For engineers and AI agents

Free CISA KEV API

KEVWire serves CISA's Known Exploited Vulnerabilities catalog (1,760 entries) as a free API with no key, joined with NVD severity (CVSS), FIRST's exploitation probability (EPSS), due dates and source links, plus critical CVEs, breaches and AI security incidents. Every filter works the same in JSON, CSV, RSS and the MCP server.

Endpoints

What	URL
Search and filter (paged JSON)	`https://kevwire.com/api/intel?kev=true&limit=25`
One record by CVE (any published CVE)	`https://kevwire.com/api/record/CVE-2022-26134`
Full export	`https://kevwire.com/api/export.json?kev=true` or `.csv`
RSS for any filter	`https://kevwire.com/feed.xml?kev=true&stacks=Microsoft`
OpenAPI description	`https://kevwire.com/openapi.json`
MCP server for AI agents	`https://kevwire.com/mcp` (setup guide)

Examples

Known exploited, newest first

curl -s 'https://kevwire.com/api/intel?kev=true&sort=newest&limit=5'

Exploited issues in your stack

curl -s 'https://kevwire.com/api/intel?kev=true&stacks=Microsoft,Fortinet&limit=25'

Python

import requests
records = requests.get("https://kevwire.com/api/intel", params={"kev": "true", "limit": 25}).json()["items"]
for record in records:
    print(record["cveId"], record["kev"]["dueAt"], record["metrics"]["cvss"])

Filters

q (words or a CVE ID), kev=true, kind (vulnerability, breach, ai-incident, ai-research, advisory), stacks (comma-separated technology labels), sort (urgent, newest, cvss, epss), limit (up to 100) and offset. Missing scores are null, never zero.

Fair use

No key and no hard quota. Keep to a few requests per second and cache responses; sources update every 5 minutes at most. See the terms for data licenses: CISA and NVD data are public domain, and each source's terms apply to its content.