# CISA Known Exploited Vulnerabilities

Every CVE CISA has confirmed is being exploited in the wild, with the remediation deadlines federal agencies are held to — filterable by vendor, product, or CVE.

- Method: `GET`
- Path: `/v1/security/kev`

**Parameters**

| Name | Type | | Description |
|---|---|---|---|
| `q` | string | optional | Free-text match against the CVE id, name, and description. |
| `vendor` | string | optional | Exact vendor name, e.g. `Microsoft`, `MLflow`. |
| `product` | string | optional | Product name substring, e.g. `Exchange`. |
| `limit` | integer | optional | Entries per page, `1`-`500`. |
| `max_age` | integer (seconds) | optional | Ask for data no older than this. Clamped to the product's own floor, so it can narrow the window but never force a refresh on every call. |

**Example request**

```bash
curl https://api.diraz.ae/v1/security/kev \
  -H "Authorization: Bearer drz_live_…"
```

**Example response**

```json
{
  "data": {
    "catalog_version": "2026.08.19",
    "date_released": "2026-08-19T17:00:32.1366Z",
    "catalog_total": 1671,
    "total": 1671,
    "items": [
      {
        "cve": "CVE-2026-64849",
        "vendor": "MLflow",
        "product": "MLflow",
        "vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
        "date_added": "2026-08-19",
        "due_date": "2026-09-02",
        "ransomware_use": "Unknown",
        "short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
        "required_action": "Apply mitigations in accordance with vendor instructions or discontinue use of the product if mitigations are unavailable."
      }
    ]
  },
  "meta": {
    "request_id": "req_7Q2fK4mZ",
    "as_of": "2026-08-20T04:05:00.000Z",
    "age_seconds": 3600,
    "next_update_at": "2026-08-20T05:05:00.000Z"
  }
}
```