ToolMint CISA KEV

CISA Known Exploited Vulnerabilities catalog for agents — lookup by CVE, search by vendor/product/date, batch-check up to 50 CVEs. Returns due dates and ransomware-use flags. Public domain US government data.

Routes and prices

Route	Price	What it does	Parameters (* required)
`GET /lookup`	$0.01	Look up one CVE	`cve`*
`GET /cve/{cve}`	$0.01	Look up CVE by path	`cve`*
`GET /search`	$0.01	Search by vendor/product/dateAdded/ransomwareKnown	`vendor`, `product`, `dateAdded`, `ransomwareKnown`, `limit`
`GET /check`	$0.01	Batch check ≤50 CVEs (cves= comma-separated)	`cves`*
`POST /check`	$0.01	Batch check ≤50 CVEs (JSON body)	—

Free routes: /, /health, /openapi.json, /.well-known/x402.

Try it

Not deployed yet. The URL below is the planned address. After launch, an unpaid call returns 402 with the terms in the price table.

curl -i "https://toolmint-cisa-kev-json.toolmint.workers.dev/lookup?cve=CVE-2021-44228"

When to use it

Triage: check one CVE or a list of up to 50 against KEV.
Find KEV entries for a vendor or product, or added on a date, or flagged as used in ransomware campaigns.

Not for: a general severity score (no CVSS here), vulnerabilities that are exploited but not yet in KEV, or proof that you are patched. "Not in KEV" means CISA has not listed it; it does not mean it is safe. A "not in KEV" answer is a normal 200 and is charged, because that is the answer you asked for.

Example

curl -i "https://toolmint-cisa-kev-json.toolmint.workers.dev/lookup?cve=CVE-2021-44228"

That hostname is the planned Worker name. The tool is not deployed yet.

Trimmed response (values illustrative):

{
  "tool": "cisa-kev-json",
  "version": "0.1.0",
  "mode": "lookup",
  "cveId": "CVE-2021-44228",
  "inKev": true,
  "vulnerability": {
    "cveId": "CVE-2021-44228",
    "vendor": "...", "product": "...", "name": "...",
    "dateAdded": "2021-12-10", "dueDate": "2021-12-24",
    "overdue": true, "daysUntilDue": -1771,
    "ransomwareUse": "Known", "ransomwareKnown": true,
    "shortDescription": "...", "requiredAction": "...",
    "cwes": ["CWE-..."], "forensicTriage": null
  },
  "catalogVersion": "...",
  "catalogDateReleased": "...",
  "summary": { "text": "1 KEV entry; 1 ransomware-known; 1 overdue", "ransomwareKnownCount": 1, "overdueCount": 1, "vendorCount": 1 },
  "provenance": {
    "source": "CISA Known Exploited Vulnerabilities (KEV) catalog",
    "sourceUrl": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
    "fetched_at": "2026-10-31T11:30:00.000Z",
    "catalogVersion": "...", "catalogDateReleased": "...",
    "license": "US Government work - public domain (CISA KEV catalog)"
  },
  "cached": false
}

overdue and daysUntilDue are computed from CISA's due date against today (UTC); the due date applies to US federal agencies. A batch response has requested, inKevCount, notInKevCount, ransomwareKnownCount, overdueCount and a results array.

Data source and licence

CISA Known Exploited Vulnerabilities catalog. US Government work, public domain. No API key.

Freshness and caching

The catalog is downloaded and kept in memory for up to 1 hour. provenance.fetched_at is when the catalog was actually downloaded (not the time of your call), and catalogDateReleased is CISA's release date. A CVE added to KEV in the last hour may not appear yet.

Limits

KEV only. No CVSS, no EPSS, no exploit details.
vendor and product are substring matches on CISA's names, so spelling must match CISA's.
Search returns at most 100 entries (truncated and matchCount tell you if there were more).

Errors are not charged

Payment settles only on a successful answer. These responses are never settled:

Status	Meaning (from the OpenAPI)	Charged?
`400`	Invalid input (not charged)	No
`502`	Upstream error (not charged)	No