Skip to content

CISA KEV Catalog Scraper

Try for free

Export the CISA Known Exploited Vulnerabilities (KEV) catalog: CVE ID, vendor, product, name, description, date added, due date, ransomware use, forensic triage, required action, notes and CWEs. Whole catalog or filtered by date, vendor, product, keyword or CWE. No login needed.

🛡️ CISA KEV Catalog Scraper

Export the CISA Known Exploited Vulnerabilities (KEV) catalog as clean rows: CVE ID, vendor, product, name, description, date added, due date, known ransomware campaign use, forensic triage, required action, notes and CWEs. Get the whole catalog in one run (1,779 entries on 2026-11-10, a few seconds) or only the entries you need, filtered by date, vendor, product, keyword, CWE or flags. No login, no API key. $0.85 per 1,000 entries on the Free plan, platform usage included.

✨ Why use CISA KEV Catalog Scraper?

  • 📚 The whole catalog by default: every entry CISA lists, with every field of the official feed, in one dataset.
  • 🎯 Filters that combine: CVE IDs, vendor, product, keyword, CWE, date added (range or "last N days"), due date range, ransomware use and forensic triage.
  • 🏛️ Official source: read from CISA's public JSON feed, with the official CSV feed and CISA's own GitHub copy as fallbacks when the main feed does not answer.
  • 🔗 Ready-to-use links: the reference links from the notes as a list, plus the NVD page of every CVE.
  • 🗓️ Made for schedules: "Added in the last N days" returns only the new entries, so a daily run costs cents.
  • 🧾 Catalog version on every row: you always know which catalog release a row came from (when the CSV fallback had to be used, only the release time is known).

🎯 Use cases

  • 🗂️ Keep a copy of the KEV catalog in your database, spreadsheet or data warehouse.
  • 📅 Track the due dates of the entries that affect the vendors and products you use.
  • 🔔 Get the entries added since yesterday or last week with a scheduled run.
  • 📊 Report on the catalog: entries per vendor, per CWE, per month, ransomware use.
  • 🔍 Check a list of CVE IDs against the catalog in one run.

🚀 How to use

  1. Open the actor and leave the filters empty for the whole catalog, or set the filters you need.
  2. Optionally set Maximum results and Sort by (newest first by default).
  3. Click Start. The run takes a few seconds.
  4. Download the dataset as JSON, CSV, Excel or XML, or read it through the API.

📥 Input

FieldWhat it does
maxResultsHow many entries to save. Empty or 0 = every matching entry.
sortBynewest (default), oldest, dueSoonest, dueLatest or cveId.
cveIdsOnly these CVE IDs. IDs not in the catalog are named in the run status.
vendors / productsOnly entries whose vendor/project or product contains one of these words (any case).
keywordsOnly entries with one of these words in the CVE ID, vendor, product, name, description or notes.
addedInLastDaysOnly entries added in the last N days (UTC, today included).
dateAddedFrom / dateAddedToDate-added range (YYYY-MM-DD).
dueDateFrom / dueDateToDue-date range (YYYY-MM-DD).
knownRansomwareCampaignUseany (default), Known or Unknown.
forensicTriageany (default), Yes or No.
cwesOnly entries tagged with one of these CWE IDs (CWE-79 or 79).

All filters are optional and combine: an entry is saved when it matches every filter you set.

{
  "vendors": ["Microsoft"],
  "dateAddedFrom": "2026-01-01",
  "knownRansomwareCampaignUse": "Known",
  "sortBy": "dueSoonest"
}

📤 Output

FieldDescription
cveIDCVE ID
vendorProjectVendor or project
productProduct
vulnerabilityNameName CISA gives the entry
dateAddedDay CISA added the entry
shortDescriptionCISA's short description
requiredActionRequired action
dueDateDue date for the required action
knownRansomwareCampaignUseKnown or Unknown
forensicTriageYes or No
notesNotes and reference links as CISA publishes them
cwesWeakness IDs (CWE); empty when CISA lists none
noteUrlsThe links found in notes
nvdUrlNVD page of the CVE
catalogVersion / catalogReleasedAtThe catalog release the row was read from

Fields CISA adds to the feed later are passed through as they come.

{
  "cveID": "CVE-2020-29583",
  "vendorProject": "Zyxel",
  "product": "Multiple Products",
  "vulnerabilityName": "Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability",
  "dateAdded": "2021-11-03",
  "shortDescription": "Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account (\"zyfwp\") with an unchangeable password.",
  "requiredAction": "Apply updates per vendor instructions.",
  "dueDate": "2022-05-03",
  "knownRansomwareCampaignUse": "Unknown",
  "forensicTriage": "No",
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-29583",
  "cwes": ["CWE-522"],
  "noteUrls": ["https://nvd.nist.gov/vuln/detail/CVE-2020-29583"],
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-29583",
  "catalogVersion": "2026.11.10",
  "catalogReleasedAt": "2026-11-10T19:03:29.8375Z"
}

💰 Pricing

You pay per catalog entry saved. Platform usage (compute and proxy) is included, so that is the whole price.

EventFreeStarterScaleBusiness
Catalog entry (per 1,000)$0.85$0.765$0.68$0.595

Example: the whole catalog (1,779 entries on 2026-11-10) costs about $1.51 on the Free plan and $1.06 on Business. A daily run with "Added in the last N days" set to 1 usually saves only a few entries and costs well under a cent. Runs that match nothing are not charged.

❓ FAQ

Is it legal to use this data? The KEV catalog is public data that CISA publishes for anyone to download and reuse.

Do I need a login, an API key or my own proxy? No. The catalog is public; the default Scrape.ly datacenter proxy is all the run needs.

How many entries can I get? All of them. There is no cap: with no filter the run saves the whole catalog.

How fresh is the data? Every run downloads the current catalog. CISA updates it when it adds entries; catalogVersion and catalogReleasedAt on each row show which release you got.

Why is cwes empty for some entries? CISA lists no CWE for those entries (175 of 1,779 on 2026-11-10).

Can I schedule it or use the API? Yes. Schedule a daily run with "Added in the last N days" = 1, or call the actor from the Scrape.ly API, CLI or MCP server.

⚠️ Limits

  • The data is exactly what CISA publishes: no CVSS scores, exploit details or product version ranges are added.
  • Vendor, product and keyword filters match words inside the field (any case), not exact names, so "Office" also matches "OfficeScan".
  • Dates are compared as calendar days in UTC.

Related actors

//From the blog\\

Latest articles

All articles
G2
4.7/5
Excellent
Trustpilot

The internet is full of data.
Start owning yours.

Scrape.ly gives you the infrastructure, the tooling, and the team to extract, process, and operationalize web data at any scale. Setup takes minutes.

Get Started FreeChat with Support
No credit card. No setup calls.