CISA Known Exploited Vulnerabilities
SecurityUSwww.cisa.gov
The CISA KEV catalog: the CVEs that are being exploited in the wild, with the remediation date US federal agencies must meet.
Capabilities (2)
GET /v1/data/cisakev/catalog1 creditReturns the complete CISA Known Exploited Vulnerabilities catalog as one JSON document: catalogVersion (a YYYY.MM.DD string), dateReleased, count, and a vulnerabilities array of roughly 1,750 entries and growing, each with cveID, vendorProject, product, vulnerabilityName, dateAdded, shortDescription, requiredAction, dueDate, knownRansomwareCampaignUse, forensicTriage, notes and cwes. About 1.8 MB; there is no server-side filtering or paging.
GET /v1/data/cisakev/schema1 creditReturns the draft-07 JSON Schema that the KEV catalog validates against: the envelope properties, the vulnerability object definition with a per-field description and type, the CVE ID regex pattern, and the list of required fields.
Licence
A work of the United States Government, not subject to copyright protection in the United States (17 U.S.C. 105). CISA publishes the KEV catalog for public use.
https://www.cisa.gov/known-exploited-vulnerabilities-catalogAttribution
Display this wherever you show the data. It arrives on every response as provenance.attribution_text.
Source: CISA Known Exploited Vulnerabilities Catalog
Cache: up to 21600s