Yes. CISA publishes the Known Exploited Vulnerabilities catalog as a JSON file and a CSV file. Fetch the JSON on a short interval, compare it with your last copy, and when a new CVE appears, check your stored inventories for it. A match deserves immediate attention.
What the catalog offers
According to the CISA KEV catalog page, the data is available as JSON, CSV and a JSON schema file, and there is an email subscription for catalog updates. Each entry carries a date added and a due date, and the entries on the page we reviewed mostly show due dates three days after the date added, with some longer windows. The page does not state a fixed update schedule, so poll rather than assume a time of day.
Why it works as a trigger
Most advisories do not mean someone is attacking you today. A KEV listing is different, because the catalog is for vulnerabilities with evidence of exploitation. That makes it a small, high signal list. Triggering on it keeps alert volume low.
Steps
- Fetch the JSON on a schedule. Every 30 to 60 minutes is reasonable. Be a polite client and avoid hammering the endpoint.
- Keep the previous copy. Store the list of CVE IDs you have already seen.
- Diff. Any ID in the new file and not in the old one is a trigger.
- Match against inventories. Search your stored SBOMs and image inventories for the affected product and version. KEV entries name a vendor and product, so matching is not always exact. Expect some manual review for non package software.
- Notify with context. Include the CVE, the due date, which projects matched, and the vendor's recommended action.
- Track to closure. Record when you patched or mitigated, since the evidence is useful later.
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
| jq -r '.vulnerabilities[].cveID' | sort > kev-now.txt
comm -13 kev-prev.txt kev-now.txt
Limits to plan for
KEV is a list of exploited issues, not all exploitable ones. A CVE missing from it is not proof of safety. It also lists many products that are not open source packages, such as appliances and operating systems, so a dependency scanner will match only part of it.
Pair it with exploitability context. An issue on KEV that sits in code your application never calls is still worth fixing, but the urgency differs from one in a reachable code path.
Try it yourself
In the demo, step through an exploitability check and note how a flagged issue gets sorted by whether it can actually be reached.
Click through it at your own pace, or open it full screen.
Quick check
Does KEV replace a daily scan?
No. It covers a small set of exploited issues. A daily sweep still catches the much larger set of other advisories.
How often does CISA update the catalog?
The page does not state a schedule. Poll regularly and diff the file.
Sources
Last reviewed: 19 October 2026.
