The raw wording: Known or Unknown.
forensicTriage	boolean	Flagged for forensic triage under the 2026 patching directive. null when the entry does not carry the field.
cwes	string[]	Weakness codes, e.g. ["CWE-78"]. Empty on the 175 entries added before tagging.
references	string[]	Every URL found in notes, in order: vendor advisory, directive pages, the NVD link. Empty when notes has none.
nvdUrl	string	The nvd.nist.gov link out of references, null when the entry has none. Not fetched by this actor.
notes	string	The raw notes field, kept so nothing is lost in parsing.
cveYear	integer	Year part of the CVE id — handy for grouping.
matchedWord	string	The searchWords phrase that matched this entry; null when that filter was not used.
catalogVersion	string	Version of the catalog file this row came from, e.g. 2026.09.21.
catalogReleasedAt	string	Publication timestamp of that file, ISO 8601 UTC.
url	string	The catalog page (see Limits — the page has no per-entry address).
fetchedAt	string	When this run downloaded the catalog, ISO 8601 UTC.

Dataset views: Exploited vulnerabilities (overview), Remediation deadlines (deadline, days left, overdue, required action), CVE watchlist check (id, in-catalog answer, deadline, ransomware).

A SUMMARY record in the run's key-value store repeats the catalog version, how many entries matched, the corrections that were applied, the filter values that matched nothing and — in watchlist mode — which ids are not in the catalog.

Use it from code / agents

curl -X POST "https://api.apify.com/v2/acts/yadroo~cisa-kev-vulnerabilities/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"catalog","vendors":["Ivanti","Fortinet"],"dueWithinDays":30,"maxItems":20}'

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('yadroo/cisa-kev-vulnerabilities').call({ mode: 'watchlist', cveIds: ['CVE-2021-44228', 'CVE-2024-3400'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

from apify_client import ApifyClient
client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("yadroo/cisa-kev-vulnerabilities").call(run_input={"overdueOnly": True, "vendors": ["Cisco"], "maxItems": 20})
items = client.dataset(run["defaultDatasetId"]).list_items().items

MCP: add https://mcp.apify.com to Claude / Cursor / any MCP client and call the yadroo/cisa-kev-vulnerabilities tool with the same JSON input. Field names are stable, so an agent can rely on cveId, inCatalog, dueDate, daysUntilDue and ransomware.

Pricing

Pay per event: $0.001 per run start + $0.002 per dataset row. Typical runs: 20 rows ≈ $0.041; 50 rows (the default) ≈ $0.101; 500 rows ≈ $1.001; the whole catalog at maxItems: 2000 ≈ $3.44 for today's 1717 entries. A watchlist check of 10 ids costs $0.021 whether or not the ids are listed.

Keep maxItems small on schedules and use onlyNew: true: after the first run a daily job usually writes a handful of rows, because the publisher adds a handful of entries per week.

Limits & FAQ

• What the catalog is not. It lists what CISA has confirmed as exploited — not every exploited vulnerability, and not a severity ranking. There is no CVSS score, no EPSS probability, no exploit code and no affected-version range in the feed, and this actor reads no other site, so it cannot invent them. The nvdUrl and vendor links are handed to you as data to follow yourself.
• Deadlines are US federal obligations. dueDate binds US federal civilian agencies under a CISA directive. Everyone else can use it as the publisher's urgency signal, nothing more.
• Dates are whole UTC days. daysUntilDue is counted from the UTC date the run started, so a run at 23:00 in one time zone and one at 01:00 in another give the same number only if they fall on the same UTC day.
• Row links are generic. The catalog page renders its table and its search box in the browser, so there is no address that opens a single entry (checked 2026-09-21: the page's search parameter returns the full table). Every row therefore links to the catalog page; use nvdUrl or references for a per-CVE page.
• forensicTriage is new. It arrived with the 2026 patching directive; only 59 entries carry Yes today, and older entries may not carry the field at all (null).
• Update rhythm. CISA publishes on working days, not on a schedule. A run at 03:00 may legitimately return exactly yesterday's answer; catalogVersion and catalogReleasedAt tell you which file you got.
• Empty results vs errors. A filter value that matches nothing is reported, and a run whose filters can never match (an unknown vendor, a phrase no entry contains) fails with a message naming the value — so an empty dataset always means "no entry matched", never "your input was ignored".
• Watchlist ids that are not CVE ids (a product name, an advisory number) stop the run with an error naming them, rather than silently disappearing from your list.
• Terms. The catalog is published by CISA for public use and the catalog page links a licence file (https://www.cisa.gov/sites/default/licenses/kev/license.txt); read it before redistributing the data. This actor only downloads the public feed at the publisher's own rate, sends no credentials and collects no personal data (the feed contains none).

---

Made by Yadroo. Sibling actors: sanctions-screen, domain-intel, ip-intel, github-repo-intel, npm-package-intel.