Known Exploited Software Vulnerabilities
The official US government list of software flaws that attackers are actively exploiting right now.
A continuously updated catalogue of software and hardware vulnerabilities with confirmed real-world exploitation, each with its identifier, affected vendor and product, the required remediation action and a federal remediation deadline. It is the de-facto global prioritisation list for patching. Security vendors, managed service providers, compliance platforms and autonomous security agents all consume it.
Source: CISA Known Exploited Vulnerabilities Catalog · Public Domain (U.S. Government Work) · Source: Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog.
Endpoints
Every request is authenticated with your X-API-Key and counted against your plan.
- GET /v1/data/known-exploited-software-vulnerabilities
- GET /v1/data/known-exploited-software-vulnerabilities/search?q=...
- GET /v1/data/known-exploited-software-vulnerabilities/{key}
Base path /v1/data/known-exploited-software-vulnerabilities · full reference in the interactive docs. Also exposed as an MCP tool for AI agents.
Fields
| Field | Type | Description |
|---|---|---|
| cve_id | str | Common Vulnerabilities and Exposures identifier for the flaw. |
| vendor_project | str | Vendor or open-source project that publishes the affected software. |
| product | str | Affected product name. |
| vulnerability_name | str | Short human-readable name of the vulnerability. |
| date_added | date | Date the vulnerability was added to the catalogue. |
| short_description | str | Plain-language summary of the weakness and how it is abused. |
| required_action | str | Remediation action required of US federal agencies. |
| due_date | date | Deadline by which the required action must be completed. |
| known_ransomware_campaign_use | str | Whether the flaw is known to be used in ransomware campaigns ('Known' or 'Unknown'). |
| notes | str | Reference links and additional vendor advisory notes. |
What you get
FAQ
- How often is the data refreshed?
- We re-ingest the upstream catalogue daily, so new entries appear within 24 hours of publication.
- Does this include severity scores?
- No. The catalogue is an exploitation signal, not a scoring system. Pair it with your existing severity data for prioritisation.
- Can I use this commercially?
- Yes. The source is a US Government work in the public domain; we ask that you keep the attribution string in your product.
Pricing
Simple, transparent pricing
Start free, upgrade when you need more. All plans include full API access.
Free
Get started and explore the API
- 100 API requests per day
- All endpoints included
- Community support
Pro
For production apps and AI agents
- 10,000 API requests per day
- All endpoints included
- Priority support
- Usage dashboard
Enterprise
Unlimited access for high-volume use
- Unlimited API requests
- All endpoints included
- Priority support
- Usage dashboard
- Dedicated support channel
Getting Started
Start building in minutes
Register for a free API key, make your first request, and upgrade when you're ready.
Register
Create an account to get your API key. It's free — no credit card required.
curl -X POST https://api.aristocles.com.au/v1/auth/register \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com", "name": "Your Name"}'Make a request
Use your API key in the X-API-Key header to authenticate requests.
curl https://api.aristocles.com.au/v1/data/asx \
-H "X-API-Key: your_api_key_here"Upgrade
Need more requests? Upgrade to Pro or Enterprise — you'll be redirected to Stripe Checkout.
curl -X POST "https://api.aristocles.com.au/v1/billing/checkout?tier=pro" \
-H "X-API-Key: your_api_key_here"Check usage
Monitor your daily request count and remaining quota at any time.
curl https://api.aristocles.com.au/v1/usage \
-H "X-API-Key: your_api_key_here"