Known Exploited Vulnerabilities (CISA KEV) in NVD
nvd/known-exploited-cves
CVEs that CISA lists in its Known Exploited Vulnerabilities (KEV) catalog, as recorded in the National Vulnerability Database: full CVE records, each carrying CISA's date added, remediation due date, required action and vulnerability name. Optionally narrowed by words in the CVE description. Oldest CVE id first; `totalResults` gives the number of KEV entries that match (about 1,750 unfiltered, 2026-10-19). Paged, up to 20 per call. National Vulnerability Database data, passed through unmodified and served by Eden Engine; not an official NIST or NVD product.
Price
$0.0026 per call
You pay the price shown. If a call turns out to cost more than its quote, you pay the actual price, capped at twice the quote. No monthly minimum. Top-ups start at $5.
Data source
National Vulnerability Database (NIST)
This product uses data from the NVD API but is not endorsed or certified by the NVD. Data from the National Vulnerability Database (NVD), National Institute of Standards and Technology, U.S. Department of Commerce; NIST information is public and may be distributed or copied, per nist.gov/oism/copyrights. Served by Eden Engine; not an official NIST product.
Use it
Five steps: search, inspect, learn, run, settle. No per-tool setup; your agent reaches this tool through the meta-tools it already has.
Connect once and your AI can find and run this tool, and any other it needs.
// 1. search: find the tool
omnial_search({ query: "what you need" })
// 2. inspect: price and input schema
omnial_inspect({ tool: "nvd/known-exploited-cves" })
// 3. learn: read the usage guide at runtime
omnial_learn({ tool: "nvd/known-exploited-cves" })
// 4. run: price the exact call first, then run it
omnial_execute({ tool: "nvd/known-exploited-cves", input: { /* see input_schema */ }, dry_run: true })
omnial_execute({ tool: "nvd/known-exploited-cves", input: { /* ... */ } })
// 5. settle: the call is charged when it finishes, nothing to doNot connected yet? Point your MCP client at https://mcp.eden-engine.com/mcp, then copy a config for your client.
Pricing
Every charge this tool can incur.
| Charge | Price |
|---|---|
Per call | $0.0026 |
- Updated
- Oct 20, 2026
Input and output schemas
Input schema
{
"type": "object",
"required": [
"results_per_page"
],
"properties": {
"start_index": {
"type": "integer",
"maximum": 1000000,
"minimum": 0,
"description": "Zero-based offset of the first record to return, for paging: ask again with start_index set to the previous start_index plus results_per_page. The response's `totalResults` says when to stop. Omit for the first page."
},
"keyword_search": {
"type": "string",
"maxLength": 200,
"minLength": 2,
"description": "Optional words to find in the CVE description, for example `log4j` or `exchange server`, to list the KEV entries about one product. Leave out to page through the whole catalog."
},
"results_per_page": {
"type": "integer",
"maximum": 20,
"minimum": 1,
"description": "How many full CVE records to return, 1 to 20. Required. Each record is about 5 to 60 KB."
}
},
"additionalProperties": false
}Output schema
{
"type": "object",
"required": [
"totalResults",
"vulnerabilities"
],
"properties": {
"format": {
"type": "string",
"description": "The NVD response format name."
},
"version": {
"type": "string",
"description": "The NVD API version."
},
"timestamp": {
"type": "string",
"description": "When NVD produced this response (UTC, no offset suffix)."
},
"startIndex": {
"type": "integer",
"description": "Zero-based offset of the first record on this page."
},
"totalResults": {
"type": "integer",
"description": "How many records match in all, across every page. 0 means nothing matched; that is an answer, not an error."
},
"resultsPerPage": {
"type": "integer",
"description": "How many records this page carries."
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve"
],
"properties": {
"cve": {
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The CVE identifier."
},
"cveTags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags such as disputed or unsupported-when-assigned."
},
"metrics": {
"type": "object",
"description": "Severity scores by CVSS version: `cvssMetricV40`, `cvssMetricV31`, `cvssMetricV30` and `cvssMetricV2`, each a list with one entry per scoring source (`type` Primary is NVD's, Secondary is the CNA's). `cvssData.baseScore` is the number and `cvssData.baseSeverity` the band. Absent for a CVE not yet scored, and a given version is absent where it was never scored.",
"additionalProperties": true
},
"affected": {
"type": "array",
"items": {
"type": "object",
"description": "One CNA-stated affected-product record.",
"additionalProperties": true
},
"description": "Vendor and product names as stated by the CNA."
},
"published": {
"type": "string",
"description": "When the CVE was published (UTC, no offset suffix)."
},
"references": {
"type": "array",
"items": {
"type": "object",
"description": "One reference.",
"additionalProperties": true
},
"description": "Advisories, patches and write-ups: `url`, `source` and `tags`."
},
"vulnStatus": {
"type": "string",
"description": "NVD processing status, for example Analyzed, Modified, Awaiting Analysis or Rejected."
},
"weaknesses": {
"type": "array",
"items": {
"type": "object",
"description": "One source's CWE list.",
"additionalProperties": true
},
"description": "CWE weakness classes, per source; the CWE id is `description[].value`."
},
"descriptions": {
"type": "array",
"items": {
"type": "object",
"description": "One description: `lang` and `value`.",
"additionalProperties": true
},
"description": "The CVE text, one entry per language; lang \"en\" is the English one."
},
"lastModified": {
"type": "string",
"description": "When the NVD record last changed (UTC, no offset suffix)."
},
"cisaActionDue": {
"type": "string",
"description": "CISA's remediation due date (YYYY-MM-DD). KEV entries only."
},
"cisaExploitAdd": {
"type": "string",
"description": "Date CISA added this CVE to its Known Exploited Vulnerabilities catalog (YYYY-MM-DD). Present only for a CVE in that catalog."
},
"configurations": {
"type": "array",
"items": {
"type": "object",
"description": "One configuration.",
"additionalProperties": true
},
"description": "The affected-product match expressions (CPE names and version ranges). Absent until NVD has analysed the CVE."
},
"sourceIdentifier": {
"type": "string",
"description": "Who assigned the CVE, usually an email address or a CNA identifier."
},
"cisaRequiredAction": {
"type": "string",
"description": "CISA's required action. KEV entries only."
},
"cisaVulnerabilityName": {
"type": "string",
"description": "CISA's name for the vulnerability. KEV entries only."
}
},
"additionalProperties": true
}
},
"additionalProperties": true
},
"description": "This page's KEV CVEs, oldest CVE id first; each is `{ cve: {...} }` with the cisa* fields present."
}
},
"description": "The NVD CVE envelope restricted to KEV entries: `totalResults` is the number of KEV entries that match, `vulnerabilities` holds this page.",
"additionalProperties": true
}