Drafted with AI assistance. Every command below was run against the live CISA KEV feed and FIRST's EPSS API on 2 November 2026 (jq 1.7) before publishing.

You don't need a platform to keep an eye on what attackers are exploiting. CISA's Known Exploited Vulnerabilities (KEV) catalog is one public JSON file, and FIRST's EPSS scores come from a free API with no key. With curl and jq (1.6 or later) you can list a month's new exploited CVEs, see how long US agencies were given to fix them, and add EPSS scores in a few commands.

1. Download the KEV catalog

curl -s -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json jq -r '.catalogVersion, .count' kev.json

Enter fullscreen mode

Exit fullscreen mode

On 2 November 2026 this printed 2026.10.30 and 1766 . Each entry has cveID , vendorProject , product , dateAdded , dueDate and knownRansomwareCampaignUse , which is all the commands below need.

2.…