CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail "summary".
full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both.
Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
| Argument | Type | Description |
|---|---|---|
| cveIds* | array | CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail "summary". |
| detail | string | full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cveIds"
],
"properties": {
"cveIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
},
"maxItems": 200,
"minItems": 1,
"description": "CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail \"summary\"."
},
"detail": {
"enum": [
"full",
"summary"
],
"type": "string",
"default": "full",
"description": "full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both."
}
},
"additionalProperties": false
}Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, or remediations. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.
| Argument | Type | Description |
|---|---|---|
| cves | array | Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include "vulnerabilities". |
| sections | array | Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget. |
| advisoryId* | string | Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized. |
| productIds | array | Narrow products to these IDs from vulnerability status, score, or remediation references. Alone selects products; combined with cves selects both sections. Explicit sections must include products. |
List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.
| Argument | Type | Description |
|---|---|---|
| feed | string | Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks). |
| limit | integer | Maximum items to return. The 30 ceiling is the upstream window, not a server choice. |
| since | string | Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"feed": {
"enum": [
"advisories",
"alerts",
"ics"
],
"type": "string",
"default": "advisories",
"description": "Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks)."
},
"limit": {
"type": "integer",
"default": 30,
"maximum": 30,
"minimum": 1,
"description": "Maximum items to return. The 30 ceiling is the upstream window, not a server choice."
},
"since": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it."
}
},
"additionalProperties": false
}Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.
| Argument | Type | Description |
|---|---|---|
| cveIds* | array | CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check. |
| assetExposure | string | Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. "unknown" returns both arms so the spread is visible without guessing. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cveIds"
],
"properties": {
"cveIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
},
"maxItems": 50,
"minItems": 1,
"description": "CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check."
},
"assetExposure": {
"enum": [
"publicly_exposed",
"not_publicly_exposed",
"unknown"
],
"type": "string",
"default": "unknown",
"description": "Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. \"unknown\" returns both arms so the spread is visible without guessing."
}
},
"additionalProperties": false
}Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.
| Argument | Type | Description |
|---|---|---|
| topic* | string | Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"topic"
],
"properties": {
"topic": {
"enum": [
"directives",
"kev_fields",
"ssvc_values",
"sectors",
"advisory_id_formats",
"severity_bands",
"sources"
],
"type": "string",
"description": "Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds)."
}
},
"additionalProperties": false
}Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.
| Argument | Type | Description |
|---|---|---|
| q | string | Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number. |
| cve | string | Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized. |
| cwe | string | Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children. |
| inKev | boolean | true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result. |
Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.
| Argument | Type | Description |
|---|---|---|
| cwe | string | Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match. |
| limit | integer | Maximum entries per page. |
| order | string | Sort direction. |
| cursor | string | Opaque pagination cursor from a previous call. Omit for the first page. |
| sortBy | string | Field to sort by. |
| overdue | boolean | True selects entries whose due date is strictly before the echoed asOf date. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"advisoryId"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier the advisory covers, e.g. CVE-2023-3935. Case and surrounding whitespace are normalized."
},
"description": "Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include \"vulnerabilities\"."
},
"sections": {
"type": "array",
"items": {
"enum": [
"advisory",
"summary",
"products",
"vulnerabilities",
"revisionHistory",
"references",
"acknowledgments"
],
"type": "string",
"description": "One section name, as the outline reports it."
},
"description": "Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget."
},
"advisoryId": {
"type": "string",
"pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
"description": "Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"description": "Exact case-sensitive CSAF product ID; surrounding whitespace is trimmed."
},
"description": "Narrow products to these IDs from vulnerability status, score, or remediation references. Alone selects products; combined with cves selects both sections. Explicit sections must include products."
}
},
"additionalProperties": false
}| limit | integer | Maximum advisories per page. |
| order | string | Sort direction. Under relevance, desc means most relevant first. |
| cursor | string | Opaque pagination cursor from a previous call. Omit for the first page. |
| sector | string | Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors. |
| series | string | Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus. |
| sortBy | string | Field to sort by. relevance requires q and ranks by FTS5 bm25. |
| vendor | string | Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact. |
| cvssMax | number | Maximum value of the advisory's maximum CVSS base score, inclusive. |
| cvssMin | number | Minimum value of the advisory's maximum CVSS base score, inclusive. |
| product | string | Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters. |
| severity | string | Severity band of the advisory's maximum CVSS score. |
| publisher | string | coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus. |
| revisedTo | string | Latest current release date, inclusive, YYYY-MM-DD. |
| publishedTo | string | Latest initial release date, inclusive, YYYY-MM-DD. |
| revisedFrom | string | Earliest current release date, inclusive, YYYY-MM-DD. |
| publishedFrom | string | Earliest initial release date, inclusive, YYYY-MM-DD. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"q": {
"type": "string",
"minLength": 2,
"description": "Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number."
},
"cve": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized."
},
"cwe": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children."
},
"inKev": {
"type": "boolean",
"description": "true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result."
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 50,
"minimum": 1,
"description": "Maximum advisories per page."
},
"order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc",
"description": "Sort direction. Under relevance, desc means most relevant first."
},
"cursor": {
"type": "string",
"description": "Opaque pagination cursor from a previous call. Omit for the first page."
},
"sector": {
"enum": [
"Chemical",
"Commercial Facilities",
"Communications",
"Critical Manufacturing",
"Dams",
"Defense Industrial Base",
"Emergency Services",
"Energy",
"Financial Services",
"Food and Agriculture",
"Government Facilities",
"Healthcare and Public Health",
"Information Technology",
"Nuclear Reactors, Materials, and Waste",
"Transportation Systems",
"Water and Wastewater Systems",
"Multiple"
],
"type": "string",
"description": "Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors."
},
"series": {
"enum": [
"ICSA",
"ICSMA"
],
"type": "string",
"description": "Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus."
},
"sortBy": {
"enum": [
"relevance",
"published",
"revised",
"maxCvss"
],
"type": "string",
"default": "revised",
"description": "Field to sort by. relevance requires q and ranks by FTS5 bm25."
},
"vendor": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact."
},
"cvssMax": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Maximum value of the advisory's maximum CVSS base score, inclusive."
},
"cvssMin": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Minimum value of the advisory's maximum CVSS base score, inclusive."
},
"product": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters."
},
"severity": {
"enum": [
"NONE",
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"type": "string",
"description": "Severity band of the advisory's maximum CVSS score."
},
"publisher": {
"enum": [
"coordinator",
"other"
],
"type": "string",
"description": "coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus."
},
"revisedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest current release date, inclusive, YYYY-MM-DD."
},
"publishedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest initial release date, inclusive, YYYY-MM-DD."
},
"revisedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest current release date, inclusive, YYYY-MM-DD."
},
"publishedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest initial release date, inclusive, YYYY-MM-DD."
}
},
"additionalProperties": false
}| product |
| string |
| Case-insensitive substring of CISA's own product label. |
| dueAfter | string | Earliest due date, inclusive, YYYY-MM-DD. |
| directive | string | Which directive the entry cites. "none" selects the entries citing neither. |
| dueBefore | string | Latest due date, inclusive, YYYY-MM-DD. |
| ransomware | boolean | True selects entries CISA has linked to ransomware campaigns. |
| cveIdPrefix | string | Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized. |
| dateAddedTo | string | Latest date added, inclusive, YYYY-MM-DD. |
| nameContains | string | Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback. |
| dateAddedFrom | string | Earliest date added, inclusive, YYYY-MM-DD. |
| vendorProject | string | Case-insensitive substring of CISA's own vendor label. |
| forensicTriage | boolean | True selects the BOD 26-04 three-day forensic-triage tier. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cwe": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match."
},
"limit": {
"type": "integer",
"default": 25,
"maximum": 100,
"minimum": 1,
"description": "Maximum entries per page."
},
"order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc",
"description": "Sort direction."
},
"cursor": {
"type": "string",
"description": "Opaque pagination cursor from a previous call. Omit for the first page."
},
"sortBy": {
"enum": [
"dueDate",
"dateAdded"
],
"type": "string",
"default": "dateAdded",
"description": "Field to sort by."
},
"overdue": {
"type": "boolean",
"description": "True selects entries whose due date is strictly before the echoed asOf date."
},
"product": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of CISA's own product label."
},
"dueAfter": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest due date, inclusive, YYYY-MM-DD."
},
"directive": {
"enum": [
"BOD 26-04",
"BOD 22-01",
"none"
],
"type": "string",
"description": "Which directive the entry cites. \"none\" selects the entries citing neither."
},
"dueBefore": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest due date, inclusive, YYYY-MM-DD."
},
"ransomware": {
"type": "boolean",
"description": "True selects entries CISA has linked to ransomware campaigns."
},
"cveIdPrefix": {
"type": "string",
"pattern": "^CVE-[0-9]{4}$",
"description": "Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized."
},
"dateAddedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest date added, inclusive, YYYY-MM-DD."
},
"nameContains": {
"type": "string",
"minLength": 2,
"description": "Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback."
},
"dateAddedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest date added, inclusive, YYYY-MM-DD."
},
"vendorProject": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of CISA's own vendor label."
},
"forensicTriage": {
"type": "boolean",
"description": "True selects the BOD 26-04 three-day forensic-triage tier."
}
},
"additionalProperties": false
}