{"uid":"cap_CAufBXTJSGIGdd260Nm9i","slug":"cisa-kev-catalogue-changes-feed-c9815752","name":"CISA KEV Catalogue Changes Feed","description":"Vulnerabilities added to CISA's KEV catalogue since a timestamp — each is confirmed actively exploited (significance 9-10), with the required remediation action and federal due date.","url":"https://oracles-production.up.railway.app/v1/kev/changes","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"limit":{"type":"integer","maximum":500,"minimum":1},"since":{"type":"string","format":"date-time","description":"Only changes detected after this ISO-8601 instant"},"min_significance":{"type":"integer","maximum":10,"minimum":1,"description":"Keep only changes scored at least this"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"count":{"type":"integer"},"source":{"type":"string"},"changes":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"title":{"type":"string"},"detail":{"type":"object"},"summary":{"type":"string"},"entityId":{"type":"string"},"sourceUrl":{"type":["string","null"],"description":"Primary-source link for verification"},"detectedAt":{"type":"string","format":"date-time"},"significance":{"type":"integer","maximum":10,"minimum":1},"effectiveDate":{"type":["string","null"]}}}}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lzjfeIpj8yuMXHazJNRMc","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns vulnerabilities newly added to CISA's Known Exploited Vulnerabilities (KEV) catalogue since a given timestamp, including remediation actions and federal due dates.","exampleAgentPrompt":"Show me all newly added CISA Known Exploited Vulnerabilities since 2025-01-01T00:00:00Z, only those with a significance of at least 8, and include the remediation required action and federal due dates.","exampleUseCases":null,"resultDescription":"A list of KEV catalogue additions detected after the specified timestamp, each with a CVE entity ID, vulnerability title, summary, significance score (9-10 for actively exploited), required remediation action, federal due date, source URL for verification, and the detection timestamp. Also includes total count and source attribution.","failureModes":["Missing or malformed 'since' parameter returns empty or error response","since timestamp in wrong format (not ISO-8601) causes validation error","limit exceeds 500 returns 400 bad request","No new KEV entries since timestamp returns count:0 with empty changes array","Payment failure (x402) if USDC not provided or insufficient funds","Service unavailability returns 5xx if upstream CISA data is inaccessible"],"whenToPreferThis":"Use this endpoint when you need real-time or near-real-time monitoring of the CISA KEV catalogue for newly confirmed actively exploited vulnerabilities, especially for federal compliance workflows, security operations center alerting, or vulnerability prioritization pipelines. Prefer this over generic CVE feeds when you specifically need CISA's authoritative 'confirmed actively exploited' signal with federal remediation due dates.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:55:23.900Z","isFirstParty":false}