How to get the CISA KEV list with EPSS scores into pandas
Short answer
CISA publishes the Known Exploited Vulnerabilities (KEV) catalog and FIRST publishes daily EPSS exploit-probability scores. The Kevscope dataset joins them daily: load the "kev" table, sort by EPSS and due date, and patch KEV entries on your systems first.
- pip install datasets
- Load the "kev" config (or "recent" for the newest additions, "epss" for scores).
- Filter to vendors and products you run.
- Sort by CISA due date, then by EPSS.
- Re-load daily; the dataset refreshes from the public sources.
Copy-paste code
Data: CyberMax dataset on Hugging Face; load it with the datasets library (pip install datasets)
from datasets import load_dataset
ds = load_dataset("CyberMax-tools/kevscope-cve-kev-epss-daily", "kev", split="train")
df = ds.to_pandas()
print(len(df), "rows")
print(df.head())
Kevscope API: Which CVEs to patch first, in one call
from $5Need it for your own CVE list, live? The Kevscope API returns today's KEV status and EPSS for any CVE: $5 for 2,000 calls, free daily tier.
Secure checkout · 14-day fix-or-refund if it doesn't work as described (terms)Questions
Is KEV the same as CVSS?
No. CVSS rates severity; KEV lists vulnerabilities known to be exploited; EPSS estimates the chance of exploitation in the next 30 days.
Free: the Free API Starter Kit
Copy-paste calls for 4 APIs with free daily tiers (CVE priority, VIN recalls, US duty rates, email checks), then 5 short emails on KEV/EPSS, MCP and free data.