CISA KEV Known Exploited Vulnerabilities Scraper

CISA KEV Known Exploited Vulnerabilities Scraper

Scrape the CISA Known Exploited Vulnerabilities catalog on demand, filtered by CVE, vendor, product, CWE, ransomware use, or date. Every entry returns with its CVE ID, vendor, product, due date, and known ransomware campaign status. No API key required. Export to CSV, JSON, Excel, or XML.

CISA's Known Exploited Vulnerabilities catalog is the authoritative list of CVEs actively exploited in the wild, but there is no official API for bulk queries. This Actor reads the public JSON feed directly, applies your filters for vendor, product, CWE, ransomware use, or date ranges, and returns each match in one fixed schema. It is built for security teams who need to automate patch prioritization, compliance checks, or threat intelligence pipelines.

Who uses it	What they scrape CISA KEV Catalog for
Vulnerability management teams	Export the latest KEV entries for their vendors to prioritize patching.
Threat intelligence analysts	Track which CVEs are being used in ransomware campaigns this week.
Compliance officers	Generate a list of KEV entries with due dates inside a reporting period for audit evidence.
SOC engineers	Feed filtered KEV data into a SIEM or SOAR playbook for automated alerting.

What it does

This Actor collects CISA KEV entries filtered by CVE ID, vendor, product, CWE, date added, ransomware campaign use, or remediation deadline, and returns each one as a flat row.

• 🔍 CVE ID filter: Return only the entry for a specific CVE, e.g. CVE-2021-44228.
• 🏢 Vendor and product filters: Narrow results to a vendor like Microsoft or a product like Log4j.
• 📅 Date range filters: Limit results to CVEs added after a date or with a remediation deadline after a date.
• 💰 Ransomware flag: Return only CVEs with known ransomware campaign use.
• 🏷️ CWE filter: Return only KEV entries tagged with specific CWE IDs like CWE-79 or CWE-89.
• 📊 Flat row output: Every vulnerability is a single row with CVE ID, vendor, product, due date, and ransomware status.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with CISA KEV Catalog data

🛡️ Prioritize patch deployment.

A vulnerability manager runs the Actor daily with a vendor filter for Microsoft and a date filter for the last 7 days, then feeds the CSV into their patch management tool.

📋 Generate audit evidence.

A compliance officer runs the Actor with a required action due date inside the current quarter and exports the list to prove all mandated fixes were addressed on time.

🚨 Track ransomware threats.

A threat intel analyst enables the ransomware-only flag and exports the list to brief leadership on which CVEs are actively used in ransomware campaigns.

🤖 Automate SOC playbooks.

A SOC engineer schedules the Actor to run hourly with a CWE filter for remote code execution flaws and pipes the JSON into a SOAR for automated ticket creation.

Why choose this scraper

	What you get
No API key	Reads the public CISA KEV JSON feed directly with no registration.
Fixed schema	Every run returns the same fields so your downstream scripts never break.
Ransomware flag	Filter to only the CVEs CISA marks as used in ransomware campaigns.
Date filters	Track new additions or upcoming remediation deadlines with date range inputs.

How it compares

This Actor focuses exclusively on the CISA KEV catalog with filtering by CVE, vendor, product, CWE, ransomware use, and date. The competitors below combine KEV with other vulnerability sources or scan workflows.

Feature	ParseForge	Cyber Vulnerability Intelligence - CVE, KEV, EPSS & OSV	SBOM Vulnerability Scanner - Lockfile CVE Scan (OSV/KEV)
CISA KEV data only	Yes	Not listed	Not listed
Filter by vendor or product	Yes	Not listed	Not listed
Filter by CWE ID	Yes	Not listed	Not listed
Filter by ransomware campaign use	Yes	Not listed	Not listed
Filter by date added or due date	Yes	Not listed	Not listed
CVSS and NVD enrichment	Not listed	Yes	Yes
SBOM or lockfile scanning	Not listed	Not listed	Yes

Configure the run

Drive the Actor with optional filters for CVE ID, vendor, product, CWE, date added, ransomware use, or remediation deadline, and filters run as each entry is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10
}

A larger pull:

{
 "maxItems": 200
}

Pricing

Pay-per-result: $0.031 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.10
1,000 results	$31.00
10,000 results	$310.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the CISA KEV Known Exploited Vulnerabilities Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to CISA KEV Catalog through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/cisa-kev-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Your filters may be too restrictive. Try removing one filter at a time, starting with the CVE ID or product filter. Also check that your date format is YYYY-MM-DD.

The vendor filter is not returning the results I expect.

The filter is a case-insensitive substring match. Searching for 'Microsoft' will match 'Microsoft Corporation' and 'Microsoft Windows'. Try a shorter substring if you are unsure of the exact vendor name in the catalog.

My CWE filter is not working.

Ensure you are using the full CWE ID format like 'CWE-79' and separating multiple IDs with commas. The filter matches KEV entries that have at least one of the listed CWEs.

The ransomware-only flag returns fewer results than I expected.

Only a subset of KEV entries are marked with known ransomware campaign use. If you need the full list, disable the checkbox.

The run is taking a long time.

The Actor fetches the full catalog and then applies your filters. If you set a very high maxItems with no filters, it will collect every entry. Reduce maxItems or add filters to speed up the run.

FAQ

Question	Answer
What is the CISA KEV catalog?	It is the Cybersecurity and Infrastructure Security Agency's list of CVEs that have been actively exploited in the wild. Federal agencies and critical infrastructure operators are required to remediate these vulnerabilities by the listed due dates.
Do I need an API key or registration?	No. The Actor reads the public CISA KEV JSON feed directly. No account, API key, or authentication is required.
How often is the KEV data updated?	CISA updates the catalog as new exploited vulnerabilities are discovered, typically multiple times per week. Each run of this Actor fetches the latest published feed.
Can I filter by vendor?	Yes. Use the vendor filter to return only KEV entries where the vendor name contains your search term, e.g. 'Microsoft' or 'Cisco'.
Can I filter by CWE?	Yes. Provide a comma-separated list of CWE IDs like 'CWE-79,CWE-89' and the Actor returns only KEV entries tagged with at least one of those CWEs.
Can I get only ransomware-related vulnerabilities?	Yes. Enable the ransomware-only checkbox to return only CVEs where CISA has marked knownRansomwareCampaignUse as 'Known'.
What output formats are supported?	The dataset can be exported to CSV, JSON, Excel, or XML from the Apify platform.
Can I schedule this to run automatically?	Yes. You can set a schedule in the Apify console to run the Actor hourly, daily, or weekly with your chosen filters.
Is there a limit on how many vulnerabilities I can collect?	You can set the maxItems input up to 1,000,000. The full KEV catalog is typically a few thousand entries, so you can collect the entire filtered set in one run.
Does this Actor include CVSS scores or NVD data?	No. This Actor returns only the fields from the CISA KEV catalog itself. For CVSS scores and NVD enrichment, consider a combined vulnerability intelligence Actor.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Cybersecurity and Infrastructure Security Agency. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.