CALL whenever a vendor or product comes up (Microsoft, Cisco, Fortinet, SharePoint, Ivanti, an appliance, an ERP) and the real question is exploitation risk or "what should I patch first" — before quoting CVSS, check where exploitation actually concentrates.
Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities (KEV) catalog — where real, confirmed in-the-wild exploitation actually concentrates, not just where CVSS is high.
With no args: returns the top vendors ranked by KEV count (e.g. Microsoft, Cisco, Adobe, Ivanti, Citrix). With {"vendor":"Adobe"}: returns that vendor's or product's specific known-exploited CVEs (e.g. ColdFusion), most-recent first, each with a ransomware-use flag.
Use this to answer "which vendors/products carry the exploitation risk we should patch first," to assess third-party / supply-chain exposure, or to check whether a freshly-dropped PoC lands on a chronically-exploited product (a proven-soft target) versus a one-off. KEV means CISA has confirmed active exploitation.
Public read (no auth). Source is CISA's KEV catalog, refreshed continuously.
Example: {"vendor":"Citrix"} → NetScaler's known-exploited CVEs; {} → the full top-vendor risk ranking.