# CISA KEV Exploited Vulnerabilities: CVEs by Vendor & Due Date (`yadroo/cisa-kev-vulnerabilities`) Actor

Filter the CISA Known Exploited Vulnerabilities catalog by vendor, product, CVE id, keyword, date added or remediation deadline. Rows carry the CVE, vendor, product, required action, due date, days left, ransomware flag, CWE codes and reference links. Watchlist mode checks your own CVE list.

- **URL**: https://apify.com/yadroo/cisa-kev-vulnerabilities.md
- **Developed by:** [Samat Makatov](https://apify.com/yadroo) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.40 / 1,000 vulnerability row returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV Exploited Vulnerabilities: CVEs by Vendor & Due Date

The US Cybersecurity and Infrastructure Security Agency keeps a public catalog of vulnerabilities that are **known to be exploited in the wild** (KEV). This actor downloads that catalog on every run and hands you the part you asked for: filtered by vendor, product, CVE id, keyword, weakness code, date added or remediation deadline, with `daysUntilDue`, an `overdue` flag, the ransomware marking, the CWE codes and the advisory links already parsed out of the notes field. Watchlist mode turns it around — paste the CVE ids from a scanner report and get one row per id saying whether the catalog lists it.

No API key, no login, no proxy, no browser: one public JSON file from `cisa.gov`, filtered in memory. Made by Yadroo.

### Use cases

- **Monthly patch round** — `addedWithinDays: 30` gives everything the publisher added since your last review, newest first, with the deadline attached.
- **One estate, one vendor list** — `vendors: ["Microsoft", "VMware", "Fortinet"]` narrows ~1.7k entries to the software you actually run.
- **Ransomware threat brief** — `ransomwareOnly: true` keeps the entries the publisher links to ransomware campaigns (360 of 1717 today).
- **Audit backlog** — `overdueOnly: true` with the `remediation` view lists every entry whose federal deadline has passed, with how many days it is overdue.
- **Next patch window** — `dueWithinDays: 14` answers "what must be fixed in the next fortnight", earliest deadline first.
- **Triage a scanner export** — `mode: "watchlist"` with your CVE ids: each id comes back with `inCatalog: true/false`, so nothing on your list is left unanswered.
- **Daily job for a ticket queue or an agent** — schedule it with `onlyNew: true` and each run reports only the CVEs it has not reported before.

### Input

Every field is optional. With the defaults (and the prefilled vendor) a run returns the 50 newest Microsoft entries.

| Field | Type | Default | Allowed values / notes |
|---|---|---|---|
| `mode` | string | `catalog` | `catalog` = one row per matching catalog entry. `watchlist` = one row per id in `cveIds`, listed or not; the other filters are then ignored and the run says so. |
| `cveIds` | string\[] | — | Required in `watchlist`, a filter in `catalog`. `CVE-2021-44228`, `cve 2021 44228` and `2021-44228` are all read as the same id. |
| `vendors` | string\[] | prefill `["Microsoft"]` | Case-insensitive substring of the vendor/project name, several values OR-ed. See [Vendors](#vendors-in-the-catalog). |
| `products` | string\[] | — | Same matching against the product name, e.g. `["Exchange Server", "SharePoint"]`. |
| `searchWords` | string\[] | — | Phrase that must appear in the vulnerability name, the short description or the product. The phrase that matched is returned in `matchedWord`. |
| `cwes` | string\[] | — | Weakness codes, exact match. `78`, `cwe 78` and `CWE-78` all mean `CWE-78`. See [CWE codes](#cwe-codes-in-the-catalog). |
| `ransomwareOnly` | boolean | `false` | Keep only entries marked as known ransomware campaign use. |
| `forensicTriageOnly` | boolean | `false` | Keep only entries flagged for forensic triage (a recent field: 59 entries today). |
| `addedWithinDays` | integer | — | 1–3650. Window on `dateAdded`, counted back from the start of the run in UTC. Ignored when `addedFrom` is set. |
| `addedFrom` | string | — | Window start, inclusive, as `2026-01-01` (UTC, ISO order only). |
| `addedTo` | string | — | Window end, inclusive, as `2026-03-31`. Empty = the day the run starts. |
| `dueWithinDays` | integer | — | 0–3650. Deadlines from today up to N days ahead. Cannot be combined with `overdueOnly`. |
| `overdueOnly` | boolean | `false` | Only entries whose deadline is already past (`daysUntilDue` is negative). |
| `onlyNew` | boolean | `false` | Report only CVE ids this actor has not reported before (see [Monitoring](#monitoring-with-onlynew)). |
| `sortBy` | string | `dateAddedDesc` | `dateAddedDesc`, `dateAddedAsc`, `dueDateAsc`, `dueDateDesc`, `vendorAsc`, `cveIdAsc`. Applied before `maxItems`. |
| `maxItems` | integer | `50` | 1–2000. The whole catalog is one download, so a bigger number costs rows, not time. |
| `fields` | string\[] | all | Keep only these output fields, in this order. `cveId` is always included. |

Filters are combined with **AND**, values inside one filter with **OR**. A value that matches nothing in the catalog is either corrected to the publisher's spelling (`"Microsft"` → `"Microsoft"`, reported in the log, the status message and `SUMMARY`) or named as unmatched — the search is never quietly widened, and a filter whose every value is unknown fails the run with a message instead of returning an empty dataset.

### Reference

#### What the catalog is

One JSON file published by CISA: every vulnerability the agency has confirmed as exploited, with the action US federal agencies must take and the date by which they must take it. 1717 entries on 2026-09-21, first added 2021-11-03. Entries are added on publication days (usually several times a week) and effectively never removed, so the file grows. Each run reports the `catalogVersion` and `catalogReleasedAt` of the file it read.

#### Vendors in the catalog

The 60 most frequent vendor/project names, with their entry count (2026-09-21). Spelling is the publisher's — match on a fragment if you are unsure (`"paloalto"` will *not* match `Palo Alto Networks`, `"palo alto"` will).

`Microsoft` (388), `Cisco` (99), `Apple` (94), `Adobe` (81), `Google` (75), `Oracle` (46), `Apache` (40), `Ivanti` (35), `Linux` (31), `Fortinet` (30), `D-Link` (26), `VMware` (26), `Citrix` (24), `SonicWall` (19), `Synacor` (19), `Android` (17), `Palo Alto Networks` (15), `Samsung` (15), `SAP` (14), `Zyxel` (13), `Mozilla` (13), `Atlassian` (13), `Trend Micro` (12), `Qualcomm` (12), `SolarWinds` (11), `Roundcube` (11), `QNAP` (11), `Red Hat` (9), `Progress` (9), `Arm` (9), `Zoho` (9), `IBM` (8), `Juniper` (8), `NETGEAR` (8), `F5` (7), `Mitel` (7), `Sophos` (7), `Jenkins` (6), `TP-Link` (6), `GitLab` (5), `N-able` (5), `PaperCut` (5), `Broadcom` (5), `WordPress` (5), `Langflow` (5), `Drupal` (5), `GNU` (5), `RARLAB` (5), `DrayTek` (5), `Exim` (5), `ConnectWise` (4), `JFrog` (4), `MikroTik` (4), `Sangoma` (4), `JetBrains` (4), `SimpleHelp` (4), `Ubiquiti` (4), `Kentico` (4), `Craft CMS` (4), `WatchGuard` (4).

283 vendor names occur in total. To get the current list yourself, run once with no filters, `maxItems: 2000` and `fields: ["cveId", "vendor"]`, then count the `vendor` column.

#### Products

695 distinct product names. The frequent ones: `Windows` (172), `Multiple Products` (80), `Chromium V8` (41), `Internet Explorer` (36), `Kernel` (34), `Flash Player` (33), `Office` (29), `Win32k` (25), `Exchange Server` (17), `Zimbra Collaboration Suite (ZCS)` (16), `ColdFusion` (16), `IOS and IOS XE Software` (14). Substring matching makes `["windows"]` cover `Windows`, `Windows Server` and `Windows Kernel` alike.

#### CWE codes in the catalog

185 distinct codes. The 30 most frequent: `CWE-20` (118, input validation), `CWE-78` (110, OS command injection), `CWE-787` (104, out-of-bounds write), `CWE-416` (93, use after free), `CWE-119` (85, memory buffer), `CWE-22` (78, path traversal), `CWE-502` (71, deserialization), `CWE-94` (70, code injection), `CWE-287` (47, authentication), `CWE-306` (42, missing authentication), `CWE-843` (38, type confusion), `CWE-284` (36, access control), `CWE-79` (33, cross-site scripting), `CWE-89` (32, SQL injection), `CWE-122` (32, heap overflow), `CWE-264` (31), `CWE-77` (30, command injection), `CWE-200` (25, information exposure), `CWE-434` (23, unrestricted upload), `CWE-918` (22, SSRF), `CWE-288` (21), `CWE-269` (18), `CWE-399` (18), `CWE-863` (17), `CWE-59` (17), `CWE-125` (17, out-of-bounds read), `CWE-190` (16), `CWE-121` (12, stack overflow), `CWE-362` (12), `CWE-862` (12). 175 entries — the older ones — carry no code at all and are therefore dropped by a `cwes` filter.

#### The two flag fields

| Field | Values in the feed | Output |
|---|---|---|
| `knownRansomwareCampaignUse` | `Known` (360), `Unknown` (1357) | `ransomwareUse` keeps the wording, `ransomware` is `true` only for `Known`. `Unknown` means the publisher has no confirmation — not that no crew uses the bug. |
| `forensicTriage` | `Yes` (59), `No` (1658) | `forensicTriage` is `true`/`false`; `null` on entries that do not carry the field at all. |

#### Monitoring with `onlyNew`

The CVE ids a run reported are stored in a named key-value store in **your** account (`kev-seen`, or `kev-seen-<task id>` when the run comes from a task, so two schedules with different filters do not blind each other). The next run with `onlyNew: true` skips them, which makes a daily schedule report only what the publisher added. The first run emits everything that matches, so start it with a `maxItems` you are happy to pay for. Delete the store to start over.

### Examples

**Everything added in the last 30 days**

```json
{ "mode": "catalog", "addedWithinDays": 30, "sortBy": "dateAddedDesc", "maxItems": 25 }
```

**Exploited Microsoft vulnerabilities**

```json
{ "mode": "catalog", "vendors": ["Microsoft"], "sortBy": "dateAddedDesc", "maxItems": 20 }
```

**VPN and edge appliances**

```json
{ "mode": "catalog", "vendors": ["Ivanti", "Fortinet", "Citrix", "Palo Alto Networks", "SonicWall"], "sortBy": "dateAddedDesc", "maxItems": 20 }
```

**Remediation backlog for an audit**

```json
{ "mode": "catalog", "overdueOnly": true, "sortBy": "dueDateDesc", "maxItems": 20 }
```

**Deadlines in the next two weeks, ransomware-linked first**

```json
{ "mode": "catalog", "dueWithinDays": 14, "ransomwareOnly": true, "sortBy": "dueDateAsc", "maxItems": 20 }
```

**Check a scanner's CVE list**

```json
{ "mode": "watchlist", "cveIds": ["CVE-2021-44228", "CVE-2023-4966", "CVE-2017-0144", "CVE-2019-11510"], "fields": ["cveId", "inCatalog", "vendor", "product", "dueDate", "ransomware"] }
```

**Daily job: only what is new, command-injection bugs**

```json
{ "mode": "catalog", "cwes": ["CWE-78", "CWE-77"], "onlyNew": true, "sortBy": "dateAddedDesc", "maxItems": 50 }
```

### Output

One row per vulnerability. A real row from the cloud run `40VccPAfEDyvZ2BsC` (input `{"vendors": ["Microsoft"], "maxItems": 50}`, 2026-09-21; the two long texts are trimmed with `…`):

```json
{
  "cveId": "CVE-2026-81963",
  "inCatalog": true,
  "vendor": "Microsoft",
  "product": "Windows",
  "vulnerabilityName": "Microsoft Windows Link Following Vulnerability",
  "shortDescription": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's \"Forensics Triage Requirements\" (see URL in Notes). …",
  "dateAdded": "2026-09-08",
  "dueDate": "2026-09-22",
  "daysUntilDue": 1,
  "overdue": false,
  "ransomware": false,
  "ransomwareUse": "Unknown",
  "forensicTriage": false,
  "cwes": ["CWE-59", "CWE-284"],
  "references": [
    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963",
    "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
    "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-81963"
  ],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963",
  "notes": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triag…",
  "cveYear": 2026,
  "matchedWord": null,
  "catalogVersion": "2026.09.21",
  "catalogReleasedAt": "2026-09-21T18:46:35.087Z",
  "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "fetchedAt": "2026-09-21T22:10:36.232Z"
}
```

| Field | Type | Meaning / when it is empty |
|---|---|---|
| `cveId` | string | CVE identifier, always present. |
| `inCatalog` | boolean | `true` for catalog rows; `false` only in watchlist mode, for an id the catalog does not list. |
| `vendor` | string | Vendor or project, the publisher's spelling. `null` on a not-listed watchlist row. |
| `product` | string | Affected product. `Multiple Products` when the entry covers a family. |
| `vulnerabilityName` | string | Short title of the vulnerability. |
| `shortDescription` | string | The publisher's description, one paragraph. |
| `requiredAction` | string | What US federal agencies must do by the deadline. |
| `dateAdded` | string | UTC date the entry was added to the catalog (`YYYY-MM-DD`). |
| `dueDate` | string | UTC date by which the required action must be done. |
| `daysUntilDue` | integer | Whole UTC days from the day the run started to `dueDate`; negative when the deadline has passed. |
| `overdue` | boolean | `true` when `daysUntilDue` is negative. 1708 of 1717 entries today. |
| `ransomware` | boolean | `true` when the publisher marks known ransomware campaign use. |
| `ransomwareUse` | string | The raw wording: `Known` or `Unknown`. |
| `forensicTriage` | boolean | Flagged for forensic triage under the 2026 patching directive. `null` when the entry does not carry the field. |
| `cwes` | string\[] | Weakness codes, e.g. `["CWE-78"]`. Empty on the 175 entries added before tagging. |
| `references` | string\[] | Every URL found in `notes`, in order: vendor advisory, directive pages, the NVD link. Empty when `notes` has none. |
| `nvdUrl` | string | The `nvd.nist.gov` link out of `references`, `null` when the entry has none. Not fetched by this actor. |
| `notes` | string | The raw notes field, kept so nothing is lost in parsing. |
| `cveYear` | integer | Year part of the CVE id — handy for grouping. |
| `matchedWord` | string | The `searchWords` phrase that matched this entry; `null` when that filter was not used. |
| `catalogVersion` | string | Version of the catalog file this row came from, e.g. `2026.09.21`. |
| `catalogReleasedAt` | string | Publication timestamp of that file, ISO 8601 UTC. |
| `url` | string | The catalog page (see Limits — the page has no per-entry address). |
| `fetchedAt` | string | When this run downloaded the catalog, ISO 8601 UTC. |

Dataset views: **Exploited vulnerabilities** (overview), **Remediation deadlines** (deadline, days left, overdue, required action), **CVE watchlist check** (id, in-catalog answer, deadline, ransomware).

A `SUMMARY` record in the run's key-value store repeats the catalog version, how many entries matched, the corrections that were applied, the filter values that matched nothing and — in watchlist mode — which ids are not in the catalog.

### Use it from code / agents

```bash
curl -X POST "https://api.apify.com/v2/acts/yadroo~cisa-kev-vulnerabilities/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"catalog","vendors":["Ivanti","Fortinet"],"dueWithinDays":30,"maxItems":20}'
```

```js
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('yadroo/cisa-kev-vulnerabilities').call({ mode: 'watchlist', cveIds: ['CVE-2021-44228', 'CVE-2024-3400'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
```

```python
from apify_client import ApifyClient
client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("yadroo/cisa-kev-vulnerabilities").call(run_input={"overdueOnly": True, "vendors": ["Cisco"], "maxItems": 20})
items = client.dataset(run["defaultDatasetId"]).list_items().items
```

MCP: add `https://mcp.apify.com` to Claude / Cursor / any MCP client and call the `yadroo/cisa-kev-vulnerabilities` tool with the same JSON input. Field names are stable, so an agent can rely on `cveId`, `inCatalog`, `dueDate`, `daysUntilDue` and `ransomware`.

### Pricing

Pay per event: **$0.001 per run start + $0.002 per dataset row**. Typical runs: 20 rows ≈ $0.041; 50 rows (the default) ≈ $0.101; 500 rows ≈ $1.001; the whole catalog at `maxItems: 2000` ≈ $3.44 for today's 1717 entries. A watchlist check of 10 ids costs $0.021 whether or not the ids are listed.

Keep `maxItems` small on schedules and use `onlyNew: true`: after the first run a daily job usually writes a handful of rows, because the publisher adds a handful of entries per week.

### Limits & FAQ

- **What the catalog is not.** It lists what CISA has confirmed as exploited — not every exploited vulnerability, and not a severity ranking. There is no CVSS score, no EPSS probability, no exploit code and no affected-version range in the feed, and this actor reads no other site, so it cannot invent them. The `nvdUrl` and vendor links are handed to you as data to follow yourself.
- **Deadlines are US federal obligations.** `dueDate` binds US federal civilian agencies under a CISA directive. Everyone else can use it as the publisher's urgency signal, nothing more.
- **Dates are whole UTC days.** `daysUntilDue` is counted from the UTC date the run started, so a run at 23:00 in one time zone and one at 01:00 in another give the same number only if they fall on the same UTC day.
- **Row links are generic.** The catalog page renders its table and its search box in the browser, so there is no address that opens a single entry (checked 2026-09-21: the page's search parameter returns the full table). Every row therefore links to the catalog page; use `nvdUrl` or `references` for a per-CVE page.
- **`forensicTriage` is new.** It arrived with the 2026 patching directive; only 59 entries carry `Yes` today, and older entries may not carry the field at all (`null`).
- **Update rhythm.** CISA publishes on working days, not on a schedule. A run at 03:00 may legitimately return exactly yesterday's answer; `catalogVersion` and `catalogReleasedAt` tell you which file you got.
- **Empty results vs errors.** A filter value that matches nothing is reported, and a run whose filters can never match (an unknown vendor, a phrase no entry contains) fails with a message naming the value — so an empty dataset always means "no entry matched", never "your input was ignored".
- **Watchlist ids that are not CVE ids** (a product name, an advisory number) stop the run with an error naming them, rather than silently disappearing from your list.
- **Terms.** The catalog is published by CISA for public use and the catalog page links a licence file (`https://www.cisa.gov/sites/default/licenses/kev/license.txt`); read it before redistributing the data. This actor only downloads the public feed at the publisher's own rate, sends no credentials and collects no personal data (the feed contains none).

***

Made by **Yadroo**. Sibling actors: [sanctions-screen](https://apify.com/yadroo/sanctions-screen), [domain-intel](https://apify.com/yadroo/domain-intel), [ip-intel](https://apify.com/yadroo/ip-intel), [github-repo-intel](https://apify.com/yadroo/github-repo-intel), [npm-package-intel](https://apify.com/yadroo/npm-package-intel).

# Actor input Schema

## `mode` (type: `string`):

`catalog` applies the filters below to the published catalog and writes one row per entry that survives them. `watchlist` takes the ids in `cveIds` and answers for each of them separately: a full row when the id is in the catalog, and a row with `inCatalog: false` and the id alone when it is not — that is the answer to "is anything on my patch list known to be exploited?", which a plain catalog export cannot give. In `watchlist` the other filters are ignored (the run reports that in its status message); only `fields` still applies.

## `cveIds` (type: `array`):

One id per entry, written as `CVE-2021-44228` (the `CVE-` part may be left out and case does not matter). In `watchlist` this is the list to check and it is required. In `catalog` it is a filter: only these ids are returned, and ids that are not in the catalog are silently absent — switch to `watchlist` if you need to see which of them were missing.

## `vendors` (type: `array`):

Keep only entries whose vendor field contains one of these, case-insensitive, e.g. \["Microsoft"], \["Ivanti", "Fortinet", "Citrix"]. Entries are combined with OR. The catalog writes vendor names the way the publisher does ("Microsoft", "Cisco", "Apple", "Linux", "D-Link"), so a short fragment matches more than you expect — README > Reference lists the vendor names that are in the catalog today. A value that matches nothing is named in the status message and in the SUMMARY record instead of being dropped in silence.

## `products` (type: `array`):

Same matching as `vendors`, against the product field, e.g. \["Windows"], \["Exchange Server", "SharePoint"]. Useful when one vendor has far more entries than you want to read.

## `searchWords` (type: `array`):

Free-text filter over the vulnerability name, the short description and the product, e.g. \["remote code execution"], \["path traversal", "deserialization"]. An entry matches when the whole phrase appears in one of those texts; several entries are combined with OR. The phrase that matched is repeated in the `matchedWord` output field.

## `cwes` (type: `array`):

Keep entries tagged with one of these weakness codes, e.g. \["CWE-78"] for OS command injection or \["CWE-22"] for path traversal. Combined with OR. Older entries were added before CISA started tagging weaknesses and carry no codes, so this filter also hides them; README > Reference lists the codes that occur in the catalog.

## `ransomwareOnly` (type: `boolean`):

Keep only entries the publisher marked as known to be used in ransomware campaigns. The raw wording stays in `ransomwareUse`; the boolean `ransomware` is true for exactly those entries. "Unknown" in the catalog means the publisher has no confirmation, not that ransomware crews ignore the bug.

## `forensicTriageOnly` (type: `boolean`):

Keep only entries the publisher flagged for forensic triage under its 2026 patching directive. The flag is a recent addition to the feed, so entries from earlier years do not carry it and are dropped by this filter.

## `addedWithinDays` (type: `integer`):

Window on the date the entry was added to the catalog, counted back from the start of the run in UTC. 7 for a weekly review, 30 for a monthly one. Empty = no lower bound. Ignored when `addedFrom` is set.

## `addedFrom` (type: `string`):

Explicit window start as `2026-01-01`, inclusive. Use it instead of `addedWithinDays` for a fixed reporting period.

## `addedTo` (type: `string`):

Explicit window end as `2026-03-31`, inclusive. Empty = the day the run starts.

## `dueWithinDays` (type: `integer`):

Keep entries whose remediation deadline falls between today and this many days ahead, e.g. 14 for the next fortnight of work. Past deadlines are excluded — use `overdueOnly` for those. Empty = no deadline filter.

## `overdueOnly` (type: `boolean`):

Keep only entries whose remediation deadline is already behind us, the backlog an agency or an auditor asks about. The gap in days is in `daysUntilDue` as a negative number.

## `onlyNew` (type: `boolean`):

Remember the CVE ids written by this actor in its key-value store and emit only ids that are not there yet. Made for a schedule: run daily with the same filters and each run reports only what the publisher added since. The first run emits everything that matches, so give it a `maxItems` you are happy to pay for.

## `sortBy` (type: `string`):

Applied before `maxItems`, so it decides which rows you get when the filters match more than you asked for. `dueDateAsc` puts the most urgent remediation work on top; `dateAddedDesc` is right for monitoring. In `watchlist` the rows keep the order of `cveIds` instead.

## `maxItems` (type: `integer`):

Stop after this many rows. The whole catalog is one download, so a larger number costs rows, not time; 2000 is above the size of the catalog today and returns everything that matches.

## `fields` (type: `array`):

Keep only these output fields, in this order, e.g. \["cveId", "vendor", "dueDate", "daysUntilDue"]. Empty = all fields.

## Actor input object example

```json
{
  "mode": "catalog",
  "vendors": [
    "Microsoft"
  ],
  "ransomwareOnly": false,
  "forensicTriageOnly": false,
  "overdueOnly": false,
  "onlyNew": false,
  "sortBy": "dateAddedDesc",
  "maxItems": 50
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "vendors": [
        "Microsoft"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("yadroo/cisa-kev-vulnerabilities").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "vendors": ["Microsoft"] }

# Run the Actor and wait for it to finish
run = client.actor("yadroo/cisa-kev-vulnerabilities").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "vendors": [
    "Microsoft"
  ]
}' |
apify call yadroo/cisa-kev-vulnerabilities --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,yadroo/cisa-kev-vulnerabilities"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/WRJfn2arZfc17R5qV/builds/jfUpbBcEe6ex4XeRp/openapi.json