PRP: Enricher for CISA Known Exploited Vulnerabilities (KEV) Catalog

[Para-dox00]

• Software distribution method or binary type: CISA KEV JSON feed — cross-references CVE IDs found in scan findings against the CISA Known Exploited Vulnerabilities catalog (known_exploited_vulnerabilities.json)
• Popularity of distribution method: The CISA KEV catalog is the authoritative, US-government-maintained list of CVEs actively exploited in the wild. As of mid-2025 it contains 1,200+ entries. Under CISA Binding Operational Directive 22-01, all US federal civilian agencies are required to remediate KEV-listed vulnerabilities on defined timelines. The catalog is freely available with no authentication and is updated multiple times per week. It is the single most actionable prioritization signal for vulnerability triage in any organization.
• Any critical, emergent vulnerability associated with software from the distribution method: By definition, every entry is actively exploited. Representative entries include CVE-2021-44228 (Log4Shell), CVE-2022-22965 (Spring4Shell), CVE-2023-34362 (MOVEit SQL injection), CVE-2024-6387 (OpenSSH regreSSHion), CVE-2024-3400 (PAN-OS command injection). Current scalibr enrichers surface vulnerabilities but provide no signal distinguishing theoretical risk from confirmed active exploitation — KEV integration fills this gap directly.
• Resources:
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (free JSON API, no auth required)
  • https://www.cisa.gov/binding-operational-directive-22-01
  • https://github.com/cisagov/known-exploited-vulnerabilities (community tooling)
  • KEV JSON schema: each entry has cveID, vendorProject, product, vulnerabilityName, dateAdded, dueDate, requiredAction fields

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once every other week,
so it can take up to two weeks before you hear back from us,
sometimes longer depending on available capacity.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
For more details, please see the rules page.
~The OSV-SCALIBR PRP team

[another-rex]

Thank you for the proposal. This is a good idea, but it is out of scope for the Patch Reward Program. We will leave this issue open for potential future implementation outside of the PRP.