Subscribe to feeds

Every cve.now feed is one URL, https://cve.now/feed, narrowed with query parameters. No account or key is needed. The easiest way to build a URL is the Subscribe section on the cve.now homepage: choose filters, pick a format, and copy the URL.

Prerequisites

• A feed reader, a Slack workspace where you can add apps, or a shell with curl.

Build a feed URL

• Without type, the unfiltered feed lists CVEs and confirmed or corroborated early warnings. type=cve lists CVEs only, and type=early_warning lists early warnings only. tech, ecosystem, and filter=kev select CVEs, so without type they imply type=cve, and they cannot combine with type=early_warning or type=all. filter=critical applies to both: type=all&filter=critical lists critical CVEs and critical early warnings.
• filter=critical is the critical list. filter=kev is the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog.
• filter, tech, and ecosystem each take one value or several, as a comma-separated list (tech=nextjs,react) or repeated (tech=nextjs&tech=react). An item must match any listed value of a parameter, and every parameter you give.
• The values multiply into combinations, and a feed can combine at most 16 (for example, 4 technologies and 4 ecosystems).

Examples:

An unknown filter, tech, or format, an invalid ecosystem, or more than 16 combinations returns HTTP 400 with a JSON error message. A valid ecosystem with no matching entries returns an empty feed.

Technologies

tech takes these slugs.

• Frameworks and runtimes: nextjs, react, node, express, django, flask, rails, spring, log4j, php, wordpress
• Infrastructure: kubernetes, docker, nginx, apache-httpd, openssl, linux-kernel, jenkins, gitlab
• Databases: postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase
• Vendors and products: fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome

To request a technology, open an issue at github.com/sazabi/cve.now.

Add a feed to a feed reader

Add the feed URL as a new subscription in any reader that supports RSS, Atom, or JSON Feed:

https://cve.now/feed?filter=critical

Add a feed to Slack

1. Add Slack's RSS app to your Slack workspace.
2. In the channel that should get updates, run:

/feed subscribe https://cve.now/feed?filter=critical

Read a feed from a script

Request JSON and filter it with your own tools. Responses allow cross-origin requests.

curl "https://cve.now/feed?filter=kev&format=json"
curl -s "https://cve.now/feed?filter=critical&tech=nextjs&format=json" | jq -r '.items[].title'

What a feed item contains

Each item links to the entry page and carries the entry's summary, or its original description when it has no summary. cve.now adds an item when an entry first appears, and again when the entry changes in a way that matters. Update items say why in the title, for example "Update: added to CISA KEV". An update is published when:

• The vulnerability is added to CISA KEV.
• It becomes critical.
• Its CVSS score is published or changes.
• Public exploit code is published for it on Exploit-DB, or it first appears in Metasploit, Nuclei, or PoC-in-GitHub.
• CISA's SSVC assessment rates its exploitation as active.

A feed holds its 200 newest items. Responses are cached for about a minute, so polling more often than every few minutes returns the same items. Item timestamps are the time an entry last changed materially, not the time of the latest check.

Verify

Open the feed URL in a browser, or run curl "https://cve.now/feed?filter=critical&format=json", and confirm the response lists items. In a feed reader or Slack, confirm the subscription shows the newest items.