SourceFinch Verified · Cybersecurity & vulnerabilities

CISA Known Exploited Vulnerabilities catalog

Name: CISA Known Exploited Vulnerabilities catalog
Creator: Cybersecurity and Infrastructure Security Agency
License: https://spdx.org/licenses/CC0-1.0.html

Every CVE in CISA's Known Exploited Vulnerabilities catalog as structured records: vendor, product, vulnerability name, date added, short description, required action, due date, known ransomware use and CWE identifiers. Monitors additions and later edits to any entry.

Healthy · 100% of observed runs successful
Cybersecurity & vulnerabilities
Cybersecurity and Infrastructure Security Agency
United States (federal)
Publisher's public bulk file or feed
11 typed fields

Monitor this source API, CLI, SDK and MCP

At a glance

Publisher: Cybersecurity and Infrastructure Security Agency · homepage
Category: Cybersecurity & vulnerabilities
Jurisdiction: United States (federal)
Publisher updates: Whenever CISA adds or amends an entry, typically several times a week
SourceFinch checks: Daily by default
Records per run: 1,739 in the latest run
Record key: cve_id
Acquired from: Publisher's public bulk file or feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Recipe: v1.0.0, approved October 12, 2026
Verified since: October 12, 2026
Last green run: October 12, 2026

What the data contains

CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that CISA has confirmed are being exploited in the wild and that U.S. federal civilian agencies must remediate under Binding Operational Directive 22-01. This source reads the whole catalog JSON file that CISA publishes (about 1.8 MB, roughly 1,700 entries at review) on each run and turns every entry into one record keyed by its CVE identifier, so a monitor reports newly added vulnerabilities and any later change to an entry's required action, due date, description or ransomware flag. Entries are never removed from the catalog by CISA, so a record leaving the set would itself be notable. The data describes software products and weaknesses; it contains no personal data. CISA distributes the catalog under the Creative Commons CC0 1.0 Universal dedication. Third-party links in the notes field are governed by those sites' own terms and are not fetched.

Fields and types

Every record has these fields. The key field cve_id identifies a record across runs, so changes are reported field by field.

Field	Type	Description
`cve_id`key	string	CVE identifier of the vulnerability (for example CVE-2021-44228), unique per catalog entry. The record key.
`vendor`	string	Vendor or project that owns the affected product, as named by CISA.
`product`	string	Affected product; "Multiple Products" when the weakness spans a vendor's range.
`vulnerability_name`	string	CISA's name for the vulnerability, usually vendor, product and weakness type.
`date_added`	date	Date CISA added the entry to the catalog (YYYY-MM-DD).
`short_description`	string, nullable	One-paragraph description of the vulnerability and its impact.
`required_action`	string, nullable	Remediation CISA requires of federal civilian agencies, typically applying vendor mitigations or discontinuing the product.
`due_date`	date, nullable	Date by which federal civilian agencies must complete the required action (YYYY-MM-DD).
`known_ransomware_use`	string, nullable	Whether CISA knows the vulnerability to be used in ransomware campaigns: Known or Unknown.
`notes`	string, nullable	Reference links and remarks published with the entry; the linked pages are not fetched.
`cwes`	string, nullable	Common Weakness Enumeration identifiers for the entry, as the JSON array string published by CISA (for example ["CWE-787"]).

Sample output

The first 5 of 1,739 records from SourceFinch's own run on October 12, 2026, exactly as delivered.

Field	Record 1	Record 2	Record 3	Record 4	Record 5
`cve_id`	CVE-2015-5477	CVE-2016-3081	CVE-2023-22894	CVE-2021-3199	CVE-2015-3306
`vendor`	ISC	Apache	Strapi	ONLYOFFICE	ProFTPD
`product`	BIND	Struts	Strapi	Docs	ProFTPD
`vulnerability_name`	ISC BIND Data Processing Errors Vulnerability	Apache Struts Command Injection Vulnerability	Strapi Cleartext Storage of Sensitive Information Vulnerability	ONLYOFFICE Docs Server Path Traversal Vulnerability	ProFTPD Improper Access Control Vulnerability
`date_added`	2026-10-08	2026-10-08	2026-10-08	2026-10-08	2026-10-08
`short_description`	ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.	Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.	Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.	ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.	ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
`required_action`	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
`due_date`	2026-10-11	2026-10-11	2026-10-11	2026-10-11	2026-10-11
`known_ransomware_use`	Unknown	Unknown	Unknown	Unknown	Unknown
`notes`	This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5477	This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081	This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-22894	This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199	This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306
`cwes`	["CWE-19"]	["CWE-77"]	["CWE-312"]	["CWE-22"]	["CWE-284"]

Sample as JSON

[
  {
    "cwes": "[\"CWE-19\"]",
    "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5477",
    "cve_id": "CVE-2015-5477",
    "vendor": "ISC",
    "product": "BIND",
    "due_date": "2026-10-11",
    "date_added": "2026-10-08",
    "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "short_description": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
    "vulnerability_name": " ISC BIND Data Processing Errors Vulnerability",
    "known_ransomware_use": "Unknown"
  },
  {
    "cwes": "[\"CWE-77\"]",
    "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081",
    "cve_id": "CVE-2016-3081",
    "vendor": "Apache",
    "product": "Struts",
    "due_date": "2026-10-11",
    "date_added": "2026-10-08",
    "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "short_description": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
    "vulnerability_name": "Apache Struts Command Injection Vulnerability",
    "known_ransomware_use": "Unknown"
  },
  {
    "cwes": "[\"CWE-312\"]",
    "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-22894",
    "cve_id": "CVE-2023-22894",
    "vendor": "Strapi",
    "product": "Strapi",
    "due_date": "2026-10-11",
    "date_added": "2026-10-08",
    "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "short_description": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ",
    "vulnerability_name": "Strapi Cleartext Storage of Sensitive Information Vulnerability",
    "known_ransomware_use": "Unknown"
  },
  {
    "cwes": "[\"CWE-22\"]",
    "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199",
    "cve_id": "CVE-2021-3199",
    "vendor": "ONLYOFFICE",
    "product": "Docs",
    "due_date": "2026-10-11",
    "date_added": "2026-10-08",
    "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "short_description": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
    "vulnerability_name": "ONLYOFFICE Docs Server Path Traversal Vulnerability",
    "known_ransomware_use": "Unknown"
  },
  {
    "cwes": "[\"CWE-284\"]",
    "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306",
    "cve_id": "CVE-2015-3306",
    "vendor": "ProFTPD",
    "product": "ProFTPD",
    "due_date": "2026-10-11",
    "date_added": "2026-10-08",
    "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "short_description": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
    "vulnerability_name": "ProFTPD Improper Access Control Vulnerability",
    "known_ransomware_use": "Unknown"
  }
]

Evidence behind every value

Each run keeps the publisher's exact response, hashed with SHA-256. This sample came from a response with hash fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee.
Every value records where it came from in that response: a JSON Pointer into the retained capture.
Each run gets a signed manifest (Ed25519) timestamped by an RFC 3161 authority: this run's manifest hash is b5a3184aef5283219f94498682832c9372ba86801b1af7db551edc62ab1ca4d9, timestamped October 12, 2026.
The compliance state at capture is recorded with the evidence: robots.txt hash and verdict, AI-preference signals, crawler identity and the usage rights below.
Download any run as an evidence bundle (WACZ) and check it offline, without trusting SourceFinch: sourcefinch verify-bundle run.wacz.

Terms posture and usage rights

Terms: Automated access permitted · publisher's terms
robots.txt: Allows this path · SHA-256 6a476baa135f1070…
AI-preference signals: None observed at review
Public record: Yes. Binding Operational Directive 22-01 directs CISA to maintain and publish the catalog; U.S. government work (17 U.S.C. 105) dedicated under CC0 1.0.
Reviewed: October 12, 2026; next review April 12, 2027

Licence basis: Open data licence (CC0-1.0)
Commercial use: Allowed
Redistribution: Allowed
Attribution: Not required

CISA distributes the KEV catalog under the Creative Commons CC0 1.0 Universal dedication: the data may be used in any legal manner. The licence notes that information at third-party links inside entries is bound by those sites' own policies, and that use of the data does not permit use of the CISA logo or DHS seal or imply endorsement. cisa.gov's robots.txt (Drupal defaults) allows /sites/default/files/, where the JSON feed lives; no key or registration is needed.

Usage rights travel with every record SourceFinch delivers (API, exports, webhooks and evidence bundles). They are our documented understanding of the publisher's stated terms, not legal advice.

Reliability

Runs, last 30 days: 1
Green: 100%
Failed: 0
Median run time: 1.4 s
Latest run: success, October 12, 2026

Measured on completed runs of this recipe version across SourceFinch, anonymized, within a rolling 30-day window. First successful observation: October 12, 2026. A new recipe has only the history collected since that date; this is not a 30-day uptime guarantee.

Use it

Every surface creates the same monitor from this Verified recipe. Monitors keep record history, report field-level changes and deliver by webhook, export or email. You confirm you have the right to collect the source (rights: true).

Console

Open this recipe in the console: it preserves the reviewed URL, fields and record key. Review the latest captured sample, confirm source rights, and choose a schedule before creating your monitor.

Portable recipe

Copy into the console's Import or share a recipe panel to customize fields, types and schedules. This configuration contains no captured records or workspace IDs.

{
  "schema": "sourcefinch/source@1",
  "name": "CISA Known Exploited Vulnerabilities catalog",
  "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "recipe": {
    "mode": "http",
    "format": "json",
    "items": "vulnerabilities[*]",
    "fields": {
      "cwes": "cwes",
      "notes": "notes",
      "cve_id": "cveID",
      "vendor": "vendorProject",
      "product": "product",
      "due_date": "dueDate",
      "date_added": "dateAdded",
      "required_action": "requiredAction",
      "short_description": "shortDescription",
      "vulnerability_name": "vulnerabilityName",
      "known_ransomware_use": "knownRansomwareCampaignUse"
    },
    "required": [
      "cve_id",
      "vendor",
      "product",
      "vulnerability_name",
      "date_added"
    ],
    "types": {
      "cwes": "string",
      "date_added": "date",
      "due_date": "date"
    }
  },
  "schedule": "daily",
  "key_field": "cve_id"
}

source.json

The request body used by the API, CLI and SDK examples.

{
  "name": "CISA Known Exploited Vulnerabilities catalog",
  "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "recipe": {
    "mode": "http",
    "format": "json",
    "items": "vulnerabilities[*]",
    "fields": {
      "cwes": "cwes",
      "notes": "notes",
      "cve_id": "cveID",
      "vendor": "vendorProject",
      "product": "product",
      "due_date": "dueDate",
      "date_added": "dateAdded",
      "required_action": "requiredAction",
      "short_description": "shortDescription",
      "vulnerability_name": "vulnerabilityName",
      "known_ransomware_use": "knownRansomwareCampaignUse"
    },
    "required": [
      "cve_id",
      "vendor",
      "product",
      "vulnerability_name",
      "date_added"
    ],
    "types": {
      "cwes": "string",
      "due_date": "date",
      "date_added": "date"
    }
  },
  "key_field": "cve_id",
  "schedule": "daily",
  "rights": true,
  "catalog": {
    "slug": "cisa-known-exploited-vulnerabilities",
    "version_id": "bbd80253-b0dd-46bd-a6f8-9f3d7b2a222c"
  }
}

REST API

Create an API key under Console → API keys. Reference: /docs/api.

# the Verified entry (fields, recipe, sample, terms) as JSON
curl https://sourcefinch.com/v1/catalog/cisa-known-exploited-vulnerabilities -H "Authorization: Bearer $SOURCEFINCH_API_KEY"

# create the monitor from source.json (below)
curl -X POST https://sourcefinch.com/v1/sources \
  -H "Authorization: Bearer $SOURCEFINCH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d @source.json

# then run it now (later runs follow the schedule)
curl -X POST https://sourcefinch.com/v1/sources/$SOURCE_ID/runs \
  -H "Authorization: Bearer $SOURCEFINCH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

CLI

The sourcefinch CLI is not on npm yet; see /docs/cli.

sourcefinch login
sourcefinch catalog get cisa-known-exploited-vulnerabilities --source-json > source.json
sourcefinch sources create --file source.json
sourcefinch runs create $SOURCE_ID --wait
sourcefinch records $SOURCE_ID

TypeScript SDK

The SDK is not on npm yet; see /docs/sdk.

import { SourceFinch } from "@sourcefinch/sdk";

const sf = new SourceFinch({ apiKey: process.env.SOURCEFINCH_API_KEY });
const entry = await sf.catalog.get("cisa-known-exploited-vulnerabilities");
const source = await sf.sources.create({
  catalog: { slug: entry.slug, version_id: entry.recipe.version_id },
  name: entry.name.slice(0, 100),
  url: entry.acquisition_path.endpoint,
  recipe: entry.recipe.definition,
  key_field: entry.recipe.key_field,
  schedule: entry.recipe.schedule,
  rights: true, // you confirm you have the right to collect this source
});
const run = await sf.runs.wait((await sf.runs.create(source.id)).id);
console.log(run.status);

MCP

Remote MCP server with OAuth; see /docs/mcp.

claude mcp add --transport http sourcefinch https://sourcefinch.com/mcp

# then ask your agent:
"Use SourceFinch to monitor CISA Known Exploited Vulnerabilities catalog: get_catalog_source cisa-known-exploited-vulnerabilities,
then create_source with its create_source_args (dry run first), then run_source."

Pricing

Each check is one run, whatever the number of records, and failed runs are free. On its default daily schedule this source uses about 30 runs a month, which fits the Free plan's 300 runs. It uses HTTP acquisition, so no browser runs are needed. See plans.

Guides using this source

All guides

SourceFinch is independent and is not affiliated with or endorsed by Cybersecurity and Infrastructure Security Agency. This page describes cisa known exploited vulnerabilities catalog as SourceFinch acquires it.