# CISA KEV Known Exploited Vulnerabilities Scraper (`parseforge/cisa-kev-scraper`) Actor

Scrapes the CISA Known Exploited Vulnerabilities catalog with optional filters for CVE ID, vendor, product, CWE, date added, ransomware use, and remediation deadline. Returns each KEV entry as a flat row.

- **URL**: https://apify.com/parseforge/cisa-kev-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Developer tools, Business, Automation
- **Stats:** 1 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $23.25 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner.jpg)](https://apify.com/parseforge?fpr=vmoqkp)

### CISA KEV Known Exploited Vulnerabilities Scraper

**Scrape the CISA Known Exploited Vulnerabilities catalog on demand, filtered by CVE, vendor, product, CWE, ransomware use, or date.** Every entry returns with its CVE ID, vendor, product, due date, and known ransomware campaign status. No API key required. Export to CSV, JSON, Excel, or XML.

CISA's Known Exploited Vulnerabilities catalog is the authoritative list of CVEs actively exploited in the wild, but there is no official API for bulk queries. This Actor reads the public JSON feed directly, applies your filters for vendor, product, CWE, ransomware use, or date ranges, and returns each match in one fixed schema. It is built for security teams who need to automate patch prioritization, compliance checks, or threat intelligence pipelines.

| Who uses it | What they scrape CISA KEV Catalog for |
|---|---|
| Vulnerability management teams | Export the latest KEV entries for their vendors to prioritize patching. |
| Threat intelligence analysts | Track which CVEs are being used in ransomware campaigns this week. |
| Compliance officers | Generate a list of KEV entries with due dates inside a reporting period for audit evidence. |
| SOC engineers | Feed filtered KEV data into a SIEM or SOAR playbook for automated alerting. |

### What it does

This Actor collects CISA KEV entries filtered by CVE ID, vendor, product, CWE, date added, ransomware campaign use, or remediation deadline, and returns each one as a flat row.

- 🔍 **CVE ID filter:** Return only the entry for a specific CVE, e.g. CVE-2021-44228.
- 🏢 **Vendor and product filters:** Narrow results to a vendor like Microsoft or a product like Log4j.
- 📅 **Date range filters:** Limit results to CVEs added after a date or with a remediation deadline after a date.
- 💰 **Ransomware flag:** Return only CVEs with known ransomware campaign use.
- 🏷️ **CWE filter:** Return only KEV entries tagged with specific CWE IDs like CWE-79 or CWE-89.
- 📊 **Flat row output:** Every vulnerability is a single row with CVE ID, vendor, product, due date, and ransomware status.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with CISA KEV Catalog data

**🛡️ Prioritize patch deployment.**

A vulnerability manager runs the Actor daily with a vendor filter for Microsoft and a date filter for the last 7 days, then feeds the CSV into their patch management tool.

**📋 Generate audit evidence.**

A compliance officer runs the Actor with a required action due date inside the current quarter and exports the list to prove all mandated fixes were addressed on time.

**🚨 Track ransomware threats.**

A threat intel analyst enables the ransomware-only flag and exports the list to brief leadership on which CVEs are actively used in ransomware campaigns.

**🤖 Automate SOC playbooks.**

A SOC engineer schedules the Actor to run hourly with a CWE filter for remote code execution flaws and pipes the JSON into a SOAR for automated ticket creation.

### Why choose this scraper

| | What you get |
|---|---|
| **No API key** | Reads the public CISA KEV JSON feed directly with no registration. |
| **Fixed schema** | Every run returns the same fields so your downstream scripts never break. |
| **Ransomware flag** | Filter to only the CVEs CISA marks as used in ransomware campaigns. |
| **Date filters** | Track new additions or upcoming remediation deadlines with date range inputs. |

### How it compares

This Actor focuses exclusively on the CISA KEV catalog with filtering by CVE, vendor, product, CWE, ransomware use, and date. The competitors below combine KEV with other vulnerability sources or scan workflows.

| Feature | ParseForge | Cyber Vulnerability Intelligence - CVE, KEV, EPSS & OSV | SBOM Vulnerability Scanner - Lockfile CVE Scan (OSV/KEV) |
|---|---|---|---|
| CISA KEV data only | Yes | Not listed | Not listed |
| Filter by vendor or product | Yes | Not listed | Not listed |
| Filter by CWE ID | Yes | Not listed | Not listed |
| Filter by ransomware campaign use | Yes | Not listed | Not listed |
| Filter by date added or due date | Yes | Not listed | Not listed |
| CVSS and NVD enrichment | Not listed | Yes | Yes |
| SBOM or lockfile scanning | Not listed | Not listed | Yes |

### Configure the run

Drive the Actor with optional filters for CVE ID, vendor, product, CWE, date added, ransomware use, or remediation deadline, and filters run as each entry is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

```json
{
 "maxItems": 10
}
```

A larger pull:

```json
{
 "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.031 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $3.10 |
| 1,000 results | $31.00 |
| 10,000 results | $310.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [CISA KEV Known Exploited Vulnerabilities Scraper](https://apify.com/parseforge/cisa-kev-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to CISA KEV Catalog through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com/?tools=parseforge/cisa-kev-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results?**

Your filters may be too restrictive. Try removing one filter at a time, starting with the CVE ID or product filter. Also check that your date format is YYYY-MM-DD.

**The vendor filter is not returning the results I expect.**

The filter is a case-insensitive substring match. Searching for 'Microsoft' will match 'Microsoft Corporation' and 'Microsoft Windows'. Try a shorter substring if you are unsure of the exact vendor name in the catalog.

**My CWE filter is not working.**

Ensure you are using the full CWE ID format like 'CWE-79' and separating multiple IDs with commas. The filter matches KEV entries that have at least one of the listed CWEs.

**The ransomware-only flag returns fewer results than I expected.**

Only a subset of KEV entries are marked with known ransomware campaign use. If you need the full list, disable the checkbox.

**The run is taking a long time.**

The Actor fetches the full catalog and then applies your filters. If you set a very high maxItems with no filters, it will collect every entry. Reduce maxItems or add filters to speed up the run.

### FAQ

| Question | Answer |
|---|---|
| What is the CISA KEV catalog? | It is the Cybersecurity and Infrastructure Security Agency's list of CVEs that have been actively exploited in the wild. Federal agencies and critical infrastructure operators are required to remediate these vulnerabilities by the listed due dates. |
| Do I need an API key or registration? | No. The Actor reads the public CISA KEV JSON feed directly. No account, API key, or authentication is required. |
| How often is the KEV data updated? | CISA updates the catalog as new exploited vulnerabilities are discovered, typically multiple times per week. Each run of this Actor fetches the latest published feed. |
| Can I filter by vendor? | Yes. Use the vendor filter to return only KEV entries where the vendor name contains your search term, e.g. 'Microsoft' or 'Cisco'. |
| Can I filter by CWE? | Yes. Provide a comma-separated list of CWE IDs like 'CWE-79,CWE-89' and the Actor returns only KEV entries tagged with at least one of those CWEs. |
| Can I get only ransomware-related vulnerabilities? | Yes. Enable the ransomware-only checkbox to return only CVEs where CISA has marked knownRansomwareCampaignUse as 'Known'. |
| What output formats are supported? | The dataset can be exported to CSV, JSON, Excel, or XML from the Apify platform. |
| Can I schedule this to run automatically? | Yes. You can set a schedule in the Apify console to run the Actor hourly, daily, or weekly with your chosen filters. |
| Is there a limit on how many vulnerabilities I can collect? | You can set the maxItems input up to 1,000,000. The full KEV catalog is typically a few thousand entries, so you can collect the entire filtered set in one run. |
| Does this Actor include CVSS scores or NVD data? | No. This Actor returns only the fields from the CISA KEV catalog itself. For CVSS scores and NVD enrichment, consider a combined vulnerability intelligence Actor. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Cybersecurity and Infrastructure Security Agency. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `cveId` (type: `string`):

Filter to a specific CVE (e.g. CVE-2021-44228). Case-insensitive substring match.

## `vendor` (type: `string`):

Filter by vendor / project name (e.g. 'Microsoft', 'Cisco', 'Apache'). Case-insensitive substring match.

## `product` (type: `string`):

Filter by product name (e.g. 'Windows', 'Log4j'). Case-insensitive substring match.

## `addedAfter` (type: `string`):

Only include CVEs added to KEV on or after this date (YYYY-MM-DD).

## `ransomwareOnly` (type: `boolean`):

Only include CVEs with knownRansomwareCampaignUse = 'Known' (used in observed ransomware campaigns).

## `cwes` (type: `string`):

Comma-separated CWE IDs (e.g. 'CWE-79,CWE-89,787'). Returns only KEV entries tagged with at least one of these CWEs.

## `requiredActionDueAfter` (type: `string`):

Only include KEV entries with a dueDate on or after this date (YYYY-MM-DD). Useful for tracking active remediation deadlines.

## `maxItems` (type: `integer`):

How many vulnerabilities to collect per run.

## Actor input object example

```json
{
  "cveId": "",
  "vendor": "",
  "product": "",
  "addedAfter": "",
  "ransomwareOnly": false,
  "cwes": "",
  "requiredActionDueAfter": "",
  "maxItems": 10
}
```

# Actor output Schema

## `overview` (type: `string`):

Overview of scraped data

## `fullData` (type: `string`):

Complete dataset

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveId": "",
    "vendor": "",
    "product": "",
    "addedAfter": "",
    "cwes": "",
    "requiredActionDueAfter": "",
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/cisa-kev-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cveId": "",
    "vendor": "",
    "product": "",
    "addedAfter": "",
    "cwes": "",
    "requiredActionDueAfter": "",
    "maxItems": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("parseforge/cisa-kev-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveId": "",
  "vendor": "",
  "product": "",
  "addedAfter": "",
  "cwes": "",
  "requiredActionDueAfter": "",
  "maxItems": 10
}' |
apify call parseforge/cisa-kev-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/cisa-kev-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/GIxqDQLX331Ij51e3/builds/teDx6WoB8nlIgH18z/openapi.json