# CISA KEV Catalogue Changes Feed

> CISA KEV Catalogue Changes Feed is a paid API for AI agents from oracles-production.up.railway.app, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Returns vulnerabilities newly added to CISA's Known Exploited Vulnerabilities (KEV) catalogue since a given timestamp, including remediation actions and federal due dates.

## Facts

- Endpoint: GET https://oracles-production.up.railway.app/v1/kev/changes
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-kev-catalogue-changes-feed-c9815752
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CAufBXTJSGIGdd260Nm9i

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-kev-catalogue-changes-feed-c9815752
```

Example prompt: Show me all newly added CISA Known Exploited Vulnerabilities since 2025-01-01T00:00:00Z, only those with a significance of at least 8, and include the remediation required action and federal due dates.

## When to prefer this

Use this endpoint when you need real-time or near-real-time monitoring of the CISA KEV catalogue for newly confirmed actively exploited vulnerabilities, especially for federal compliance workflows, security operations center alerting, or vulnerability prioritization pipelines. Prefer this over generic CVE feeds when you specifically need CISA's authoritative 'confirmed actively exploited' signal with federal remediation due dates.

## Known failure modes

- Missing or malformed 'since' parameter returns empty or error response
- since timestamp in wrong format (not ISO-8601) causes validation error
- limit exceeds 500 returns 400 bad request
- No new KEV entries since timestamp returns count:0 with empty changes array
- Payment failure (x402) if USDC not provided or insufficient funds
- Service unavailability returns 5xx if upstream CISA data is inaccessible

## How this service works

Vulnerabilities added to CISA's KEV catalogue since a timestamp — each is confirmed actively exploited (significance 9-10), with the required remediation action and federal due date.

## Output

A list of KEV catalogue additions detected after the specified timestamp, each with a CVE entity ID, vulnerability title, summary, significance score (9-10 for actively exploited), required remediation action, federal due date, source URL for verification, and the detection timestamp. Also includes total count and source attribution.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "limit": {
       "type": "integer",
       "maximum": 500,
       "minimum": 1
      },
      "since": {
       "type": "string",
       "format": "date-time",
       "description": "Only changes detected after this ISO-8601 instant"
      },
      "min_significance": {
       "type": "integer",
       "maximum": 10,
       "minimum": 1,
       "description": "Keep only changes scored at least this"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "count": {
       "type": "integer"
      },
      "source": {
       "type": "string"
      },
      "changes": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "type": {
          "type": "string"
         },
         "title": {
          "type": "string"
         },
         "detail": {
          "type": "object"
         },
         "summary": {
          "type": "string"
         },
         "entityId": {
          "type": "string"
         },
         "sourceUrl": {
          "type": [
           "string",
           "null"
          ],
          "description": "Primary-source link for verification"
         },
         "detectedAt": {
          "type": "string",
          "format": "date-time"
         },
         "significance": {
          "type": "integer",
          "maximum": 10,
          "minimum": 1
         },
         "effectiveDate": {
          "type": [
           "string",
           "null"
          ]
         }
        }
       }
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-kev-catalogue-changes-feed-c9815752/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from oracles-production.up.railway.app](https://www.zero.xyz/host/oracles-production.up.railway.app/llms.txt)