# CISA Known Exploited Vulnerabilities (KEV) Catalog

> CISA Known Exploited Vulnerabilities (KEV) Catalog is a paid API for AI agents from proxy.suverse.io, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-14).

Returns the full CISA KEV catalog of CVEs confirmed exploited in the wild, including CVE ID, vendor, product, name, date added, and remediation due date.

## Facts

- Endpoint: POST https://proxy.suverse.io/v1/data/suverse-cisa-kev
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-kev-catalog-a4767e82
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3X7bfkcJI_yMcxH6sbufW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-known-exploited-vulnerabilities-kev-catalog-a4767e82 -d '<json body>'
```

Example prompt: Pull the full CISA Known Exploited Vulnerabilities catalog so I can see every CVE that's been confirmed exploited in the wild along with the vendor, product, and remediation due date.

## When to prefer this

Choose this endpoint when you need authoritative, government-confirmed exploitation data rather than theoretical CVSS scores or researcher-reported vulnerabilities. It is ideal for compliance workflows requiring CISA KEV adherence, patch prioritization based on proven real-world exploitation, or enriching internal vulnerability scanners with must-patch deadlines. Prefer this over raw NVD or CVE feeds when you specifically need the 'confirmed exploited in the wild' signal and associated remediation due dates.

## Known failure modes

- Payment failure (x402) if USDC balance is insufficient
- Upstream CISA data source unavailability causing empty or stale response
- Malformed POST body causing a 400 error
- Network timeout if the full catalog response is large

## How this service works

The full CISA Known Exploited Vulnerabilities catalog, the US government list of CVEs confirmed exploited in the wild: CVE id, vendor, product, name, date added, due date. For AI agents prioritizing patching by real exploitation and enforcing deadlines.

## Output

A catalog of CVE records that CISA has confirmed are actively exploited in the wild. Each entry includes the CVE identifier, the affected vendor, product name, vulnerability name, the date CISA added it to the KEV list, and the remediation due date by which federal agencies are required to patch.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "properties": {}
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST",
      "PUT",
      "PATCH"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-kev-catalog-a4767e82/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from proxy.suverse.io](https://www.zero.xyz/host/proxy.suverse.io/llms.txt)