Microproduct data guidebeginner

CISA Known Exploited Vulnerabilities Catalog

Confirmed in-the-wild software vulnerabilities for building patch-priority alerts, exposure monitors, and remediation queues.

Start the guide Open official source

At a glance

Difficulty
Beginner — comfortable for a first prototype
Size
Tiny · ≤0.01 GB
Formats
JSON, CSV
Access
Download
API key
Not required
Provider
Cybersecurity and Infrastructure Security Agency
Updates
Continuous
Data terms
U.S. Government public data / federal copyright guidance

From source to product signal

Test a product idea in four steps

CISA's catalog lists vulnerabilities with evidence of active exploitation and the action required of covered federal agencies. Start by monitoring entries added during the last 30 days. Inclusion confirms known exploitation, but it is not a severity ranking or a complete inventory of every vulnerability that matters to an organization.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Read CISA's catalog guidance and download the official JSON feed.
  2. 2.Parse the vulnerabilities array and convert dateAdded to a calendar date.
  3. 3.Compare catalog entries with an authorized software inventory before assigning remediation work.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

from datetime import date, timedelta
import pandas as pd
import requests

url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
response = requests.get(url, timeout=30)
response.raise_for_status()
vulnerabilities = pd.DataFrame(response.json()["vulnerabilities"])
vulnerabilities["dateAdded"] = pd.to_datetime(vulnerabilities["dateAdded"])
cutoff = pd.Timestamp(date.today() - timedelta(days=30))
recent = vulnerabilities[vulnerabilities["dateAdded"] >= cutoff]
recent = recent.assign(retrieved_at_utc=pd.Timestamp.now(tz="UTC"))
print(recent[["cveID", "vendorProject", "product", "dateAdded"]].head(20))
4

Test a useful signal

Monitor newly exploited vulnerabilities

Identify which vendors and products appear in CISA additions from the last 30 days.

  1. 01Filter the catalog to entries added in the last 30 days and check for missing identifiers.
  2. 02Group the recent entries by vendor and product and flag matches in an authorized asset inventory.
  3. 03Explain why catalog inclusion should influence remediation priority without replacing asset exposure and business-impact analysis.

Dataset details

Cybersecurity and Infrastructure Security Agency is a government source. Last verified 2026-08-11. Temporal coverage: 2021-present.

Domains

CybersecuritySoftware Security

Data types

Event DataTabular

Tasks

Vulnerability MonitoringAlertingOperational Planning

Geography

Global

Formats

JSONCSV

Provider

Cybersecurity and Infrastructure Security Agency

Data terms

U.S. Government public data / federal copyright guidance