How do I connect CISA KEV to Lodol?

Authenticate CISA KEV once from your workspace and every action and trigger it supports becomes available to drop into a workflow. There is no glue code to write or maintain.

All integrations

CISA KEV

Compliance & Security

Work with the CISA Known Exploited Vulnerabilities (KEV) catalog: the US government's authoritative list of the vulnerabilities attackers are actually exploiting. Check a scanner's findings or your software inventory against it, browse and search it by vendor, product, weakness type or date, see what CISA added this week, track remediation deadlines, pull out the ones used in ransomware campaigns, and export any of it as CSV. No account or API key required.

Get Started Browse all integrations

14 actions

Actions

Steps your workflow can run in CISA KEV.

Get catalog detailsRead which version of the CISA Known Exploited Vulnerabilities catalog is current, when CISA published it, and how much it holds: the number of vulnerabilities, vendors, products and weakness types, how many have known ransomware use, and the dates of the first and latest entries. Run it to check for a new release before doing anything else. No API key required.

Summarize the catalogBreak the whole catalog down in one step: the vendors and products with the most known-exploited vulnerabilities, the weakness types that show up most often, how many entries were added each year, how many have confirmed ransomware use, and how many are past their remediation deadline. Use it for a periodic threat-landscape report. No API key required.

List vulnerabilitiesBrowse the catalog through every filter it can be narrowed by: vendor, product, weakness type, confirmed ransomware use, when CISA added the entry, when remediation is due, and free text. Order the results and page through them. This is the general-purpose browse action; the others answer one specific question each. No API key required.

Search vulnerabilitiesSearch the catalog for a word, phrase, CVE ID or product name and get the best matches first. A hit on the CVE ID outranks one on the vulnerability name, which outranks the vendor or product, which outranks the description and the advisory notes, and each result says which fields it matched on. Use it when you have a term rather than a filter. No API key required.

Get a vulnerabilityRead one catalog entry in full by its CVE ID: what the flaw is, which product it affects, what CISA requires be done about it, by when, whether ransomware crews are known to use it, and the advisory links. The step fails if the CVE is not in the catalog, so use 'Check CVEs against the catalog' when you are testing membership rather than reading a known entry. No API key required.

Check CVEs against the catalogTake a list of CVE IDs, such as the findings of a scanner, and get back which of them CISA has confirmed are being exploited. Those are the ones to fix first. The answer separates the listed CVEs (in full) from the ones that are not listed, counts how many have known ransomware use, and sets a flag a workflow can branch on, so nothing fails just because a CVE is absent. No API key required.

Check products against the catalogTake a list of software you run and get back the known exploited vulnerabilities for each one. Each name is matched against the vendor and product read together, so an inventory line written the way people write them ('Ivanti Connect Secure') finds the entry however CISA split it. Every name gets its own row of matches, plus how many involve ransomware and how many are overdue. No API key required.

List recently added vulnerabilitiesList what CISA has added to the catalog lately. Give a date to start from, or a number of days to look back. Run it on a schedule to be told each week which vulnerabilities have just been confirmed as exploited in the wild. No API key required.

List vulnerabilities due soonList the entries whose remediation deadline falls in the next few days, soonest first. CISA sets a due date on every entry: the date US federal agencies must have remediated it by. Optionally include the ones already past their deadline, and narrow to a single vendor. No API key required.

List ransomware vulnerabilitiesList only the entries CISA has confirmed are used in ransomware campaigns. These are the subset of an already-urgent catalog that a ransomware crew is known to be exploiting, so they are the ones to patch before the rest. Narrow by vendor and by when CISA added the entry. No API key required.

List vendorsList every vendor named in the catalog with how many known exploited vulnerabilities each one has, how many of those involve ransomware, and when their most recent entry was added. Use it to see who dominates the catalog, or to find the exact spelling of a vendor to filter by. No API key required.

List productsList the products named in the catalog with how many known exploited vulnerabilities each one has, how many involve ransomware, and when their most recent entry was added. Narrow it to one vendor to see only their affected products. No API key required.

List weakness types (CWE)List the MITRE weakness types the catalog's entries are classified under, with how many entries carry each one. It is the answer to 'which classes of bug are actually being exploited?', and the place to find a CWE code to filter the browse action by. No API key required.

Export vulnerabilities as CSVExport matching entries as CSV, ready to attach to a ticket or drop into a spreadsheet. The rows are read from the official CSV file CISA publishes alongside the JSON, so every cell is the catalog's own text under the catalog's own column names. With no filters and the row limit raised it is the whole published file. No API key required.