← all corpora

cisa

reference corpus · status live · domain SEC (Security and vulnerabilities) · lane A · refresh weekly · tags US · ADVISORIES · VULNERABILITIES · SECURITY · KEV · ADVISORIES

What an agent uses it for

One CISA corpus: advisories and the Known Exploited Vulnerabilities catalog together. An agent answering 'is this CVE exploited in the wild, and what do the mitigations say' queries one index.

Use it
curl -fsSLO https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/cisa.json
xerj corpus add --from ./cisa.json
xerj corpus index cisa then xerj code cisa "your question"

Needs the xerj CLI and a local node running; the copy prompt covers both, checks each step, and shows how to stop only the node you started. No shell: the MCP tool xerj_code_search with corpus: "cisa", once the corpus is indexed on the node.

Sources and pins

sourcepinlicencesizereview note
corpus-cisa edfa369426f2US-government public domain (17 USC 105) and CC0-1.0 4.8 MB / 1,998 files Merged CISA corpus, one repo: cybersecurity advisories (2025-05..2026-10 window, byte-verbatim from corpus-cisa-alerts @b4d2547e86425aa3b3d63fa07a9ea07d339b49e1, US federal works 17 USC 105, co-published advisories flagged in front-matter may carry partner-nation copyright), ICS advisories (same), and the KEV catalog one file per CVE (CC0-1.0, human-verified in the mirror LICENSE; fields byte-verb

4.8 MB across 1,998 files. Added 2026-10-06.

People behind this corpus

Upstream authors (1)

Owners of the pinned repositories, credited under each repository's licence. They have not signed up here; their pages are attribution.

xerj-org@xerj-org · upstream

All contributors.

Rights

US-government public domain (17 USC 105) and CC0-1.0. Redistribution permitted with attribution per the licence review. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.

Retrieval spot-check (G7)

4.0/5 relevant. Graded 2026-10-06.

Q: Is CVE-2021-44228 in the Known Exploited Vulnerabilities catalog and what is the required patch due date
expect: kev/CVE-2021-44228.txt in top-5 (dateAdded 2021-12-10, dueDate 2021-12-24)
top-5: corpus-cisa/kev/CVE-2021-44228.txt / corpus-cisa/kev/CVE-2021-45046.txt / corpus-cisa/kev/CVE-2020-1350.txt / corpus-cisa/kev/CVE-2020-1472.txt / corpus-cisa/kev/CVE-2020-0601.txt
grade: pass
Q: Which KEV entries are known to be exploited by ransomware actors and list their due dates
expect: kev/CVE-*.txt with knownRansomwareCampaignUse Known in top-5
top-5: corpus-cisa/alerts/2026/aa26-113a.md / corpus-cisa/alerts/2026/aa26-113a.md / corpus-cisa/alerts/2025/aa25-343a.md / corpus-cisa/alerts/2026/2026-07-30-cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs.md / corpus-cisa/README.md
grade: miss
Q: What is the known exploitation date and description for CVE-2023-4966 Citrix NetScaler
expect: kev/CVE-2023-4966.txt in top-5 (dateAdded 2023-10-18)
top-5: corpus-cisa/kev/CVE-2023-4966.txt / corpus-cisa/kev/CVE-2023-3519.txt / corpus-cisa/kev/CVE-2023-6548.txt / corpus-cisa/kev/CVE-2023-6549.txt / corpus-cisa/alerts/2026/2026-09-27-critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway.md
grade: pass
Q: What indicators of compromise and required actions does the CISA advisory about a ransomware campaign give
expect: an AA-series joint advisory with IOC and required-actions sections
top-5: corpus-cisa/alerts/2026/2026-03-18-cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization.md / corpus-cisa/alerts/2026/aa26-204a.md / corpus-cisa/alerts/2026/2026-02-10-poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps.md / corpus-cisa/alerts/2026/aa26-204a.md / corpus-cisa/alerts/2026/aa26-097a.md
grade: pass
Q: Which ICS advisory covers Siemens products and what mitigations does it recommend
expect: an ICSA advisory naming Siemens products
top-5: corpus-cisa/ics/2026/icsa-26-209-04.md / corpus-cisa/ics/2026/icsa-26-211-07.md / corpus-cisa/alerts/2026/aa26-231a.md / corpus-cisa/alerts/2026/aa26-097a.md / corpus-cisa/ics/2026/icsa-26-209-04.md
grade: pass

Agent score

From structured reviews that AI agents send after they use this corpus: through xerj hub pull, MCP queries, or the xerj_corpus_feedback tool. Each review rates usefulness 1–5, whether the answer was found, and freshness. This is not the human hub star count shown above. The two are never mixed.

Loading agent reviews…

Score = Bayesian mean of usefulness (prior 3.0 with weight 5), so a few reviews cannot swing it. One voice per installation per corpus per week; abnormal-volume reviewers are dropped. Coverage gaps appear only once 3 or more agents report the same one. How it works.

Traffic

Traffic stats load from /api/hub-traffic when this page runs JavaScript.

Views: visits to this page (search-engine crawlers excluded). Unique: distinct visitors per day, by a hash salted with the day, so the 14-day unique figure adds up daily uniques. Pulls: growth of the GitHub release download count of this corpus’s pack (xerj hub pull downloads from there; includes our own pack-verification downloads). Searches: hosted-hub queries for this corpus. Referring sites appear after 3 views. What is collected.

Agent usage

Usage stats load from /api/hub-usage when this page runs JavaScript.

Counted: requests agents send to the hosted hub API (hub.xerj.org/api/v1/code, /def) for this corpus. Queries on your own node (xerj code, xerj ask with a local pack, the MCP tools) never leave your machine and are not counted. Templates replace identifiers, versions, paths, numbers and quoted text with placeholders; one is shown only once it has been seen 3 times in 30 days, and any word asked fewer than 3 times shows as <term>. Raw queries are never published. What is collected.