CVE, KEV and EPSS check

Reads three public sources and joins them on the CVE ID. None needs an account.

• NVD API 2.0 (NIST): CVSS score and details. The NVD terms ask a service to show this notice: "This product uses data from the NVD API but is not endorsed or certified by the NVD." Do not call the output an NVD publication when you change it.
• CISA KEV catalog: one JSON file. CISA publishes it under the Creative Commons CC0 1.0 licence ("You may use this data in any legal manner"). Using it does not allow use of the CISA logo or the DHS seal and does not imply endorsement.
• FIRST EPSS API: scores are free to use. FIRST asks for attribution. Cite it as: "See EPSS at https://www.first.org/epss".

Author: Don Mangu (GitHub). This skill needs no token. For one table of many CVEs, filters by KEV date, EPSS, CVSS or vendor, and scheduled runs, the author also runs a paid hosted version on the Apify Store: CVE KEV EPSS API (disclosure: the author owns it). You never need it for the steps below. This is an unofficial tool and is not affiliated with, endorsed by or operated by NIST, CISA or FIRST.

Example prompts

• "Is CVE-2021-44228 known to be exploited, and how likely is exploitation?"
• "Which of these 20 CVEs should I fix first?"
• "What did CISA add to the KEV catalog this week?"

Out of scope: "Is my server vulnerable?" The skill looks up CVEs. It does not scan anything.

Step 1: know the endpoints

• NVD, one CVE: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-3094. The cveId parameter takes one ID.
• NVD, many CVEs: add hasKev, kevStartDate and kevEndDate (CVEs added to KEV in a date range), or pubStartDate and pubEndDate or keywordSearch. A date range can be 120 days at most. Date format: 2026-09-11T00:00:00.000. Use resultsPerPage up to 2000.
• KEV: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. Fields per entry: cveID, vendorProject, product, dateAdded, dueDate, requiredAction, knownRansomwareCampaignUse, cwes. CISA also keeps a copy at https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json.
• EPSS: https://api.first.org/data/v1/epss?cve=CVE-2024-3094,CVE-2021-44228. At most 100 IDs per call. A call with more than 100 IDs answers with an empty list and no error.

Step 2: run it

import json, time, urllib.request

UA = "MyResearchTool/1.0 (+https://example.org/contact)"   # name your tool and give your own contact
CVES = ["CVE-2024-3094", "CVE-2021-44228", "CVE-2023-22894"]  # change this list (up to 100 for EPSS in one call)

def get(url):
    req = urllib.request.Request(url, headers={"User-Agent": UA, "Accept": "application/json"})
    with urllib.request.urlopen(req, timeout=60) as r:
        return json.load(r)

# 1. KEV catalog: one file, about 1.8 MB, CC0 1.0 licence.
kev_feed = get("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json")
kev = {e["cveID"]: e for e in kev_feed["vulnerabilities"]}
print("KEV catalog", kev_feed["catalogVersion"], "with", len(kev), "entries")

# 2. EPSS: up to 100 CVE IDs per call. More than 100 returns an empty list, not an error.
epss_json = get("https://api.first.org/data/v1/epss?cve=" + ",".join(CVES))
epss = {r["cve"]: r for r in epss_json["data"]}

# 3. NVD: the cveId parameter takes one ID, so one request per CVE.
#    Without an API key the NVD allows 5 requests per rolling 30 seconds and recommends a 6 second sleep.
def cvss(metrics):
    for key in ("cvssMetricV31", "cvssMetricV40", "cvssMetricV30", "cvssMetricV2"):
        items = [m for m in metrics.get(key, []) if "cvssData" in m]
        if items:
            m = next((x for x in items if x["type"] == "Primary"), items[0])
            return m["cvssData"]["version"], m["cvssData"]["baseScore"]
    return None, None

print("cve | cvss | in KEV | KEV added | ransomware | EPSS | percentile")
for i, cve_id in enumerate(CVES):
    if i:
        time.sleep(6)
    data = get("https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" + cve_id)
    if not data["vulnerabilities"]:
        print(cve_id, "| not found in the NVD")
        continue
    version, score = cvss(data["vulnerabilities"][0]["cve"]["metrics"])
    k = kev.get(cve_id)
    e = epss.get(cve_id, {})
    print(cve_id, f"| {score} (v{version})", "|", "yes" if k else "no", "|", k["dateAdded"] if k else "-", "|",
          k["knownRansomwareCampaignUse"] if k else "-", "|", e.get("epss"), "|", e.get("percentile"))

Output of this code on 11.10.2026 against the live sources:

KEV catalog 2026.10.08 with 1739 entries
cve | cvss | in KEV | KEV added | ransomware | EPSS | percentile
CVE-2024-3094 | 10.0 (v3.1) | no | - | - | 0.859740000 | 0.997270000
CVE-2021-44228 | 10.0 (v3.1) | yes | 2021-12-10 | Known | 0.999990000 | 1.000000000
CVE-2023-22894 | 4.9 (v3.1) | yes | 2026-10-08 | Unknown | 0.036090000 | 0.891980000

Rules

• Public endpoints only. No login, no key, no attempts around blocks.
• The NVD public limit without a key is 5 requests in a rolling 30 second window, and the NVD guide recommends a 6 second sleep. Keep the sleep. On HTTP 403 or 429 wait at least 30 seconds, then try again once or twice. Then stop. Do not change IP address.
• Send a User-Agent that names your tool and gives your own contact.
• A new CVE often has no CVSS score for days. Say "no score yet" instead of guessing.
• The NVD can hold several CVSS scores for one CVE (3.1, 4.0, 3.0, 2.0, and one from the NVD and one from the vendor). State which one you print. The code above takes 3.1 first, then 4.0, 3.0 and 2.0, and the NVD analysis before the vendor score.
• EPSS is a probability for the next 30 days and changes daily. Print the date of the score (date field of the EPSS answer).
• The KEV dueDate is the date for US federal agencies. It is not a deadline for other organisations.
• Say what you could not check: the code reads the live sources once. It does not show how the exploitation was seen, and a CVE outside KEV is not proof that no attacker uses it.

Limits

The KEV catalog held 1,739 entries on 11.10.2026. The NVD held 404,209 CVE records. One NVD request per CVE makes a list of 100 CVEs take about 10 minutes at 6 seconds each. For a date or KEV window, one NVD request returns up to 2000 CVEs, which is faster. For a table of many CVEs, a script or the hosted version is quicker than asking one question at a time.