CISA Known Exploited Vulnerabilities
CISA Known Exploited Vulnerabilities
CISA's catalog of vulnerabilities with evidence of exploitation in the wild, downloadable as JSON or CSV with CVE ID, vendor, product, date added, required action, due date, ransomware-use status and CWEs. No key is needed.
Coverage
The checked JSON contains 1,766 entries added from 2021-11-03 through 2026-10-30 and carries catalog version 2026.10.30. CISA updates the catalog as vulnerabilities meet its inclusion criteria; no fixed publication interval is stated.
Verdict
This is defensive data for prioritizing remediation around vulnerabilities CISA says have been exploited in the wild. Date added is a catalog event, not the first exploitation date, and required-action due dates are operational deadlines for covered U.S. federal agencies rather than universal risk thresholds. Entries can be revised, and absence from the catalog does not mean a vulnerability is unexploited. Third-party links in records retain their own terms.
Get the free weekly email
Free weekly email of newly verified free data. Unsubscribe by emailing us.
By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.
Use in your agent
Load the CISA KEV JSON catalog into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.
Access
- No account or key. CISA publishes complete JSON and CSV downloads.
Request
curl 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'Format
JSON catalog metadata plus vulnerability records with CVE ID, vendor, product, name, dates, description, required action, ransomware-use status, notes and CWEs.
Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
"""CISA Known Exploited Vulnerabilities JSON -> pandas -> Parquet. No key."""
import requests
import pandas as pd
URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
r = requests.get(URL, timeout=60)
r.raise_for_status()
payload = r.json()
df = pd.DataFrame(payload["vulnerabilities"])
df["dateAdded"] = pd.to_datetime(df["dateAdded"], utc=True)
df["dueDate"] = pd.to_datetime(df["dueDate"], utc=True)
df.to_parquet("cisa_kev.parquet", index=False)
print(len(df), "vulnerabilities", payload["catalogVersion"],
df["dateAdded"].min().date().isoformat(), "to", df["dateAdded"].max().date().isoformat())Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 1766 vulnerabilities 2026.10.30 2021-11-03 to 2026-10-30
Limits
- Rate limit: Not stated.
- The checked files contain the complete catalog rather than a query-filtered response.
Quirks
- dateAdded records when CISA added an entry; it is not the first exploitation date.
- Store catalogVersion and dateReleased alongside each snapshot because entries and required actions may change.
- knownRansomwareCampaignUse can be Unknown; do not interpret it as a negative finding.
Terms and attribution
- The KEV database is CC0-1.0.
- Third-party links included in the catalog retain their own policies and licenses; CISA and DHS marks are not licensed.
Sources
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog: “For the benefit of the cybersecurity community and network defenders”
- https://www.cisa.gov/sites/default/files/licenses/kev/license.txt: “The KEV database is distributed under the Creative Commons 0 1.0 License.”
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json: “"catalogVersion": "2026.10.30"”
Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer