{"uid":"cap_vyaw2idjp5JUZAO3eFgfk","slug":"datakoot-cisa-known-exploited-vulnerabilities-kev-lookup-df408de9","name":"Datakoot CISA Known Exploited Vulnerabilities (KEV) Lookup","description":"48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.","url":"https://x402.datakoot.com/api/known_exploited?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"limit":{"type":"number","description":"When listing, how many newest entries to return (default 20, max 100)."},"cve_id":{"type":"string","description":"Optional. Check a single CVE, e.g. CVE-2021-44228."},"vendor":{"type":"string","description":"Optional. Filter by vendor or product name substring."},"ransomware_only":{"type":"boolean","description":"Optional. Only vulns CISA links to known ransomware campaigns."}}},"responseSchema":{"type":"json","example":{"filter":{"vendor":null,"ransomware_only":false},"source":"CISA KEV (public domain)","released":"2026-10-02T15:19:38.2945Z","returned":5,"catalog_count":1733,"catalog_version":"2026.10.02","vulnerabilities":[{"name":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","cve_id":"CVE-2026-102490","vendor":"Zammad GmbH","product":"Zammad","due_date":"2026-10-05","date_added":"2026-10-02","description":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escal","known_ransomware_use":false},{"name":"Zammad GmbH Zammad Session Fixation Vulnerability","cve_id":"CVE-2026-102489","vendor":"Zammad GmbH","product":"Zammad","due_date":"2026-10-05","date_added":"2026-10-02","description":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. ","known_ransomware_use":false}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_vE02u1vcojjU05cqzUHXA","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Query the CISA Known Exploited Vulnerabilities catalog to retrieve CVE details, filter by vendor/product, or flag ransomware-linked vulnerabilities.","exampleAgentPrompt":"Check if CVE-2021-44228 (Log4Shell) is in the CISA Known Exploited Vulnerabilities catalog, and tell me whether it's been linked to any ransomware campaigns.","exampleUseCases":[{"title":"Rapid CVE triage for security team","prompt":"Is CVE-2023-44487 in the CISA Known Exploited Vulnerabilities list? If so, what's the remediation due date and is it tied to ransomware?"},{"title":"Vendor-specific vulnerability audit","prompt":"Pull the latest 50 known exploited vulnerabilities from CISA that involve Fortinet products so I can cross-check our firewall patch status."},{"title":"Ransomware exposure monitoring","prompt":"Give me the 20 most recently added CISA KEV entries that are specifically linked to known ransomware campaigns — I want to prioritize patching those first."}],"resultDescription":"A JSON object containing the applied filters, data source attribution (CISA KEV), catalog version and total count, timestamp of the data release, and an array of vulnerability records — each with CVE ID, vulnerability name, affected vendor and product, date added to the catalog, CISA remediation due date, a truncated description, and a boolean indicating known ransomware use.","failureModes":["Invalid CVE ID format returns an empty or error result","Vendor substring with no matches returns an empty vulnerabilities array","Limit exceeding 100 is clamped or rejected","Payment failure via x402 results in no data returned (charged only on success)","CISA upstream data source temporarily unavailable may return stale or cached data"],"whenToPreferThis":"Use this endpoint when you need real-time, authoritative data from the CISA KEV catalog — especially for compliance workflows (CISA remediation deadlines), threat intelligence enrichment, or ransomware prioritization. It is preferable to scraping the CISA website directly, querying NVD (which lacks the 'known exploited' and ransomware flags), or using generic CVE databases when the specific requirement is active exploitation evidence recognized by CISA. Ideal for security automation agents that need structured, filterable KEV data per CVE or per vendor at $0.002/call with no subscription.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:43:24.071Z","isFirstParty":false,"canonicalSlug":"datakoot-cisa-known-exploited-vulnerabilities-kev-lookup-df408de9"}