Microsoft Windows and SharePoint, ransomware use known

What this example returns

The dataset’s “Catalog entries” view shows 12 columns: CVE ID, Vendor / project, Product, Name, Added, Due, Ransomware use, Forensic triage, CWEs, Description, Required action, and NVD. See every output field.

What each setting does

The input this example runs CISA KEV Catalog Scraper with. “Try this input” opens it in the console, where you can run it as-is or change any field first.

Sort by sortBy

Due date, soonest first

Order of the saved entries. Applied before the maximum results.

Default: Date added, newest first → this example uses Due date, soonest first

Vendors or projects vendors

Microsoft

Only entries whose vendor/project contains one of these words (any case), e.g. Microsoft, Apache.

Products products

Windows, SharePoint

Only entries whose product contains one of these words (any case), e.g. Exchange Server, Chrome.

Date added from dateAddedFrom

2024-01-01

Only entries added on or after this day (YYYY-MM-DD).

Date added to dateAddedTo

2025-12-31

Only entries added on or before this day (YYYY-MM-DD).

Due date from dueDateFrom

2024-01-01

Only entries whose CISA due date is on or after this day (YYYY-MM-DD).

Due date to dueDateTo

2025-12-31

Only entries whose CISA due date is on or before this day (YYYY-MM-DD).

Known ransomware campaign use knownRansomwareCampaignUse

Known

Keep only entries with this value of the catalog's knownRansomwareCampaignUse field.

Default: Any → this example uses Known

{
  "vendors": [
    "Microsoft"
  ],
  "products": [
    "Windows",
    "SharePoint"
  ],
  "dateAddedFrom": "2024-01-01",
  "dateAddedTo": "2025-12-31",
  "dueDateFrom": "2024-01-01",
  "dueDateTo": "2025-12-31",
  "knownRansomwareCampaignUse": "Known",
  "sortBy": "dueSoonest"
}

What it costs

You pay for the events the actor reports, such as each result or page it produces. Platform usage is included in the event prices: compute, proxies, browser and storage cost nothing extra.

• Catalog entryfrom $0.000595One CISA KEV catalog entry saved: CVE ID, vendor, product, name, description, dates, ransomware use, forensic triage, required action, notes and CWEs.

Full pricing

When to use this example

From the CISA KEV Catalog Scraper readme:

Other ways to run CISA KEV Catalog Scraper

• Look up CVE IDsCheck a list of CVE IDs against the catalog.
• Added in the last 90 daysThe 20 newest catalog entries added in the last 90 days.
• Command injection entries by CWEEntries tagged CWE-78 or CWE-77 that mention command injection, by CVE ID.

All examples of CISA KEV Catalog Scraper

About CISA KEV Catalog Scraper

Export the CISA Known Exploited Vulnerabilities (KEV) catalog: CVE ID, vendor, product, name, description, date added, due date, ransomware use, forensic triage, required action, notes and CWEs. Whole catalog or filtered by date, vendor, product, keyword or CWE. No login needed.

Price:

from $0.595 / 1,000 results

Developer:

Querystone

Categories:

Developer tools, Automation

CISA KEV Catalog Scraper pageOutput fieldsPricing