---
name: cisa-kev-ingestion
description: "How to get CISA Known Exploited Vulnerabilities data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load the CISA KEV JSON catalog into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/cisa-kev
Provider: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key. CISA publishes complete JSON and CSV downloads.

## Request
```bash
curl 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
```

## Format
JSON catalog metadata plus vulnerability records with CVE ID, vendor, product, name, dates, description, required action, ransomware-use status, notes and CWEs.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""CISA Known Exploited Vulnerabilities JSON -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
r = requests.get(URL, timeout=60)
r.raise_for_status()
payload = r.json()
df = pd.DataFrame(payload["vulnerabilities"])
df["dateAdded"] = pd.to_datetime(df["dateAdded"], utc=True)
df["dueDate"] = pd.to_datetime(df["dueDate"], utc=True)
df.to_parquet("cisa_kev.parquet", index=False)
print(len(df), "vulnerabilities", payload["catalogVersion"],
      df["dateAdded"].min().date().isoformat(), "to", df["dateAdded"].max().date().isoformat())
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 1766 vulnerabilities 2026.10.30 2021-11-03 to 2026-10-30

## Limits
- Rate limit: Not stated.
- The checked files contain the complete catalog rather than a query-filtered response.

## Quirks
- dateAdded records when CISA added an entry; it is not the first exploitation date.
- Store catalogVersion and dateReleased alongside each snapshot because entries and required actions may change.
- knownRansomwareCampaignUse can be Unknown; do not interpret it as a negative finding.

## Terms and attribution
- The KEV database is CC0-1.0.
- Third-party links included in the catalog retain their own policies and licenses; CISA and DHS marks are not licensed.
- Terms page: https://www.cisa.gov/sites/default/files/licenses/kev/license.txt

## Sources
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog: "For the benefit of the cybersecurity community and network defenders"
- https://www.cisa.gov/sites/default/files/licenses/kev/license.txt: "The KEV database is distributed under the Creative Commons 0 1.0 License."
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json: ""catalogVersion": "2026.10.30""

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.