{
  "openapi": "3.0.1",
  "info": {
    "title": "CISA KEV Exploited Vulnerabilities: CVEs by Vendor & Due Date",
    "description": "Filter the CISA Known Exploited Vulnerabilities catalog by vendor, product, CVE id, keyword, date added or remediation deadline. Rows carry the CVE, vendor, product, required action, due date, days left, ransomware flag, CWE codes and reference links. Watchlist mode checks your own CVE list.",
    "version": "0.1",
    "x-build-id": "jfUpbBcEe6ex4XeRp"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/yadroo~cisa-kev-vulnerabilities/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-yadroo-cisa-kev-vulnerabilities",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/yadroo~cisa-kev-vulnerabilities/runs": {
      "post": {
        "operationId": "runs-sync-yadroo-cisa-kev-vulnerabilities",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/yadroo~cisa-kev-vulnerabilities/run-sync": {
      "post": {
        "operationId": "run-sync-yadroo-cisa-kev-vulnerabilities",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "mode": {
            "title": "What to return",
            "enum": [
              "catalog",
              "watchlist"
            ],
            "type": "string",
            "description": "`catalog` applies the filters below to the published catalog and writes one row per entry that survives them. `watchlist` takes the ids in `cveIds` and answers for each of them separately: a full row when the id is in the catalog, and a row with `inCatalog: false` and the id alone when it is not — that is the answer to \"is anything on my patch list known to be exploited?\", which a plain catalog export cannot give. In `watchlist` the other filters are ignored (the run reports that in its status message); only `fields` still applies.",
            "default": "catalog"
          },
          "cveIds": {
            "title": "CVE ids",
            "type": "array",
            "description": "One id per entry, written as `CVE-2021-44228` (the `CVE-` part may be left out and case does not matter). In `watchlist` this is the list to check and it is required. In `catalog` it is a filter: only these ids are returned, and ids that are not in the catalog are silently absent — switch to `watchlist` if you need to see which of them were missing.",
            "items": {
              "type": "string"
            }
          },
          "vendors": {
            "title": "Vendor / project",
            "type": "array",
            "description": "Keep only entries whose vendor field contains one of these, case-insensitive, e.g. [\"Microsoft\"], [\"Ivanti\", \"Fortinet\", \"Citrix\"]. Entries are combined with OR. The catalog writes vendor names the way the publisher does (\"Microsoft\", \"Cisco\", \"Apple\", \"Linux\", \"D-Link\"), so a short fragment matches more than you expect — README > Reference lists the vendor names that are in the catalog today. A value that matches nothing is named in the status message and in the SUMMARY record instead of being dropped in silence.",
            "items": {
              "type": "string"
            }
          },
          "products": {
            "title": "Product",
            "type": "array",
            "description": "Same matching as `vendors`, against the product field, e.g. [\"Windows\"], [\"Exchange Server\", \"SharePoint\"]. Useful when one vendor has far more entries than you want to read.",
            "items": {
              "type": "string"
            }
          },
          "searchWords": {
            "title": "Words in the name or description",
            "type": "array",
            "description": "Free-text filter over the vulnerability name, the short description and the product, e.g. [\"remote code execution\"], [\"path traversal\", \"deserialization\"]. An entry matches when the whole phrase appears in one of those texts; several entries are combined with OR. The phrase that matched is repeated in the `matchedWord` output field.",
            "items": {
              "type": "string"
            }
          },
          "cwes": {
            "title": "CWE codes",
            "type": "array",
            "description": "Keep entries tagged with one of these weakness codes, e.g. [\"CWE-78\"] for OS command injection or [\"CWE-22\"] for path traversal. Combined with OR. Older entries were added before CISA started tagging weaknesses and carry no codes, so this filter also hides them; README > Reference lists the codes that occur in the catalog.",
            "items": {
              "type": "string"
            }
          },
          "ransomwareOnly": {
            "title": "Only vulnerabilities used in ransomware campaigns",
            "type": "boolean",
            "description": "Keep only entries the publisher marked as known to be used in ransomware campaigns. The raw wording stays in `ransomwareUse`; the boolean `ransomware` is true for exactly those entries. \"Unknown\" in the catalog means the publisher has no confirmation, not that ransomware crews ignore the bug.",
            "default": false
          },
          "forensicTriageOnly": {
            "title": "Only entries that require forensic triage",
            "type": "boolean",
            "description": "Keep only entries the publisher flagged for forensic triage under its 2026 patching directive. The flag is a recent addition to the feed, so entries from earlier years do not carry it and are dropped by this filter.",
            "default": false
          },
          "addedWithinDays": {
            "title": "Added in the last N days",
            "minimum": 1,
            "maximum": 3650,
            "type": "integer",
            "description": "Window on the date the entry was added to the catalog, counted back from the start of the run in UTC. 7 for a weekly review, 30 for a monthly one. Empty = no lower bound. Ignored when `addedFrom` is set."
          },
          "addedFrom": {
            "title": "Added from (UTC date)",
            "type": "string",
            "description": "Explicit window start as `2026-01-01`, inclusive. Use it instead of `addedWithinDays` for a fixed reporting period."
          },
          "addedTo": {
            "title": "Added to (UTC date)",
            "type": "string",
            "description": "Explicit window end as `2026-03-31`, inclusive. Empty = the day the run starts."
          },
          "dueWithinDays": {
            "title": "Remediation due in the next N days",
            "minimum": 0,
            "maximum": 3650,
            "type": "integer",
            "description": "Keep entries whose remediation deadline falls between today and this many days ahead, e.g. 14 for the next fortnight of work. Past deadlines are excluded — use `overdueOnly` for those. Empty = no deadline filter."
          },
          "overdueOnly": {
            "title": "Only past-due entries",
            "type": "boolean",
            "description": "Keep only entries whose remediation deadline is already behind us, the backlog an agency or an auditor asks about. The gap in days is in `daysUntilDue` as a negative number.",
            "default": false
          },
          "onlyNew": {
            "title": "Only CVEs not reported in earlier runs",
            "type": "boolean",
            "description": "Remember the CVE ids written by this actor in its key-value store and emit only ids that are not there yet. Made for a schedule: run daily with the same filters and each run reports only what the publisher added since. The first run emits everything that matches, so give it a `maxItems` you are happy to pay for.",
            "default": false
          },
          "sortBy": {
            "title": "Sort",
            "enum": [
              "dateAddedDesc",
              "dateAddedAsc",
              "dueDateAsc",
              "dueDateDesc",
              "vendorAsc",
              "cveIdAsc"
            ],
            "type": "string",
            "description": "Applied before `maxItems`, so it decides which rows you get when the filters match more than you asked for. `dueDateAsc` puts the most urgent remediation work on top; `dateAddedDesc` is right for monitoring. In `watchlist` the rows keep the order of `cveIds` instead.",
            "default": "dateAddedDesc"
          },
          "maxItems": {
            "title": "Max rows",
            "minimum": 1,
            "maximum": 2000,
            "type": "integer",
            "description": "Stop after this many rows. The whole catalog is one download, so a larger number costs rows, not time; 2000 is above the size of the catalog today and returns everything that matches.",
            "default": 50
          },
          "fields": {
            "title": "Output fields",
            "type": "array",
            "description": "Keep only these output fields, in this order, e.g. [\"cveId\", \"vendor\", \"dueDate\", \"daysUntilDue\"]. Empty = all fields.",
            "items": {
              "type": "string"
            }
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}