Exploited CVE Search API: CISA KEV search by vendor, product, CVE or ransomware linkage

CISA KEV search by vendor, product, CVE or ransomware linkage, with days-since-added and days-to-deadline computed per entry. Exploited-in-the-wild, not just published. Free, no key.

Free — no key, no signup, rate-limited to 60 calls per minute per client.

How do you call it?

GET /v1/cyber/kev — product id kev_search. Over MCP, call answerpool_get with product_id=kev_search.

curl "https://answerpool.io/v1/cyber/kev?vendor=Microsoft"

Live call: https://answerpool.io/v1/cyber/kev?vendor=Microsoft · JSON sample: /v1/samples/kev_search

What does the answer look like?

A representative response, the same static sample served at /v1/samples/kev_search.

entries

{
 "as_of": "2026-09-03T16:00:00Z",
 "catalog_version": "2026.09.02",
 "catalog_released": "2026-09-02T16:54:39.832Z",
 "catalog_size": 1694,
 "matched": 1,
 "count": 1,
 "entries": [
  {
   "cve_id": "CVE-2026-59822",
   "vendor": "BerriAI",
   "product": "LiteLLM",
   "vulnerability_name": "BerriAI LiteLLM Improper Access Control Vulnerability",
   "date_added": "2026-09-02",
   "due_date": "2026-09-16",
   "days_since_added": 1,
   "days_until_due": 13,
   "past_due": false,
   "known_ransomware_use": false,
   "required_action": "Apply mitigations per vendor instructions or discontinue use.",
   "cwes": [
    "CWE-284"
   ],
   "cve_url": "https://www.cve.org/CVERecord?id=CVE-2026-59822"
  }
 ],
 "note": "Day-counts are computed from the federal remediation deadline CISA sets for agencies; they are a severity/urgency signal for everyone else, not an obligation.",
 "source": "CISA Known Exploited Vulnerabilities catalog",
 "refresh_after": "2026-09-18T00:00:00.000Z"
}

How fresh is it, and where does the data come from?

The fastest source behind this answer can change daily, so every response carries a refresh_after timestamp — right now it would be 2026-09-18T00:00:00.000Z. Schedule the next call on that value rather than on a guess.

• CISA Known Exploited Vulnerabilities catalog (US federal public domain) — upstream: https://www.cisa.gov/sites/default/files/feeds

Method version 0.1.0 · serving cache 1 day · every response carries a result_id you can resolve at /v1/provenance.

When should you use it?

You need to know whether a vulnerability is actively exploited and how urgent it is.

What you skip building

• downloading and filtering the KEV JSON
• deadline date arithmetic

When should you not use it?

CVE description text or full CVSS detail — follow cve_url; the catalog covers exploited CVEs only, not all published vulnerabilities.

Where else can you find this?

• Catalog entry (JSON, free)
• OpenAPI schema — input and output types, prices, the 402 flow
• llms.txt — every product in one plain-text document