cisa_kev_lookup
Filter the CISA Known Exploited Vulnerabilities (KEV) catalog by CVE, vendor, product, ransomware use, or due date to check mandatory-remediation status under BOD 22-01.
Instructions
Filter the CISA Known Exploited Vulnerabilities (KEV) catalog standalone (keyless; www.cisa.gov feed, cached) — the mandatory-remediation list carrying BINDING due-dates under BOD 22-01 / its 2026 successor BOD 26-04. Works even when NVD is rate-limited (a separate host, no key). Filters (all optional, AND-combined, client-side): cveId (exact KEV membership check), vendorProject/product (case-insensitive substring), ransomwareOnly (knownRansomwareCampaignUse === 'Known'), addedSince/dueBefore (ISO YYYY-MM-DD); limit (≤1000, def 100), offset. Returns { catalogVersion, dateReleased, count, found?, matches:[{ cveID, vendorProject, product, vulnerabilityName, dateAdded, dueDate, knownRansomwareCampaignUse, shortDescription, requiredAction, cwes, nvdUrl }] } + honest _meta. ★HONESTY: knownRansomwareCampaignUse and requiredAction are surfaced VERBATIM (never defaulted); dueDate is the CISA-mandated remediation deadline. A cveId NOT in the catalog ⇒ found:false — but the not-in-KEV≠safe caveat rides on EVERY response: KEV is a CURATED SUBSET of confirmed in-the-wild exploitation, so absence means CISA has not catalogued it, NOT that the component is unexploited/safe. A catalog download failure / floor-fail / count-drift THROWS (a truncated/near-empty catalog must never read as 'nothing is exploited') — never a fake-empty. The snapshot freshness (catalogVersion + release date + cache age) is disclosed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cveId | No | Exact CVE identifier CVE-YYYY-NNNN to check for KEV membership. A miss returns found:false + the not-in-KEV≠safe caveat (absence is NOT a safety clearance). | |
| limit | No | Max matches returned (default 100, max 1000). | |
| offset | No | Zero-based page offset (default 0). | |
| product | No | Case-insensitive substring filter on the product (e.g. 'Log4j', 'Exchange Server'). | |
| dueBefore | No | Keep only entries with dueDate < this ISO date (YYYY-MM-DD) — the CISA-mandated remediation deadline. | |
| addedSince | No | Keep only entries with dateAdded >= this ISO date (YYYY-MM-DD). | |
| vendorProject | No | Case-insensitive substring filter on the vendor/project (e.g. 'Microsoft', 'Apache'). | |
| ransomwareOnly | No | When true, keep only entries with knownRansomwareCampaignUse === 'Known'. |