Which CVEs to patch first, in one call
Send up to 20 CVE IDs and get a patch-priority verdict for each, with the evidence behind it: CISA KEV status and due date, ransomware use, FIRST EPSS, CVSS and CISA's SSVC exploitation call. For security teams, MSPs, scanners and AI agents. Free tier, no key; plans from $19/month.
Who it's for
Anyone with more CVEs than time: a scanner report, an SBOM or an advisory feed that needs sorting into "today" and "later".
Paste the CVEs from a scan; get them back sorted act_now → low, with the reason for each.
One verdict per CVE, the same rules for every client, and the evidence to show them.
Add KEV, EPSS, CVSS and SSVC to every finding with one API call instead of four feeds.
An MCP tool that answers "is this CVE being exploited, and how urgent is it?" in plain JSON.
Try it
Paste CVE IDs (up to 20, any separator, or a chunk of a scan report). Kevscope returns them most urgent first.
Raw JSON response
Real sample output
Captured from a live call to this API.
{
"results": [
{
"id": "CVE-2024-3400",
"status": "ok",
"priority": {
"level": "act_now",
"score": 100,
"reasons": [
"In CISA KEV since 2024-04-12 (federal due date 2024-04-19)",
"Known use in ransomware campaigns (CISA)",
"CISA SSVC: exploitation active",
"CISA SSVC: automatable",
"EPSS 100.0% chance of exploitation in 30 days (top 0.1%)",
"CVSS 10.0 CRITICAL (CNA)"
]
},
"title": "PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect",
"description": "A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the f…",
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"published": "2024-04-12",
"updated": "2025-10-21",
"assigner": "palo_alto",
"cwe": [
"CWE-77",
"CWE-20"
],
"cvss": {
"score": 10,
"severity": "CRITICAL",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1",
"source": "CNA"
},
"epss": {
"score": 0.99999,
"percentile": 1,
"date": "2026-09-26"
},
"ssvc": {
"exploitation": "active",
"automatable": "yes",
"technicalImpact": "total"
},
"kev": {
"listed": true,
"dateAdded": "2024-04-12",
"dueDate": "2024-04-19",
"ransomware": true,
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"name": "Palo Alto Networks PAN-OS Command Injection Vulnerability",
"requiredAction": "Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule."
},
"links": {
"cve": "https://www.cve.org/CVERecord?id=CVE-2024-3400",
"nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400",
"kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400"
}
},
{
"id": "CVE-2024-6387",
"status": "ok",
"priority": {
"level": "high",
"score": 68,
"reasons": [
"CISA SSVC: public proof of concept",
"EPSS 99.5% chance of exploitation in 30 days (top 0.1%)",
"CVSS 8.1 HIGH (CNA)"
]
},
"title": "Openssh: regresshion - race condition in ssh allows rce/dos",
"description": "A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.",
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"published": "2024-07-01",
"updated": "2026-09-01",
"assigner": "redhat",
"cwe": [
"CWE-364"
],
"cvss": {
"score": 8.1,
"severity": "HIGH",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1",
"source": "CNA"
},
"epss": {
"score": 0.99506,
"percentile": 0.99944,
"date": "2026-09-26"
},
"ssvc": {
"exploitation": "poc",
"automatable": "no",
"technicalImpact": "total"
},
"kev": {
"listed": false
},
"links": {
"cve": "https://www.cve.org/CVERecord?id=CVE-2024-6387",
"nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-6387"
}
},
{
"id": "CVE-2019-0001",
"status": "ok",
"priority": {
"level": "medium",
"score": 52,
"reasons": [
"EPSS 3.0% chance of exploitation in 30 days (top 13%)",
"CVSS 7.5 HIGH (CNA)"
]
},
"title": "Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).",
"description": "Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result…",
"vendor": "Juniper Networks",
"product": "Junos OS",
"published": "2019-01-15",
"updated": "2024-09-17",
"assigner": "juniper",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 7.5,
"severity": "HIGH",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0",
"source": "CNA"
},
"epss": {
"score": 0.03049,
"percentile": 0.87041,
"date": "2026-09-26"
},
"ssvc": null,
"kev": {
"listed": false
},
"links": {
"cve": "https://www.cve.org/CVERecord?id=CVE-2019-0001",
"nvd": "https://nvd.nist.gov/vuln/detail/CVE-2019-0001"
}
}
],
"count": 3,
"summary": {
"cves": 3,
"actNow": 1,
"high": 1,
"medium": 1,
"low": 0,
"notFound": 0
},
"sources": {
"kevCatalog": "2026.09.25",
"epssDate": "2026-09-26",
"cveRecords": "CVE Program (cveawg.mitre.org), CISA-ADP Vulnrichment"
},
"note": "Sorted most urgent first. Verdict rules are public: act_now = in CISA KEV or SSVC exploitation active; high = EPSS >= 10%, an automatable or critical public PoC, or top-5% EPSS with CVSS >= 7; medium = CVSS >= 7, top-20% EPSS or a public PoC; low = the rest.",
"checkedAt": "2026-09-27T07:57:04.019Z"
}Limits, plainly
Free and rate limited so it stays fast for everyone. Loop over longer lists 20 CVEs at a time: a key covers thousands of calls a month. For a Monday summary instead of an API, the Exploited Vulnerabilities Brief (weekly edition) is on the CyberMax hub.
- Up to 20 CVEs per call; 10 calls a minute per IP on the free tier.
- Free tier: 200 calls a day per IP, no key. Paid keys from $19/month (see Get an API key).
- Sources are asked live and cached up to 1 hour: CVE Program records (incl. CISA-ADP), FIRST EPSS (updated daily) and the CISA KEV catalog.
- The verdict is a transparent rule set on public data, not a guarantee; your own exposure and compensating controls still decide.
Rather read it than call it?
The Exploited Vulnerabilities Brief, weekly edition: every Monday, the new CISA KEV entries ranked with EPSS and CVSS, due dates and ransomware flags, as a PDF plus CSVs. $9/month on Polar, cancel any time.
Get an API key
CVE priority API: up to 20 CVEs per call, each with a verdict (act_now, high, medium, low) and the evidence behind it: CISA KEV status, due date and ransomware use, FIRST EPSS, CVSS (CNA or CISA-ADP) and CISA SSVC. Plus new KEV entries and a pre-KEV EPSS watchlist. Keys work on the REST API and the MCP server.
50,000 calls a month · 60 per minute
Get Team keyor $490/year, 2 months freePay with card, Apple Pay, Google Pay or Link through Stripe Checkout (sales tax/VAT handled by Stripe). Your key appears on the page you return to right after checkout: save it. Manage or cancel any time at kevscope-api.cybermax-tools.workers.dev/manage. Send it as x-api-key: YOUR_KEY (or Authorization: Bearer YOUR_KEY, which MCP clients support). Check usage at /key. Failed calls are not counted. Vulnerability platforms sell monthly seats: OpenCVE Starter €19 and Pro €49 a month, Vulners from $600 a month (checked 27 Sep 2026); CISA KEV, FIRST EPSS and NVD are free but raw. Kevscope matches the €19/€49 price points with the prioritised answer (act_now to low, with evidence) for up to 20 CVEs a call, 200 free calls a day, and $5 pay-as-you-go for 2,000 calls.
Using several CyberMax APIs? CyberMax API All-Access: one key for all 9 APIs (this one included, 10,000 calls a month here) for $119/month. See All-Access
curl -s "https://kevscope-api.cybermax-tools.workers.dev/api/priority?..." -H "x-api-key: YOUR_KEY"
# MCP (Claude Desktop, Cursor, VS Code)
{ "mcpServers": { "kevscope-api": { "type": "http", "url": "https://kevscope-api.cybermax-tools.workers.dev/mcp",
"headers": { "Authorization": "Bearer YOUR_KEY" } } } }
# Usage so far
curl -s https://kevscope-api.cybermax-tools.workers.dev/key -H "x-api-key: YOUR_KEY"Use the API
JSON over HTTPS, CORS enabled, no key. GET for quick calls, POST a JSON body for lists. Spec: openapi.json · llms.txt
curl -s "https://kevscope-api.cybermax-tools.workers.dev/api/priority?cve=CVE-2024-3400%2C+CVE-2024-6387%2C+CVE-2019-0001"
# lists: POST a JSON body
curl -s -X POST https://kevscope-api.cybermax-tools.workers.dev/api/priority \
-H "content-type: application/json" \
-d '{"cves":["CVE-2024-3400","CVE-2024-6387"]}'import requests
r = requests.post("https://kevscope-api.cybermax-tools.workers.dev/api/priority",
json={"cves":["CVE-2024-3400","CVE-2024-6387"]}, timeout=30)
r.raise_for_status()
for row in r.json()["results"]:
print(row)Endpoints: /api/priority patch-priority verdict for up to 20 cves, with evidence · /api/kev/recent cves added to cisa kev in the last n days, with epss · /api/watchlist early warning: highest-epss cves that are not in cisa kev yet
Add it to your AI agent (MCP)
A remote MCP server at https://kevscope-api.cybermax-tools.workers.dev/mcp (streamable HTTP, no auth). Read-only tools with JSON schemas, so agents know exactly what to send.
// Claude Desktop, Cursor, VS Code, any MCP client (remote, no key)
{
"mcpServers": {
"kevscope-api": { "type": "http", "url": "https://kevscope-api.cybermax-tools.workers.dev/mcp" }
}
}
# Claude Code
claude mcp add --transport http kevscope-api https://kevscope-api.cybermax-tools.workers.dev/mcp
# Tools: cve_priority, kev_recent, epss_watchlist
# e.g. cve_priority({"cves":["CVE-2024-3400"]})cve_priority
Patch-priority verdict for 1-20 CVE IDs with evidence: CISA KEV status (date added, due date, ransomware use), FIRST EPSS probability, CVSS (CNA or CISA-ADP), CISA SSVC exploitation/automatable/impact, vendor, product and links. Sorted most urgent first.kev_recent
CVEs added to the CISA Known Exploited Vulnerabilities catalog in the last N days, newest first, with due date, ransomware use and EPSS. Optional vendor/product text filter.epss_watchlist
The highest-EPSS CVEs (most likely to be exploited in 30 days) that are not in CISA KEV yet. Defaults to this year's CVE IDs.
FAQ
Why not the free NVD, EPSS and KEV feeds?
They are the sources, and they are free, but they are three feeds with three formats. NVD's API allows 5 requests per 30 seconds without a key, and since April 2026 NVD no longer enriches every CVE, so many records have no NVD score. Kevscope reads the CVE Program record (with the CNA's and CISA's scores), EPSS and KEV in one call and sorts the answer for you.
Why not OpenCVE or Vulners?
They are full vulnerability platforms: OpenCVE's paid plans are €19 and €49 a month, Vulners' Basic is $600 a month (public pricing pages, 27 Sep 2026). If what you need is a priority verdict with evidence for the CVEs you already have, an Analyst key ($19/month) covers 10,000 calls of up to 20 CVEs each.
How is the verdict decided?
act_now: listed in CISA KEV, or CISA's SSVC says exploitation is active. high: EPSS of 10% or more, a public proof of concept that is automatable or CVSS 9+, or top-5% EPSS with CVSS 7+. medium: CVSS 7+, top-20% EPSS or a public proof of concept. low: the rest. The reasons list shows exactly which facts applied.
What is SSVC and where does it come from?
Stakeholder-Specific Vulnerability Categorization: CISA's decision points (exploitation none/poc/active, automatable yes/no, technical impact partial/total), published in the CISA-ADP container of the official CVE record (CISA Vulnrichment). Not every CVE has them yet.
Is there a key or a cost?
The free tier needs no key: 200 calls a day per IP. Paid keys: Analyst $19/month for 10,000 calls, Team $49/month for 50,000 calls, SOC $99/month for 150,000 calls; or pay as you go: $5 for 2,000 calls that never expire. Yearly billing gives 2 months free. Every call ranks up to 20 CVEs. Send the key as the x-api-key header. No surprise overage charges; cancel any time.
Can I use it from Claude, Cursor or another AI agent?
Yes. Add the MCP server URL below (with your key as a Bearer token for paid limits). Tools: cve_priority, kev_recent and epss_watchlist.
Where does the data come from?
The CVE Program's public CVE Services API (records incl. CISA-ADP Vulnrichment), FIRST's EPSS API (EPSS scores by FIRST.org) and the CISA Known Exploited Vulnerabilities catalog, asked live and cached up to 1 hour. Not affiliated with or endorsed by CISA, FIRST or the CVE Program. CVE is a registered trademark of The MITRE Corporation.