Known exploited vulnerabilities (CISA KEV)

When to choose it

A security-triage agent checks a batch of CVE IDs against the KEV edition and records when each was added and whether known ransomware campaign use is reported. Absence from the catalog does not mean a CVE is safe.

Dataset facts

Source

CISA Known Exploited Vulnerabilities catalog (cisa-kev)

Identifier

CVE ID (cisa-kev reference code)

Coverage

Every entry in the published CISA KEV edition: 1,769 entries in the edition checked 2026-11-09. The count grows as CISA adds entries; read the version and values returned by the API.

Freshness

CISA catalog release 2026-11-06T19:44:45.1797Z at the 2026-11-09 check. Versioned snapshot, not a live CISA query; no automatic refresh schedule is promised.

Limitations

Five approved source fields only: no vendor, product, vulnerability name, description, required action, notes, severity, exploit or remediation content. Due dates are CISA federal policy dates, not universal deadlines. Absence from the catalog means not listed in that edition, not safe. CWE IDs are source-supplied strings; no CWE domain is released. Not affiliated with or endorsed by CISA or DHS.

Access

Available through the paid get_reference_data REST and MCP operation at the shared Agent Master Data API, at the reference-data price. Discovery is free; inspect current pricing and terms before authorizing payment.

Usage terms

CISA KEV catalog data: CC0-1.0 under the reviewed grant; no mandatory attribution. Agent Master Data selects the approved fields and restructures the values. Preserve the provenance and public-use terms returned by the API.

Reference domain

cisa-kev

Approved source fields

• code — CVE identifier (cveID)
• label — CVE identifier as the display label
• date_added — date CISA added the CVE to the catalog (dateAdded)
• due_date — CISA’s federal remediation due date (dueDate)
• known_ransomware_campaign_use — publisher flag (knownRansomwareCampaignUse)
• cwe_ids — CWE identifiers supplied by the source (cwes)

Source fields describe the collection; use the API schema for response structure. The count and data version above describe the checked release, not a live counter.

Query capabilities

• Exact CVE IDs in the cisa-kev domain
• Case-insensitive substring query against code or label
• Cursor pagination, 1–500 values per page
• Not part of organization search or entity resolution

Reference request shape

Illustrative arguments for get_reference_data, not an executed request or a sample result. Check live availability and authorize the quoted spend before calling.

{
  "domain": "cisa-kev",
  "codes": [
    "CVE-2021-44228"
  ],
  "include_inactive": true,
  "limit": 1
}

include_inactive: true intentionally includes values whose validity is unknown. Preserve active: null and reference_value_validity_unknown; do not relabel them as known active. Use include_inactive: false if your task accepts only known-active values.

Exact input schema · Result envelope

Before accepting a result

Inspect the response’s source licenses, public-use terms, version, warnings and available source timestamps. An absent retrieval timestamp is unknown freshness, not today’s data.

Read the agent guide