CISA KEV

Work with the CISA Known Exploited Vulnerabilities (KEV) catalog: the US government's authoritative list of the vulnerabilities attackers are actually exploiting. Check a scanner's findings or your software inventory against it, browse and search it by vendor, product, weakness type or date, see what CISA added this week, track remediation deadlines, pull out the ones used in ransomware campaigns, and export any of it as CSV. No account or API key required.

Actions

Action	What it does
Check CVEs against the catalog	Take a list of CVE IDs, such as the findings of a scanner, and get back which of them CISA has confirmed are being exploited.
Check products against the catalog	Take a list of software you run and get back the known exploited vulnerabilities for each one.
Export vulnerabilities as CSV	Export matching entries as CSV, ready to attach to a ticket or drop into a spreadsheet.
Get a vulnerability	Read one catalog entry in full by its CVE ID: what the flaw is, which product it affects, what CISA requires be done about it, by when, whether ransomware crews are known to use it, and the advisory links.
Get catalog details	Read which version of the CISA Known Exploited Vulnerabilities catalog is current, when CISA published it, and how much it holds: the number of vulnerabilities, vendors, products and weakness types, how many have known ransomware use, and the dates of the first and latest entries.
List products	List the products named in the catalog with how many known exploited vulnerabilities each one has, how many involve ransomware, and when their most recent entry was added.
List ransomware vulnerabilities	List only the entries CISA has confirmed are used in ransomware campaigns.
List recently added vulnerabilities	List what CISA has added to the catalog lately.
List vendors	List every vendor named in the catalog with how many known exploited vulnerabilities each one has, how many of those involve ransomware, and when their most recent entry was added.
List vulnerabilities	Browse the catalog through every filter it can be narrowed by: vendor, product, weakness type, confirmed ransomware use, when CISA added the entry, when remediation is due, and free text.
List vulnerabilities due soon	List the entries whose remediation deadline falls in the next few days, soonest first.
List weakness types (CWE)	List the MITRE weakness types the catalog's entries are classified under, with how many entries carry each one.
Search vulnerabilities	Search the catalog for a word, phrase, CVE ID or product name and get the best matches first.
Summarize the catalog	Break the whole catalog down in one step: the vendors and products with the most known-exploited vulnerabilities, the weakness types that show up most often, how many entries were added each year, how many have confirmed ransomware use, and how many are past their remediation deadline.

Check CVEs against the catalog

Take a list of CVE IDs, such as the findings of a scanner, and get back which of them CISA has confirmed are being exploited. Those are the ones to fix first. The answer separates the listed CVEs (in full) from the ones that are not listed, counts how many have known ransomware use, and sets a flag a workflow can branch on, so nothing fails just because a CVE is absent. No API key required.

Inputs

CVE IDscve_idslistRequired: The CVEs to check, up to 500. Any casing is accepted, and a value that is not a CVE ID is reported back rather than failing the step.

Outputs

any_listedtrue/false: True when at least one CVE is in the catalog, for branching a workflow on.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
checked_countnumber: How many valid CVE IDs were checked.
date_releasedtext: When CISA published that version of the catalog.
invalidlist: Values that were not CVE IDs and so were skipped.
listedlist: The matching catalog entries.
listed_countnumber: How many of the CVEs are in the catalog.
not_listedlist: The CVE IDs that are not in the catalog. That means CISA has no confirmed evidence of exploitation, not that they are harmless.
not_listed_countnumber: How many are not.
overdue_countnumber: How many of the listed CVEs are past their remediation deadline.
ransomware_countnumber: How many of the listed CVEs have known ransomware campaign use.

Example output

{
  "any_listed": true,
  "catalog_version": "2026.08.21",
  "checked_count": 2,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "invalid": [
    "not-a-cve"
  ],
  "listed": [
    {
      "cve_id": "CVE-2021-44228",
      "cwes": [
        "CWE-20",
        "CWE-400",
        "CWE-502"
      ],
      "date_added": "2021-12-10",
      "days_since_added": 1717,
      "days_until_due": -1703,
      "due_date": "2021-12-24",
      "due_status": "overdue",
      "known_ransomware_campaign_use": "Known",
      "note_urls": [
        "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
      ],
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "product": "Log4j2",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
      "used_in_ransomware": true,
      "vendor_project": "Apache",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    }
  ],
  "listed_count": 1,
  "not_listed": [
    "CVE-1999-0001"
  ],
  "not_listed_count": 1,
  "overdue_count": 1,
  "ransomware_count": 1
}

Check products against the catalog

Take a list of software you run and get back the known exploited vulnerabilities for each one. Each name is matched against the vendor and product read together, so an inventory line written the way people write them ('Ivanti Connect Secure') finds the entry however CISA split it. Every name gets its own row of matches, plus how many involve ransomware and how many are overdue. No API key required.

Inputs

ProductsproductslistRequired: The software to check, up to 100 names. Use whatever your inventory calls them: 'Log4j', 'Google Chrome', 'Ivanti Connect Secure'.
Maximum results per productlimitnumber: How many entries to return for each name. Each row also carries the total that matched it.From 1 to 500. Default: 25.

Outputs

any_listedtrue/false: True when at least one name matched, for branching a workflow on.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
checked_countnumber: How many names were checked.
date_releasedtext: When CISA published that version of the catalog.
matched_countnumber: How many of them matched at least one entry.
resultslist: One row per name that was checked.
unmatchedlist: The names with nothing in the catalog.
vulnerability_countnumber: How many distinct CVEs were found across every name.

Example output

{
  "any_listed": true,
  "catalog_version": "2026.08.21",
  "checked_count": 2,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "matched_count": 1,
  "results": [
    {
      "count": 1,
      "overdue_count": 2,
      "query": "Log4j",
      "ransomware_count": 2,
      "total_count": 2,
      "truncated": true,
      "vulnerabilities": [
        {
          "cve_id": "CVE-2021-44228",
          "cwes": [
            "CWE-20",
            "CWE-400",
            "CWE-502"
          ],
          "date_added": "2021-12-10",
          "days_since_added": 1717,
          "days_until_due": -1703,
          "due_date": "2021-12-24",
          "due_status": "overdue",
          "known_ransomware_campaign_use": "Known",
          "note_urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
          ],
          "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
          "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
          "product": "Log4j2",
          "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
          "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
          "used_in_ransomware": true,
          "vendor_project": "Apache",
          "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
        }
      ]
    }
  ],
  "unmatched": [
    "Nonexistent Widget"
  ],
  "vulnerability_count": 2
}

Export vulnerabilities as CSV

Export matching entries as CSV, ready to attach to a ticket or drop into a spreadsheet. The rows are read from the official CSV file CISA publishes alongside the JSON, so every cell is the catalog's own text under the catalog's own column names. With no filters and the row limit raised it is the whole published file. No API key required.

Inputs

Vendorvendortext: Only entries from this vendor. The list is read from the catalog itself, with the number of entries beside each name. Leave it unset for every vendor.
Productproducttext: Only entries for this product. Choose a vendor first to narrow the list to their products. Leave it unset for every product.
Ransomware useransomwaretext: Whether to keep only the entries CISA has confirmed are used in ransomware campaigns, or only the rest. 'No confirmed ransomware use' means CISA lacks confirmation, not that the vulnerability is unused by ransomware crews.One of: any (Any (no filter)), known (Known ransomware campaign use), unknown (No confirmed ransomware use). Default: any.
Added on or afteradded_fromdate: Only entries CISA added to the catalog on or after this date. Leave it empty to reach back to the catalog's first entry.
Added on or beforeadded_todate: Only entries CISA added to the catalog on or before this date. Leave it empty to include everything up to the latest entry.
Due on or afterdue_fromdate: Only entries whose remediation deadline falls on or after this date.
Due on or beforedue_todate: Only entries whose remediation deadline falls on or before this date.
Text containsquerytext: Only entries whose CVE ID, name, vendor, product, description, required action or notes contain this text. Not case sensitive.
Order bysorttext: How to order the entries. Newest added first by default.One of: date_added_desc (Date added (newest first)), date_added_asc (Date added (oldest first)), due_date_asc (Remediation due date (soonest first)), due_date_desc (Remediation due date (latest first)), cve_id_asc (CVE ID (A to Z)), cve_id_desc (CVE ID (Z to A)), vendor_asc (Vendor (A to Z)). Default: date_added_desc.
Maximum rowslimitnumber: How many rows to write. Raise it above the size of the catalog to export all of it.From 1 to 5000. Default: 500.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
columnslist: The column names, in order.
countnumber: How many rows were written.
csvtext: The CSV text, header row first, in CISA's own column order.
date_releasedtext: When CISA published that version of the catalog.
sorttext: The order the entries came back in.
source_urltext: The CSV file the rows were read from.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.

Example output

{
  "catalog_version": "2026.08.21",
  "columns": [
    "cveID",
    "vendorProject",
    "product",
    "vulnerabilityName",
    "dateAdded",
    "shortDescription",
    "requiredAction",
    "dueDate",
    "knownRansomwareCampaignUse",
    "notes",
    "cwes"
  ],
  "count": 1,
  "csv": "cveID,vendorProject,product,vulnerabilityName,dateAdded,shortDescription,requiredAction,dueDate,knownRansomwareCampaignUse,notes,cwes\nCVE-2021-44228,Apache,Log4j2,Apache Log4j2 Remote Code Execution Vulnerability,2021-12-10,Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints.,\"1) Apply updates; OR 2) remove affected assets from agency networks.\",2021-12-24,Known,https://nvd.nist.gov/vuln/detail/CVE-2021-44228,\"CWE-20,CWE-400,CWE-502\"\n",
  "date_released": "2026-08-21T17:46:43.6019Z",
  "sort": "date_added_desc",
  "source_url": "https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "total_count": 8,
  "truncated": true
}

Get a vulnerability

Read one catalog entry in full by its CVE ID: what the flaw is, which product it affects, what CISA requires be done about it, by when, whether ransomware crews are known to use it, and the advisory links. The step fails if the CVE is not in the catalog, so use 'Check CVEs against the catalog' when you are testing membership rather than reading a known entry. No API key required.

Inputs

CVE IDcve_idtextRequired: The CVE to read, such as CVE-2021-44228. Any casing is accepted.

Outputs

cve_idtext: The CVE identifier, for example 'CVE-2021-44228'.
cweslist: The MITRE weakness types this flaw is classified under, for example 'CWE-78'.
date_addedtext: The date CISA added this entry, as YYYY-MM-DD.
days_since_addednumber: How many days ago CISA added this entry.
days_until_duenumber: Days left until the remediation deadline. Negative once the deadline has passed.
due_datetext: The date the required action must be completed by, as YYYY-MM-DD. Binding on US federal agencies; a strong recommendation for everyone else.
due_statustext: 'overdue' when the deadline has passed, 'due_today' when it is today, 'upcoming' when it is still ahead.
known_ransomware_campaign_usetext: CISA's own wording: 'Known' when the vulnerability is confirmed to have been used in a ransomware campaign, 'Unknown' when CISA has no such confirmation.
note_urlslist: Just the links from the notes, one per entry.
notestext: CISA's notes: advisory and reference links separated by semicolons, some of them labelled.
nvd_urltext: This CVE's record in the NIST National Vulnerability Database.
producttext: The affected product, for example 'Log4j2'.
required_actiontext: What CISA requires be done about it, such as applying the vendor's update or taking the product out of service.
short_descriptiontext: CISA's one-paragraph description of the flaw.
used_in_ransomwaretrue/false: True when the field above reads 'Known', so a workflow can branch on it directly.
vendor_projecttext: The vendor or open-source project, for example 'Apache'.
vulnerability_nametext: CISA's name for the vulnerability.

Example output

{
  "cve_id": "CVE-2021-44228",
  "cwes": [
    "CWE-20",
    "CWE-400",
    "CWE-502"
  ],
  "date_added": "2021-12-10",
  "days_since_added": 1717,
  "days_until_due": -1703,
  "due_date": "2021-12-24",
  "due_status": "overdue",
  "known_ransomware_campaign_use": "Known",
  "note_urls": [
    "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
  ],
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "product": "Log4j2",
  "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
  "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
  "used_in_ransomware": true,
  "vendor_project": "Apache",
  "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
}

Get catalog details

Read which version of the CISA Known Exploited Vulnerabilities catalog is current, when CISA published it, and how much it holds: the number of vulnerabilities, vendors, products and weakness types, how many have known ransomware use, and the dates of the first and latest entries. Run it to check for a new release before doing anything else. No API key required.

Inputs

None.

Outputs

catalog_urltext: CISA's page for the catalog.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: The entry count CISA states in the file.
csv_urltext: The CSV file carrying the same rows.
cwe_countnumber: How many distinct weakness types appear.
date_releasedtext: When CISA published that version of the catalog.
first_addedtext: The date of the catalog's oldest entry.
json_urltext: The JSON file this data was read from.
last_addedtext: The date of its most recent entry.
product_countnumber: How many distinct products are named.
ransomware_countnumber: How many entries have known ransomware campaign use.
retrieved_attext: When this step read the catalog, in UTC.
titletext: The catalog's own title.
vendor_countnumber: How many distinct vendors are named.
vulnerability_countnumber: The number of entries actually present, which should equal the count above.

Example output

{
  "catalog_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "catalog_version": "2026.08.21",
  "count": 1674,
  "csv_url": "https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "cwe_count": 185,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "first_added": "2021-11-03",
  "json_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "last_added": "2026-08-21",
  "product_count": 701,
  "ransomware_count": 352,
  "retrieved_at": "2026-08-23T19:05:57Z",
  "title": "CISA Catalog of Known Exploited Vulnerabilities",
  "vendor_count": 278,
  "vulnerability_count": 1674
}

List products

List the products named in the catalog with how many known exploited vulnerabilities each one has, how many involve ransomware, and when their most recent entry was added. Narrow it to one vendor to see only their affected products. No API key required.

Inputs

Vendorvendortext: Only entries from this vendor. The list is read from the catalog itself, with the number of entries beside each name. Leave it unset for every vendor.
Name containsquerytext: Only names containing this text. Not case sensitive. Leave it empty for all of them.
Order bysorttext: How to order the list. Most vulnerabilities first by default.One of: count_desc (Most vulnerabilities first), name_asc (Name (A to Z)). Default: count_desc.
Maximum resultslimitnumber: How many rows to return, longest-standing first in a tie.From 1 to 1000. Default: 50.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
productslist: One row per product.
sorttext: The order the entries came back in.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 2,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "products": [
    {
      "count": 172,
      "last_added": "2026-08-12",
      "product": "Windows",
      "ransomware_count": 62,
      "vendor_project": "Microsoft"
    },
    {
      "count": 53,
      "last_added": "2026-06-16",
      "product": "Multiple Products",
      "ransomware_count": 2,
      "vendor_project": "Apple"
    }
  ],
  "sort": "count_desc",
  "total_count": 701,
  "truncated": true
}

List ransomware vulnerabilities

List only the entries CISA has confirmed are used in ransomware campaigns. These are the subset of an already-urgent catalog that a ransomware crew is known to be exploiting, so they are the ones to patch before the rest. Narrow by vendor and by when CISA added the entry. No API key required.

Inputs

Vendorvendortext: Only entries from this vendor. The list is read from the catalog itself, with the number of entries beside each name. Leave it unset for every vendor.
Added on or afteradded_fromdate: Only entries CISA added to the catalog on or after this date. Leave it empty to reach back to the catalog's first entry.
Added on or beforeadded_todate: Only entries CISA added to the catalog on or before this date. Leave it empty to include everything up to the latest entry.
Order bysorttext: How to order the entries. Newest added first by default.One of: date_added_desc (Date added (newest first)), date_added_asc (Date added (oldest first)), due_date_asc (Remediation due date (soonest first)), due_date_desc (Remediation due date (latest first)), cve_id_asc (CVE ID (A to Z)), cve_id_desc (CVE ID (Z to A)), vendor_asc (Vendor (A to Z)). Default: date_added_desc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
offsetnumber: How many matches were skipped before this page.
sorttext: The order the entries came back in.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vulnerabilitieslist: The matching catalog entries.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 1,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "offset": 0,
  "sort": "date_added_desc",
  "total_count": 352,
  "truncated": true,
  "vulnerabilities": [
    {
      "cve_id": "CVE-2021-44228",
      "cwes": [
        "CWE-20",
        "CWE-400",
        "CWE-502"
      ],
      "date_added": "2021-12-10",
      "days_since_added": 1717,
      "days_until_due": -1703,
      "due_date": "2021-12-24",
      "due_status": "overdue",
      "known_ransomware_campaign_use": "Known",
      "note_urls": [
        "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
      ],
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "product": "Log4j2",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
      "used_in_ransomware": true,
      "vendor_project": "Apache",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    }
  ]
}

List recently added vulnerabilities

List what CISA has added to the catalog lately. Give a date to start from, or a number of days to look back. Run it on a schedule to be told each week which vulnerabilities have just been confirmed as exploited in the wild. No API key required.

Inputs

Added sincesincedate: Only entries added on or after this date. Overrides the look-back below when both are set. Leave it empty to use the look-back.
Days to look backdaysnumber: How far back to look when no start date is given. CISA adds entries on weekdays, so 7 covers a week of releases.From 1 to 3650. Default: 30.
Order bysorttext: How to order the entries. Newest added first by default.One of: date_added_desc (Date added (newest first)), date_added_asc (Date added (oldest first)), due_date_asc (Remediation due date (soonest first)), due_date_desc (Remediation due date (latest first)), cve_id_asc (CVE ID (A to Z)), cve_id_desc (CVE ID (Z to A)), vendor_asc (Vendor (A to Z)). Default: date_added_desc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.

Outputs

as_of_datetext: The date the deadline comparisons were made against.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
offsetnumber: How many matches were skipped before this page.
sincetext: The start date used, whether given directly or worked out from the look-back.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vulnerabilitieslist: The matching catalog entries.

Example output

{
  "as_of_date": "2026-08-23",
  "catalog_version": "2026.08.21",
  "count": 1,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "offset": 0,
  "since": "2026-07-24",
  "total_count": 21,
  "truncated": true,
  "vulnerabilities": [
    {
      "cve_id": "CVE-2026-73570",
      "cwes": [
        "CWE-78"
      ],
      "date_added": "2026-08-21",
      "days_since_added": 2,
      "days_until_due": 12,
      "due_date": "2026-09-04",
      "due_status": "upcoming",
      "known_ransomware_campaign_use": "Unknown",
      "note_urls": [
        "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73570"
      ],
      "notes": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "product": "Zimbra Collaboration Suite (ZCS)",
      "required_action": "Apply mitigations in accordance with vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
      "used_in_ransomware": false,
      "vendor_project": "Synacor",
      "vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability"
    }
  ]
}

List vendors

List every vendor named in the catalog with how many known exploited vulnerabilities each one has, how many of those involve ransomware, and when their most recent entry was added. Use it to see who dominates the catalog, or to find the exact spelling of a vendor to filter by. No API key required.

Inputs

Name containsquerytext: Only names containing this text. Not case sensitive. Leave it empty for all of them.
Order bysorttext: How to order the list. Most vulnerabilities first by default.One of: count_desc (Most vulnerabilities first), name_asc (Name (A to Z)). Default: count_desc.
Maximum resultslimitnumber: How many rows to return, longest-standing first in a tie.From 1 to 1000. Default: 50.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
sorttext: The order the entries came back in.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vendorslist: One row per vendor.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 2,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "sort": "count_desc",
  "total_count": 278,
  "truncated": true,
  "vendors": [
    {
      "count": 385,
      "last_added": "2026-08-12",
      "name": "Microsoft",
      "ransomware_count": 114
    },
    {
      "count": 96,
      "last_added": "2026-07-30",
      "name": "Cisco",
      "ransomware_count": 9
    }
  ]
}

List vulnerabilities

Browse the catalog through every filter it can be narrowed by: vendor, product, weakness type, confirmed ransomware use, when CISA added the entry, when remediation is due, and free text. Order the results and page through them. This is the general-purpose browse action; the others answer one specific question each. No API key required.

Inputs

Vendorvendortext: Only entries from this vendor. The list is read from the catalog itself, with the number of entries beside each name. Leave it unset for every vendor.
Productproducttext: Only entries for this product. Choose a vendor first to narrow the list to their products. Leave it unset for every product.
Weaknesses (CWE)cweslist: Only entries classified under these weakness types, such as CWE-78 for OS command injection. An entry matches when it carries any one of them. Leave every option unchecked to include them all.
Ransomware useransomwaretext: Whether to keep only the entries CISA has confirmed are used in ransomware campaigns, or only the rest. 'No confirmed ransomware use' means CISA lacks confirmation, not that the vulnerability is unused by ransomware crews.One of: any (Any (no filter)), known (Known ransomware campaign use), unknown (No confirmed ransomware use). Default: any.
Added on or afteradded_fromdate: Only entries CISA added to the catalog on or after this date. Leave it empty to reach back to the catalog's first entry.
Added on or beforeadded_todate: Only entries CISA added to the catalog on or before this date. Leave it empty to include everything up to the latest entry.
Due on or afterdue_fromdate: Only entries whose remediation deadline falls on or after this date.
Due on or beforedue_todate: Only entries whose remediation deadline falls on or before this date.
Text containsquerytext: Only entries whose CVE ID, name, vendor, product, description, required action or notes contain this text. Not case sensitive.
Order bysorttext: How to order the entries. Newest added first by default.One of: date_added_desc (Date added (newest first)), date_added_asc (Date added (oldest first)), due_date_asc (Remediation due date (soonest first)), due_date_desc (Remediation due date (latest first)), cve_id_asc (CVE ID (A to Z)), cve_id_desc (CVE ID (Z to A)), vendor_asc (Vendor (A to Z)). Default: date_added_desc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 10000. Default: 0.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
offsetnumber: How many matches were skipped before this page.
sorttext: The order the entries came back in.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vulnerabilitieslist: The matching catalog entries.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 2,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "offset": 0,
  "sort": "date_added_desc",
  "total_count": 35,
  "truncated": true,
  "vulnerabilities": [
    {
      "cve_id": "CVE-2026-73570",
      "cwes": [
        "CWE-78"
      ],
      "date_added": "2026-08-21",
      "days_since_added": 2,
      "days_until_due": 12,
      "due_date": "2026-09-04",
      "due_status": "upcoming",
      "known_ransomware_campaign_use": "Unknown",
      "note_urls": [
        "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73570"
      ],
      "notes": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "product": "Zimbra Collaboration Suite (ZCS)",
      "required_action": "Apply mitigations in accordance with vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
      "used_in_ransomware": false,
      "vendor_project": "Synacor",
      "vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability"
    },
    {
      "cve_id": "CVE-2021-44228",
      "cwes": [
        "CWE-20",
        "CWE-400",
        "CWE-502"
      ],
      "date_added": "2021-12-10",
      "days_since_added": 1717,
      "days_until_due": -1703,
      "due_date": "2021-12-24",
      "due_status": "overdue",
      "known_ransomware_campaign_use": "Known",
      "note_urls": [
        "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
      ],
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "product": "Log4j2",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
      "used_in_ransomware": true,
      "vendor_project": "Apache",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    }
  ]
}

List vulnerabilities due soon

List the entries whose remediation deadline falls in the next few days, soonest first. CISA sets a due date on every entry: the date US federal agencies must have remediated it by. Optionally include the ones already past their deadline, and narrow to a single vendor. No API key required.

Inputs

Days aheadwithin_daysnumber: How far ahead to look. 0 returns only what is due today.From 0 to 3650. Default: 14.
Counting fromas_ofdate: The date to measure the window from. Leave it empty to count from today.
Include overdue entriesinclude_overduetrue/false: Also return entries whose deadline has already passed. Most of the catalog is past its deadline, so this widens the answer considerably.Default: false.
Vendorvendortext: Only entries from this vendor. The list is read from the catalog itself, with the number of entries beside each name. Leave it unset for every vendor.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.

Outputs

as_of_datetext: The date the deadline comparisons were made against.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
due_bytext: The last deadline date included.
include_overduetrue/false: Whether overdue entries were included in the answer.
offsetnumber: How many matches were skipped before this page.
overdue_countnumber: How many of the matches are already past their deadline.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vulnerabilitieslist: The matching catalog entries.

Example output

{
  "as_of_date": "2026-08-23",
  "catalog_version": "2026.08.21",
  "count": 1,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "due_by": "2026-09-06",
  "include_overdue": false,
  "offset": 0,
  "overdue_count": 0,
  "total_count": 5,
  "truncated": true,
  "vulnerabilities": [
    {
      "cve_id": "CVE-2026-73570",
      "cwes": [
        "CWE-78"
      ],
      "date_added": "2026-08-21",
      "days_since_added": 2,
      "days_until_due": 12,
      "due_date": "2026-09-04",
      "due_status": "upcoming",
      "known_ransomware_campaign_use": "Unknown",
      "note_urls": [
        "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73570"
      ],
      "notes": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "product": "Zimbra Collaboration Suite (ZCS)",
      "required_action": "Apply mitigations in accordance with vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
      "used_in_ransomware": false,
      "vendor_project": "Synacor",
      "vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability"
    }
  ]
}

List weakness types (CWE)

List the MITRE weakness types the catalog's entries are classified under, with how many entries carry each one. It is the answer to 'which classes of bug are actually being exploited?', and the place to find a CWE code to filter the browse action by. No API key required.

Inputs

Name containsquerytext: Only names containing this text. Not case sensitive. Leave it empty for all of them.
Order bysorttext: How to order the list. Most vulnerabilities first by default.One of: count_desc (Most vulnerabilities first), name_asc (Name (A to Z)). Default: count_desc.
Maximum resultslimitnumber: How many rows to return, longest-standing first in a tie.From 1 to 1000. Default: 50.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
cweslist: One row per weakness type.
date_releasedtext: When CISA published that version of the catalog.
sorttext: The order the entries came back in.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 2,
  "cwes": [
    {
      "count": 118,
      "last_added": "2026-08-12",
      "name": "CWE-20",
      "ransomware_count": 28
    },
    {
      "count": 108,
      "last_added": "2026-08-21",
      "name": "CWE-78",
      "ransomware_count": 21
    }
  ],
  "date_released": "2026-08-21T17:46:43.6019Z",
  "sort": "count_desc",
  "total_count": 185,
  "truncated": true
}

Search vulnerabilities

Search the catalog for a word, phrase, CVE ID or product name and get the best matches first. A hit on the CVE ID outranks one on the vulnerability name, which outranks the vendor or product, which outranks the description and the advisory notes, and each result says which fields it matched on. Use it when you have a term rather than a filter. No API key required.

Inputs

Search forquerytextRequired: The text to look for. Matched against the CVE ID, vulnerability name, vendor, product, description, required action and notes. Not case sensitive.
Maximum resultslimitnumber: How many matches to return, best first. The answer also carries how many matched in all.From 1 to 200. Default: 25.

Outputs

catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
countnumber: How many entries this step returned.
date_releasedtext: When CISA published that version of the catalog.
querytext: The text that was searched for.
total_countnumber: How many entries matched in all, before the limit was applied.
truncatedtrue/false: True when matches were left out by the limit.
vulnerabilitieslist: The matching catalog entries, best match first.

Example output

{
  "catalog_version": "2026.08.21",
  "count": 1,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "query": "log4j",
  "total_count": 2,
  "truncated": true,
  "vulnerabilities": [
    {
      "cve_id": "CVE-2021-44228",
      "cwes": [
        "CWE-20",
        "CWE-400",
        "CWE-502"
      ],
      "date_added": "2021-12-10",
      "days_since_added": 1717,
      "days_until_due": -1703,
      "due_date": "2021-12-24",
      "due_status": "overdue",
      "known_ransomware_campaign_use": "Known",
      "matched_fields": [
        "vulnerability_name",
        "product"
      ],
      "note_urls": [
        "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
      ],
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "product": "Log4j2",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
      "used_in_ransomware": true,
      "vendor_project": "Apache",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    }
  ]
}

Summarize the catalog

Break the whole catalog down in one step: the vendors and products with the most known-exploited vulnerabilities, the weakness types that show up most often, how many entries were added each year, how many have confirmed ransomware use, and how many are past their remediation deadline. Use it for a periodic threat-landscape report. No API key required.

Inputs

Rows per rankingtopnumber: How many entries to include in each of the vendor, product and weakness rankings.From 1 to 50. Default: 10.

Outputs

added_by_yearlist: How many entries CISA added each year, oldest year first.
as_of_datetext: The date the deadline comparisons were made against.
catalog_versiontext: The version of the catalog this answer was read from, such as '2026.08.21'. CISA versions it by release date.
cwe_countnumber: How many distinct weakness types appear.
date_releasedtext: When CISA published that version of the catalog.
due_statusobject: Entry counts by where their remediation deadline falls relative to today.
first_addedtext: The date of the oldest entry.
last_addedtext: The date of the most recent entry.
product_countnumber: How many distinct products are named.
ransomwareobject: Entry counts by confirmed ransomware use.
top_cweslist: The weakness types that appear most often.
top_productslist: The products with the most entries.
top_vendorslist: The vendors with the most entries.
total_countnumber: How many entries the catalog holds.
vendor_countnumber: How many distinct vendors are named.

Example output

{
  "added_by_year": [
    {
      "count": 311,
      "year": "2021"
    },
    {
      "count": 555,
      "year": "2022"
    }
  ],
  "as_of_date": "2026-08-23",
  "catalog_version": "2026.08.21",
  "cwe_count": 185,
  "date_released": "2026-08-21T17:46:43.6019Z",
  "due_status": {
    "due_today": 1,
    "overdue": 1669,
    "upcoming": 4
  },
  "first_added": "2021-11-03",
  "last_added": "2026-08-21",
  "product_count": 701,
  "ransomware": {
    "known": 352,
    "unknown": 1322
  },
  "top_cwes": [
    {
      "count": 118,
      "cwe": "CWE-20"
    },
    {
      "count": 108,
      "cwe": "CWE-78"
    }
  ],
  "top_products": [
    {
      "count": 172,
      "product": "Windows",
      "vendor_project": "Microsoft"
    },
    {
      "count": 53,
      "product": "Multiple Products",
      "vendor_project": "Apple"
    }
  ],
  "top_vendors": [
    {
      "count": 385,
      "vendor_project": "Microsoft"
    },
    {
      "count": 96,
      "vendor_project": "Cisco"
    }
  ],
  "total_count": 1674,
  "vendor_count": 278
}

ActionsCopy Anchor Link

Check CVEs against the catalogCopy Anchor Link

Inputs

Outputs

Check products against the catalogCopy Anchor Link

Inputs

Outputs

Export vulnerabilities as CSVCopy Anchor Link

Inputs

Outputs

Get a vulnerabilityCopy Anchor Link

Inputs

Outputs

Get catalog detailsCopy Anchor Link

Inputs

Outputs

List productsCopy Anchor Link

Inputs

Outputs

List ransomware vulnerabilitiesCopy Anchor Link

Inputs

Outputs

List recently added vulnerabilitiesCopy Anchor Link

Inputs

Outputs

List vendorsCopy Anchor Link

Inputs

Outputs

List vulnerabilitiesCopy Anchor Link

Inputs

Outputs

List vulnerabilities due soonCopy Anchor Link

Inputs

Outputs

List weakness types (CWE)Copy Anchor Link

Inputs

Outputs

Search vulnerabilitiesCopy Anchor Link

Inputs

Outputs

Summarize the catalogCopy Anchor Link

Inputs

Outputs

On this page

Actions

Check CVEs against the catalog

Check products against the catalog

Export vulnerabilities as CSV

Get a vulnerability

Get catalog details

List products

List ransomware vulnerabilities

List recently added vulnerabilities

List vendors

List vulnerabilities

List vulnerabilities due soon

List weakness types (CWE)

Search vulnerabilities

Summarize the catalog