{ "openapi": "3.0.1", "info": { "title": "CISA KEV Exploited Vulnerabilities: CVEs by Vendor & Due Date", "description": "Filter the CISA Known Exploited Vulnerabilities catalog by vendor, product, CVE id, keyword, date added or remediation deadline. Rows carry the CVE, vendor, product, required action, due date, days left, ransomware flag, CWE codes and reference links. Watchlist mode checks your own CVE list.", "version": "0.1", "x-build-id": "MyagZD5CipdTxtYG1" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/yadroo~cisa-kev-vulnerabilities/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-yadroo-cisa-kev-vulnerabilities", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/yadroo~cisa-kev-vulnerabilities/runs": { "post": { "operationId": "runs-sync-yadroo-cisa-kev-vulnerabilities", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/yadroo~cisa-kev-vulnerabilities/run-sync": { "post": { "operationId": "run-sync-yadroo-cisa-kev-vulnerabilities", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "mode": { "title": "What to return", "enum": [ "catalog", "watchlist" ], "type": "string", "description": "`catalog` applies the filters below to the published catalog and writes one row per entry that survives them. `watchlist` takes the ids in `cveIds` and answers for each of them separately: a full row when the id is in the catalog, and a row with `inCatalog: false` and the id alone when it is not — that is the answer to \"is anything on my patch list known to be exploited?\", which a plain catalog export cannot give. In `watchlist` the other filters are ignored (the run reports that in its status message); only `fields` still applies.", "default": "catalog" }, "cveIds": { "title": "CVE ids", "type": "array", "description": "One id per entry, written as `CVE-2021-44228` (the `CVE-` part may be left out and case does not matter). In `watchlist` this is the list to check and it is required. In `catalog` it is a filter: only these ids are returned, and ids that are not in the catalog are silently absent — switch to `watchlist` if you need to see which of them were missing.", "items": { "type": "string" } }, "vendors": { "title": "Vendor / project", "type": "array", "description": "Keep only entries whose vendor field contains one of these, case-insensitive, e.g. [\"Microsoft\"], [\"Ivanti\", \"Fortinet\", \"Citrix\"]. Entries are combined with OR. The catalog writes vendor names the way the publisher does (\"Microsoft\", \"Cisco\", \"Apple\", \"Linux\", \"D-Link\"), so a short fragment matches more than you expect — README > Reference lists the vendor names that are in the catalog today. A value that matches nothing is named in the status message and in the SUMMARY record instead of being dropped in silence.", "items": { "type": "string" } }, "products": { "title": "Product", "type": "array", "description": "Same matching as `vendors`, against the product field, e.g. [\"Windows\"], [\"Exchange Server\", \"SharePoint\"]. Useful when one vendor has far more entries than you want to read.", "items": { "type": "string" } }, "searchWords": { "title": "Words in the name or description", "type": "array", "description": "Free-text filter over the vulnerability name, the short description and the product, e.g. [\"remote code execution\"], [\"path traversal\", \"deserialization\"]. An entry matches when the whole phrase appears in one of those texts; several entries are combined with OR. The phrase that matched is repeated in the `matchedWord` output field.", "items": { "type": "string" } }, "cwes": { "title": "CWE codes", "type": "array", "description": "Keep entries tagged with one of these weakness codes, e.g. [\"CWE-78\"] for OS command injection or [\"CWE-22\"] for path traversal. Combined with OR. Older entries were added before CISA started tagging weaknesses and carry no codes, so this filter also hides them; README > Reference lists the codes that occur in the catalog.", "items": { "type": "string" } }, "ransomwareOnly": { "title": "Only vulnerabilities used in ransomware campaigns", "type": "boolean", "description": "Keep only entries the publisher marked as known to be used in ransomware campaigns. The raw wording stays in `ransomwareUse`; the boolean `ransomware` is true for exactly those entries. \"Unknown\" in the catalog means the publisher has no confirmation, not that ransomware crews ignore the bug.", "default": false }, "forensicTriageOnly": { "title": "Only entries that require forensic triage", "type": "boolean", "description": "Keep only entries the publisher flagged for forensic triage under its 2026 patching directive. The flag is a recent addition to the feed, so entries from earlier years do not carry it and are dropped by this filter.", "default": false }, "addedWithinDays": { "title": "Added in the last N days", "minimum": 1, "maximum": 3650, "type": "integer", "description": "Window on the date the entry was added to the catalog, counted back from the start of the run in UTC. 7 for a weekly review, 30 for a monthly one. Empty = no lower bound. Ignored when `addedFrom` is set." }, "addedFrom": { "title": "Added from (UTC date)", "pattern": "^(\\d{4}-\\d{2}-\\d{2})?$", "type": "string", "description": "Explicit window start as `2026-01-01` (YYYY-MM-DD, a UTC day), inclusive. Use it instead of `addedWithinDays` for a fixed reporting period. Other date formats are refused before the run starts." }, "addedTo": { "title": "Added to (UTC date)", "pattern": "^(\\d{4}-\\d{2}-\\d{2})?$", "type": "string", "description": "Explicit window end as `2026-03-31` (YYYY-MM-DD, a UTC day), inclusive. Empty = the day the run starts." }, "dueWithinDays": { "title": "Remediation due in the next N days", "minimum": 0, "maximum": 3650, "type": "integer", "description": "Keep entries whose remediation deadline falls between today and this many days ahead, e.g. 14 for the next fortnight of work. Past deadlines are excluded — use `overdueOnly` for those. Empty = no deadline filter." }, "overdueOnly": { "title": "Only past-due entries", "type": "boolean", "description": "Keep only entries whose remediation deadline is already behind us, the backlog an agency or an auditor asks about. The gap in days is in `daysUntilDue` as a negative number.", "default": false }, "onlyNew": { "title": "Only CVEs not reported in earlier runs", "type": "boolean", "description": "Remember the CVE ids this actor reported and emit only ids that are not remembered yet — made for a schedule: run daily with the same filters and each run reports what the publisher added since. The memory is a named key-value store in your account: one per task (`kev-seen-`), and for runs started without a task (API, MCP, a schedule of the actor itself) one record per filter set in `kev-seen`, so two schedules with different filters do not hide each other's CVEs. The first run of an empty memory returns up to `maxItems` matches in `sortBy` order and records every other current match as already known; give that first run a larger `maxItems` if you also want the existing backlog. A run stopped by your spending limit records only the rows it delivered, so the next run picks up the rest. Ignored in `watchlist` mode.", "default": false }, "sortBy": { "title": "Sort", "enum": [ "dateAddedDesc", "dateAddedAsc", "dueDateAsc", "dueDateDesc", "vendorAsc", "cveIdAsc" ], "type": "string", "description": "Applied before `maxItems`, so it decides which rows you get when the filters match more than you asked for. `dueDateAsc` puts the most urgent remediation work on top; `dateAddedDesc` is right for monitoring. In `watchlist` the rows keep the order of `cveIds` instead.", "default": "dateAddedDesc" }, "maxItems": { "title": "Max rows", "minimum": 1, "maximum": 5000, "type": "integer", "description": "Stop after this many rows. The whole catalog is one download, so a larger number costs rows, not time; 5000 is well above the size of the catalog today (about 1.7k entries) and returns everything that matches.", "default": 50 }, "fields": { "title": "Output fields", "type": "array", "description": "Keep only these output fields, in this order, e.g. [\"cveId\", \"vendor\", \"dueDate\", \"daysUntilDue\"]. `cveId` is always kept (first, unless you list it elsewhere). Empty = all fields.", "items": { "type": "string" } } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }