CISA Known Exploited Vulnerabilities (KEV) catalog
CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's public JSON feed on www.cisa.gov, keyless: check up to 100 CVE ids for KEV membership, search and browse the catalog by vendor, product, text, CWE, ransomware use, forensic triage and added or due dates, and list what CISA added in the last days. Each entry carries the date added, federal due date and required action, known ransomware campaign use, the BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links and CWEs, plus the catalog version. Adds over nvd-nist-gov (an in_kev flag and three KEV fields that lag CISA) and osv-dev (no KEV data): same-day additions, ransomware and forensic triage, notes, catalog browsing and vendor grouping.
Try CISA Known Exploited Vulnerabilities (KEV) catalog now.
Choose an example or ask your own question.
const result = await firecrawl.scrape({
alexandria: {
provider: "cisa-gov",
capability: "vulnerabilities/kev_lookup",
options: {
cve_ids: [
"CVE-2021-44228",
],
},
},
});This is a sample shape. Press Run to see live data from CISA Known Exploited Vulnerabilities (KEV) catalog.
{
"catalog": {
"catalog_version": "2026.10.23",
"count": 1756,
"date_released": "2026-10-23T19:30:18.9209Z",
"title": "CISA Catalog of Known Exploited Vulnerabilities"
},
"in_kev_count": 1,
"observed_at_ms": 1792790027238,
"requested": 1,
"results": [
{
"cve_id": "CVE-2021-44228",
"entry": {
"cve_id": "CVE-2021-44228",
"cwes": [
"CWE-20",
"CWE-400",
"CWE-502"
],
"date_added": "2021-12-10",
"due_date": "2021-12-24",
"forensic_triage": "No",
"known_ransomware_campaign_use": "Known",
"note_urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
],
"notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
"product": "Log4j2",
"required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
"short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
"vendor_project": "Apache",
"vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
},
"in_kev": true
}
],
"source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
}