How to Scrape the CISA KEV Catalog

The vulnerability backlog for a large organization can contain thousands of technically valid findings. The CISA KEV Scraper creates a smaller feed of CVEs that CISA says have been exploited in the wild, with remediation-oriented fields preserved.

Start with a bounded filter

Search across CVE IDs, vendors, products, descriptions, actions, and notes:

{"query":"Microsoft","dateAddedFrom":"2026-01-01","sort":"newest","maxResults":100}

For a vendor watchlist, leave query empty and populate vendors. Product filters use substring matching, so a value such as SharePoint can cover several product-name variants. ransomwareOnly keeps only records CISA explicitly marks as known ransomware-campaign use; entries marked unknown are excluded.

Each result contains the CVE, vendor, product, vulnerability name, date added, description, required action, due date, ransomware status, CWE values, notes, and catalog release metadata. Use cve_id as the stable record key. Store catalog version and release time with every snapshot so changes are auditable.

The due date should not be interpreted as a universal service-level agreement. It is published in the context of CISA directives, while private organizations need risk-based timelines appropriate to their assets and obligations. Likewise, absence from KEV does not show that a CVE is unexploited or low risk.

Schedule this Actor daily, then compare CVE IDs against the previous complete snapshot. Route newly added records through asset matching before opening tickets. A KEV for a product the organization does not operate is useful intelligence, but not an affected asset. Preserve vendor guidance links from the notes when validating remediation.