CVE Intelligence
Home / Feeds and export

Feeds and export

Follow the CVEs that matter to you in your RSS reader, in Slack/Teams (via RSS integration), or import them into your SIEM and intel platform (OpenCTI, MISP) as STIX 2.1.

Ready-made feeds

All updated CVEs RSS CSV STIX 2.1
CISA KEV RSS CSV STIX 2.1
Critical RSS CSV STIX 2.1
Ransomware RSS CSV STIX 2.1
With public exploit/PoC RSS CSV STIX 2.1
CISA KEV + Public exploit RSS CSV STIX 2.1

By vendor (most exploited)

RSS · MicrosoftRSS · DebianRSS · AppleRSS · CiscoRSS · GoogleRSS · Red HatRSS · FedoraprojectRSS · OracleRSS · AdobeRSS · OpensuseRSS · SUSERSS · MavenRSS · CanonicalRSS · Apache Software FoundationRSS · NetappRSS · VmwareRSS · IvantiRSS · LinuxRSS · SiemensRSS · FortinetRSS · CitrixRSS · DlinkRSS · SonicwallRSS · Composer

Any CVE Intelligence search becomes a feed: use the RSS/CSV/STIX links above the result list.

Formats

  • RSS 2.0 — the 50 most recently updated CVEs, with severity, KEV, ransomware and exploit in the category; refreshed every 15 min.
  • CSV — up to 5,000 rows with CVSS, EPSS, KEV, ransomware, public exploit, CWE and product (UTF-8, Excel-ready).
  • STIX 2.1 — up to 1,000 "vulnerability" objects with CVE/NVD/CWE references and labels (severity, cisa-kev, ransomware, public-exploit).
  • API v1 — for continuous integrations, use API v1 (/updates endpoint with cursor).