Track CISA KEV additions and EPSS scores with curl and jq

#security #cybersecurity #bash #devops

Drafted with AI assistance. Every command below was run against the live CISA KEV feed and FIRST's EPSS API on 2 November 2026 (jq 1.7) before publishing.

You don't need a platform to keep an eye on what attackers are exploiting. CISA's Known Exploited Vulnerabilities (KEV) catalog is one public JSON file, and FIRST's EPSS scores come from a free API with no key. With curl and jq (1.6 or later) you can list a month's new exploited CVEs, see how long US agencies were given to fix them, and add EPSS scores in a few commands.

1. Download the KEV catalog

curl -s -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
jq -r '.catalogVersion, .count' kev.json

On 2 November 2026 this printed 2026.10.30 and 1766. Each entry has cveID, vendorProject, product, dateAdded, dueDate and knownRansomwareCampaignUse, which is all the commands below need.

2. List one month's additions

Dates are plain YYYY-MM-DD strings, so a text comparison picks a month. Swap the two dates for the month you want.

# How many
jq '[.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01")] | length' kev.json

# Date added, CVE, vendor, product, due date (tab-separated)
jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | [.dateAdded, .cveID, .vendorProject, .product, .dueDate] | @tsv' kev.json

For October 2026 the count is 36. The TSV output pastes straight into a spreadsheet.

3. See how long agencies were given to fix them

The gap between dateAdded and dueDate is the BOD 22-01 deadline for US federal agencies, and a useful benchmark for everyone else.

jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | (.dueDate | strptime("%Y-%m-%d") | mktime) - (.dateAdded | strptime("%Y-%m-%d") | mktime) | . / 86400' kev.json | sort -n | uniq -c

# Entries known to be used in ransomware, whole catalog
jq '[.vulnerabilities[] | select(.knownRansomwareCampaignUse == "Known")] | length' kev.json

For October 2026: 29 entries with a 3-day window and 7 with 14 days. The ransomware count was 361 across the catalog. CISA updates that field after entries are added, so re-check it rather than trusting an old copy.

4. Add EPSS scores

FIRST's API takes a comma-separated list of CVEs and returns up to 100 results by default, enough for any month of KEV additions.

ids=$(jq -r '[.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .dateAdded < "2026-11-01") | .cveID] | join(",")' kev.json)
curl -s -o epss.json "https://api.first.org/data/v1/epss?cve=$ids&limit=100"

# Highest first: CVE, EPSS, percentile
jq -r '.data | sort_by(-(.epss | tonumber)) | .[] | [.cve, .epss, .percentile] | @tsv' epss.json

# How many score under 10%
jq '[.data[] | select((.epss | tonumber) < 0.1)] | length' epss.json

Scores change daily. On 2 November 2026, 35 of October's 36 additions had a score, and 16 of those were under 10%.

That last number is the interesting one. A CVE on KEV is already being exploited, whatever its EPSS score. EPSS estimates the chance of exploitation in the next 30 days across the whole internet, so a low score on a KEV entry usually means a narrow target, like one vendor's appliance. Fix KEV entries first, then use EPSS to order everything else.

5. Check a single CVE

jq -r '.vulnerabilities[] | select(.cveID == "CVE-2024-3400") | [.dateAdded, .dueDate, .knownRansomwareCampaignUse] | @tsv' kev.json
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq -r '.data[0].epss'

Putting it to use

Run steps 1 and 2 weekly (or from cron) and compare the new CVEs with your asset list or last scan.
Treat dueDate as your own target for anything internet-facing.
Keep the TSV output. A dated list of what was exploited and when is good evidence for audits and client reviews.

If jq complains that strptime is not defined, your version is older than 1.5. Install a current one from your package manager.

The original version of this guide, with these commands, lives on varaxontech.com. We publish the monthly numbers too: here's the CISA KEV report for October 2026. If you'd rather not use a terminal, the free CVE checker shows KEV, EPSS and CVSS for any CVE.

DEV Community