cisa

reference corpus · status live · domain SEC (Security advisories and identifiers) · lane A · refresh weekly · tags US · ADVISORIES · VULNERABILITIES · SECURITY · KEV · ADVISORIES

What an agent uses it for

One CISA corpus: advisories and the Known Exploited Vulnerabilities catalog together. An agent answering 'is this CVE exploited in the wild, and what do the mitigations say' queries one index.

Use it
xerj corpus add --from https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/cisa.json
xerj corpus index cisa then xerj code cisa "your question"

Sources and pins

source	pin	licence	size	review note
corpus-cisa	edfa369426f2	US-government public domain (17 USC 105) and CC0-1.0	4.8 MB / 1,998 files	Merged CISA corpus, one repo: cybersecurity advisories (2025-05..2026-10 window, byte-verbatim from corpus-cisa-alerts @b4d2547e86425aa3b3d63fa07a9ea07d339b49e1, US federal works 17 USC 105, co-published advisories flagged in front-matter may carry partner-nation copyright), ICS advisories (same), and the KEV catalog one file per CVE (CC0-1.0, human-verified in the mirror LICENSE; fields byte-verb

4.8 MB across 1,998 files. Added 2026-10-06.

Rights

US-government public domain (17 USC 105) and CC0-1.0. Redistribution permitted with attribution per the licence review. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.

Retrieval spot-check (G7)

4.0/5 relevant. Graded 2026-10-06.

Q: Is CVE-2021-44228 in the Known Exploited Vulnerabilities catalog and what is the required patch due date
expect: kev/CVE-2021-44228.txt in top-5 (dateAdded 2021-12-10, dueDate 2021-12-24)
top-5: corpus-cisa/kev/CVE-2021-44228.txt / corpus-cisa/kev/CVE-2021-45046.txt / corpus-cisa/kev/CVE-2020-1350.txt / corpus-cisa/kev/CVE-2020-1472.txt / corpus-cisa/kev/CVE-2020-0601.txt
grade: pass

Q: Which KEV entries are known to be exploited by ransomware actors and list their due dates
expect: kev/CVE-*.txt with knownRansomwareCampaignUse Known in top-5
top-5: corpus-cisa/alerts/2026/aa26-113a.md / corpus-cisa/alerts/2026/aa26-113a.md / corpus-cisa/alerts/2025/aa25-343a.md / corpus-cisa/alerts/2026/2026-07-30-cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs.md / corpus-cisa/README.md
grade: miss

Q: What is the known exploitation date and description for CVE-2023-4966 Citrix NetScaler
expect: kev/CVE-2023-4966.txt in top-5 (dateAdded 2023-10-18)
top-5: corpus-cisa/kev/CVE-2023-4966.txt / corpus-cisa/kev/CVE-2023-3519.txt / corpus-cisa/kev/CVE-2023-6548.txt / corpus-cisa/kev/CVE-2023-6549.txt / corpus-cisa/alerts/2026/2026-09-27-critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway.md
grade: pass

Q: What indicators of compromise and required actions does the CISA advisory about a ransomware campaign give
expect: an AA-series joint advisory with IOC and required-actions sections
top-5: corpus-cisa/alerts/2026/2026-03-18-cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization.md / corpus-cisa/alerts/2026/aa26-204a.md / corpus-cisa/alerts/2026/2026-02-10-poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps.md / corpus-cisa/alerts/2026/aa26-204a.md / corpus-cisa/alerts/2026/aa26-097a.md
grade: pass

Q: Which ICS advisory covers Siemens products and what mitigations does it recommend
expect: an ICSA advisory naming Siemens products
top-5: corpus-cisa/ics/2026/icsa-26-209-04.md / corpus-cisa/ics/2026/icsa-26-211-07.md / corpus-cisa/alerts/2026/aa26-231a.md / corpus-cisa/alerts/2026/aa26-097a.md / corpus-cisa/ics/2026/icsa-26-209-04.md
grade: pass