Prioritization
How to track CISA KEV additions and EPSS scores with curl and jq
Copy-paste commands to download CISA's KEV catalog, list a month's new exploited CVEs, measure fix deadlines and pull EPSS scores, using only curl and jq.
By Brandon Sooknanan, Founder, Varaxon Technologies · · 4 min read
You don't need a platform to keep an eye on what attackers are exploiting. CISA's Known Exploited Vulnerabilities catalog is one public JSON file, and FIRST's EPSS scores come from a free API. This guide walks through the commands step by step. You need curl and jq (version 1.6 or later), which most Linux and macOS machines already have.
1. Download the KEV catalog
| What it does | Command |
|---|---|
| Save the catalog as kev.json | curl -s -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
| Show the catalog version and total entries | jq -r '.catalogVersion, .count' kev.json |
On 2 November 2026 this printed 2026.10.30 and 1766. Each entry has a cveID, vendorProject, product, dateAdded, dueDate and knownRansomwareCampaignUse field, which is all the commands below need.
2. List one month's additions
Dates in the feed are plain YYYY-MM-DD strings, so a text comparison is enough to pick a month. Change the two dates to the month you want.
| What it does | Command |
|---|---|
| Count the month's additions | jq '[.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01")] | length' kev.json |
| List them: date added, CVE, vendor, product, due date | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | [.dateAdded, .cveID, .vendorProject, .product, .dueDate] | @tsv' kev.json |
For October 2026 the count is 36. The list is tab-separated, so it pastes straight into a spreadsheet.
3. See how long agencies were given to fix them
The gap between dateAdded and dueDate is the deadline US federal agencies get under BOD 22-01. Many teams use it as their own benchmark. This command turns each gap into days and counts them:
| What it does | Command |
|---|---|
| Count additions by fix window | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | (.dueDate | strptime("%Y-%m-%d") | mktime) - (.dateAdded | strptime("%Y-%m-%d") | mktime) | . / 86400' kev.json | sort -n | uniq -c |
| Count entries known to be used in ransomware | jq '[.vulnerabilities[] | select(.knownRansomwareCampaignUse == "Known")] | length' kev.json |
For October 2026 the first command prints 29 entries with a 3-day window and 7 with 14 days. The second printed 361 across the whole catalog. CISA updates the ransomware field after entries are added, so re-check it rather than relying on an old copy.
4. Add EPSS scores
FIRST's API accepts a comma-separated list of CVEs and returns up to 100 results by default, which covers any single month of KEV additions. No account or key is needed.
| What it does | Command |
|---|---|
| Collect the month's CVE IDs | ids=$(jq -r '[.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | .cveID] | join(",")' kev.json) |
| Fetch their EPSS scores | curl -s -o epss.json "https://api.first.org/data/v1/epss?cve=$ids&limit=100" |
| List them, highest first: CVE, EPSS, percentile | jq -r '.data | sort_by(-(.epss | tonumber)) | .[] | [.cve, .epss, .percentile] | @tsv' epss.json |
| Count how many score under 10% | jq '[.data[] | select((.epss | tonumber) < 0.1)] | length' epss.json |
Scores change daily, so note the date. On 2 November 2026, 35 of October's 36 additions had a score, and 16 of those were under 10%.
5. Check a single CVE
| What it does | Command |
|---|---|
| KEV details for one CVE | jq -r '.vulnerabilities[] | select(.cveID == "CVE-2024-3400") | [.dateAdded, .dueDate, .knownRansomwareCampaignUse] | @tsv' kev.json |
| Its EPSS score | curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq -r '.data[0].epss' |
If you'd rather not use a terminal, the free CVE checker shows the same KEV fields, EPSS and CVSS for any CVE, and every KEV entry has its own page, such as CVE-2024-3400.
Putting it to use
- Run steps 1 and 2 weekly, or from a scheduled job, and compare the new CVEs with your asset list or last scan.
- Treat the
dueDateas your own target for anything internet-facing. - Keep the TSV output. A dated list of what was exploited and when is useful evidence for audits and client reviews.
We publish these numbers every month. October's are in the CISA KEV report for October 2026. Varaxon Scan Hub runs the same KEV and EPSS checks on every finding in a scan export and puts the exploited ones first.
Common questions
How often does CISA update the KEV JSON feed?
Whenever it adds entries, often several times a week. The catalogVersion and dateReleased fields tell you which version you downloaded.
Do I need an API key for EPSS?
No. FIRST's EPSS API is free and needs no account. Keep requests reasonable, and batch CVEs with commas rather than calling once per CVE.
Why does jq say strptime is not defined?
Your jq is older than 1.5. Install a current version (1.6 or later) from your package manager or the jq releases page.
Turn your next scan export into a client-ready report.
Run a free pre-flight check