Exploitation Trends API: Aggregates over the CISA KEV catalog: top exploited vendors all-time

Aggregates over the CISA KEV catalog: top exploited vendors all-time and recent, additions by month, top CWE weakness types, ransomware share and past-due count. Free, no key.

Free — no key, no signup, rate-limited to 60 calls per minute per client.

How do you call it?

GET /v1/cyber/kev/stats — product id kev_stats. Over MCP, call answerpool_get with product_id=kev_stats.

curl "https://answerpool.io/v1/cyber/kev/stats?days=90"

Live call: https://answerpool.io/v1/cyber/kev/stats?days=90 · JSON sample: /v1/samples/kev_stats

What does the answer look like?

A representative response, the same static sample served at /v1/samples/kev_stats.

top_vendors_all_time

{
 "as_of": "2026-09-03T16:00:00Z",
 "catalog_version": "2026.09.02",
 "catalog_size": 1694,
 "window_days": 90,
 "added_in_window": 37,
 "ransomware_linked_total": 288,
 "ransomware_share_pct": 17.0,
 "past_due_total": 1602,
 "top_vendors_all_time": [
  {
   "key": "Microsoft",
   "count": 331
  }
 ],
 "top_vendors_in_window": [
  {
   "key": "Cisco",
   "count": 6
  }
 ],
 "additions_by_month": [
  {
   "key": "2026-08",
   "count": 12
  }
 ],
 "top_cwes": [
  {
   "key": "CWE-78",
   "count": 61
  }
 ],
 "note": "Counts are AnswerPool aggregates over the CISA catalog: which vendors' products are most often found exploited, how additions are trending, and how much of the catalog is ransomware-linked. Counts reflect what CISA has catalogued, which is a floor on real exploitation, not a census.",
 "source": "CISA Known Exploited Vulnerabilities catalog",
 "refresh_after": "2026-09-18T00:00:00.000Z"
}

How fresh is it, and where does the data come from?

The fastest source behind this answer can change daily, so every response carries a refresh_after timestamp — right now it would be 2026-09-18T00:00:00.000Z. Schedule the next call on that value rather than on a guess.

• CISA Known Exploited Vulnerabilities catalog (US federal public domain) — upstream: https://www.cisa.gov/sites/default/files/feeds

Method version 0.1.0 · serving cache 1 day · every response carries a result_id you can resolve at /v1/provenance.

When should you use it?

You want the distribution and trend of real-world exploitation.

What you skip building

• downloading 1
• 700 records to group them
• month bucketing
• CWE tallying

When should you not use it?

A specific CVE or vendor lookup — /v1/cyber/kev.

Where else can you find this?

• Catalog entry (JSON, free)
• OpenAPI schema — input and output types, prices, the 402 flow
• llms.txt — every product in one plain-text document