KEVin Vulnerability API

Security intelligence, delivered fast.

Query the CISA Known Exploited Vulnerabilities Catalog (KEV) and Common Vulnerabilities and Exposures (CVE) data with predictable endpoints designed for analysts and automation.

API Usage

KEV Endpoints

/kev Latest KEVs

/kev/exists?cve=CVE-2023-22527 KEV presence check

/kev?filter=ransomware Filter by ransomware

/kev?page=1&per_page=25 Paginated KEV list

/kev?page=2&per_page=25 Next page of KEVs

/kev?search=Microsoft&page=1&per_page=10 Keyword search

/kev/CVE-2023-1234 Fetch by CVE ID

/kev/recent?days=7 Recent additions

/kev?sort=date&order=desc&page=1&per_page=15 Sort by newest date added

/kev?sort=severity&order=desc&page=1&per_page=15 Sort by highest severity

/kev?actor=Lazarus%20Group Search by threat actor

Operations

Limits

2 requests per second per IP. One hour block on violations.

Search is limited to KEV data only (as of 29 August 2023).

Edge Cache

Edge cache set to 3 hours. Updates may be delayed if CVE data is stuck in cache.

Policies

Terms of Agreement

Support

Open issues on GitHub.

Support infrastructure on the donations page.