# CISA Known Exploited Vulnerabilities - Recent

> CISA Known Exploited Vulnerabilities - Recent is a paid API for AI agents from fittings.sh, paid per call via x402, $0.00498/call, status unknown (last checked 2026-09-15).

Returns CVEs recently added to CISA's Known Exploited Vulnerabilities catalog, sorted newest first, with optional ransomware-campaign filtering.

## Facts

- Endpoint: GET https://fittings.sh/v1/kev/recent
- Price: $0.00498/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-recent-890ce917
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lOGYtdzHP2awnQpG66GGV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-known-exploited-vulnerabilities-recent-890ce917
```

Example prompt: Pull the CISA Known Exploited Vulnerabilities added in the last 14 days — up to 50 entries, and only include ones tied to ransomware campaigns.

## When to prefer this

Use this endpoint when you need up-to-date, authoritative data on actively exploited vulnerabilities from the US government's CISA KEV catalog — particularly for patch prioritization, compliance workflows, or ransomware threat intelligence. Prefer it over generic CVE databases when you specifically need CISA-confirmed exploitation evidence, especially for federal or critical infrastructure contexts where KEV compliance is mandatory.

## Known failure modes

- Invalid 'days' value outside 1–90 range returns an error
- Invalid 'limit' value outside 1–100 range returns an error
- No new vulnerabilities in the lookback window returns an empty list
- Upstream CISA data source unavailable causes a service error
- Malformed query parameters return a 400-level error

## How this service works

Vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog within a recent lookback window, newest first.

## Output

A list of vulnerability entries from the CISA KEV catalog added within the specified lookback window, ordered newest first. Each entry includes CVE identifiers, vulnerability names, affected products, and indicators of ransomware campaign use. Controlled by optional parameters for lookback days (1–90, default 7), max entries (1–100, default 25), and a ransomware-only filter.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "days": {
       "type": "number",
       "description": "Lookback window in days, 1-90, default 7"
      },
      "limit": {
       "type": "number",
       "description": "Maximum entries, 1-100, default 25"
      },
      "ransomwareOnly": {
       "type": "boolean",
       "description": "Only entries with known ransomware campaign use"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-recent-890ce917/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fittings.sh](https://www.zero.xyz/host/fittings.sh/llms.txt)