Everything this site knows is available as static files. The point of taking it from here rather than assembling it yourself: the CISA catalogue, NVD severity scores and FIRST exploitation probabilities are already joined into one document — three sources, three formats and three rate-limit regimes collapsed into a single fetch.
No API key, no registration, no rate limits — these are files on a CDN, not endpoints. Currently 1,703 records, rebuilt twice a day.
What is available
| URL | What it is |
|---|---|
| /kev/index.json | The whole catalogue, one record per vulnerability: CVE, vendor, product, name, dates, deadline, ransomware flag, CVSS, EPSS, derived status, canonical URL. ~500 KB. |
| /kev/{cve-id}.json | Full single record — everything the page shows, plus CVSS vector, CWE list, notes and parsed source links. E.g. cve-2021-44228.json. |
| /feed.xml | RSS, the 50 most recently added records. The practical "tell me when something new is being exploited" channel. |
| /sitemap-index.xml | Every page on the site, if you need to crawl rather than fetch. |
Catalogue index fields
| Field | Meaning |
|---|---|
| cveID | CVE identifier, uppercase |
| vendor, product | As published by CISA |
| vulnerabilityName | CISA's title for the flaw |
| dateAdded, dueDate | Added to KEV; federal remediation deadline (BOD 22-01) |
| knownRansomware | true when CISA marks known ransomware campaign use |
| cvss | Base score from NVD (v4/v3.1/v3.0/v2, best available), null while NVD has not analysed the CVE |
| epss | FIRST EPSS: probability of exploitation in the next 30 days, 0–1 |
| status | "active" or "past due", computed against the build date |
| url | Canonical advisory page on this site |
The envelope carries catalogVersion and
dateReleased from CISA, and generatedAt —
when this file was built. If generatedAt is older than a
day, something is wrong on our side.
Quick start
curl -s https://www.netvigilance.com/kev/index.json | jq
'.vulnerabilities[] | select(.knownRansomware) | .cveID'
curl -s https://www.netvigilance.com/kev/index.json | jq
'[.vulnerabilities[] | select(.epss > 0.5)] | length'
Terms, in one paragraph
Free for any use, commercial included. The underlying facts come from CISA, NVD and FIRST — public data; the joining and cleaning are ours. If it saves you work, a link back to netvigilance.com is appreciated — it is also how you let your users verify the data against its source. Field names won't change or disappear without a note in the RSS feed first.
Numbers derived from this data live at KEV in numbers. Questions about how the pipeline works are answered in the about page.