Early warnings
Security incidents reported before a CVE exists, such as vendor breaches, exploited zero-days, and malicious package releases, with every source linked and a confidence level for each.
Many incidents become public long before a CVE record does, and some never get one: a SaaS vendor discloses a breach, a zero-day is exploited before a patch, or a package release turns out to be malicious. cve.now lists these incidents as early warnings in its main feed, next to new CVEs. Each comes with the sources that reported it and what to do if you use the affected vendor.
To see only early warnings, choose Early warnings in the Type filter on the homepage, or open cve.now/?type=early_warning.
Confidence levels
Every early warning has a confidence level, based on who has reported it.
| Level | Meaning |
|---|---|
| Confirmed | The vendor, a regulator or CERT, or a published CVE has confirmed the incident. |
| Corroborated | An established security newsroom, or a trusted security reporter, has reported it. |
| Unverified | Only social posts make the claim so far. |
The default list shows confirmed and corroborated incidents. Unverified claims are listed separately, linked from the bottom of the page, and are never in the RSS feed or indexed by search engines. Claims that only come from ransomware leak sites are never shown: they are the attacker's word.
Kinds
Each early warning is one of these kinds: breach, vulnerability, malicious-package, ransomware, or outage.
Filter the list
The type query parameter selects what the homepage lists: cve for CVEs only, early_warning for early warnings only, or all for both. Severity applies to both: filter=critical lists critical early warnings. Technology and ecosystem filter CVEs only. With type=early_warning, the page takes two more query parameters, each a comma-separated list.
| Parameter | Values | Default |
|---|---|---|
confidence | confirmed, corroborated, unverified | confirmed,corroborated |
kind | breach, vulnerability, malicious-package, ransomware, outage | Every kind |
For example, cve.now/?type=early_warning&confidence=confirmed&kind=breach shows confirmed breaches only. The list covers the last two weeks.
An early warning's page
Each early warning has its own page at cve.now/ followed by its id, which starts with SZB-, the same way a CVE's page is cve.now/ followed by its CVE id. The page shows:
- The status, kind, vendor, product when known, when cve.now first saw it, and when it was confirmed.
- A short summary of the incident.
- If you use the vendor: concrete actions, such as rotating API tokens.
- What the sources say: a quote from each report that supports the claim, with a link to it.
- Tracked as: the CVE ids, once the incident has them.
Subscribe
The unfiltered feed at https://cve.now/feed includes confirmed and corroborated early warnings alongside CVEs. For early warnings only, use the URL below. Add kind or filter=critical to narrow it.
https://cve.now/feed?type=early_warningAdd &format=atom or &format=json for Atom or JSON Feed.
Add it to a feed reader or a Slack channel the same way as the vulnerability feeds. See Subscribe to feeds.