BountyHub Docs
CVE Watcher Push Notifications
Send new and upgraded CISA KEV vulnerabilities to Discord, Slack, email, or Telegram from CVE Watcher, and troubleshoot missing alerts.
CVE Watcher push notifications
CVE Watcher can push every new or materially upgraded known-exploited vulnerability to your own Discord, Slack, email, or Telegram channel. Push notifications require a paid plan; the feed itself stays available on every plan.
#How delivery works
- A KEV-confirmed CVE finishes NVD enrichment and is published to BountyHub's public Discord.
- The CVE becomes visible in the in-app feed.
- A delivery job is queued for each assigned channel on an active or trialing paid plan.
- The job sends one message to that channel.
Push happens after the public announcement and in-app visibility, so your channel never gets a CVE that is not already visible in BountyHub. Each CVE version is delivered at most once per channel; retries do not double-send, and a re-announced upgrade arrives as a new message.
Only KEV-confirmed CVEs are pushed. The exploit sweep's early likely and
watch entries appear in the feed but do not trigger notifications until CISA
adds them to KEV.
#Set up a channel
- Create the integration and notification channel under Notifications — see Notifications overview. A CVE Watcher assignment always points at an existing notification channel.
- Open CVE Watcher and select the Notifications tab. The tab is disabled on the free plan.
- Find the integration kind, choose Assign, and select the channel.
- Assigning a channel replaces any previous channel of the same kind. Use the item menu to remove an assignment.
You can have one Discord, one Slack, one email, and one Telegram channel assigned at the same time.
#Supported channels
| Kind | Delivered | Channel must provide |
|---|---|---|
| Discord | Yes | A webhook URL (webhook_url). |
| Slack | Yes | A webhook URL (webhook_url or incoming_webhook_url). |
| Yes | A destination address (email). | |
| Telegram | Yes | A bot token (bot_token) and chat id (chat_id). |
| Webhook | Not yet | — |
Values are read from the notification channel's configuration first, then from the integration's configuration. A channel that is missing a required value is skipped with a warning in the server log; fix the configuration and the next CVE will deliver normally.
Webhook channels can be selected in the UI, but CVE Watcher does not currently deliver pushes through them. Use Discord, Slack, email, or Telegram for alerts.
#What a message contains
Discord, Slack, and Telegram receive a Markdown message; email receives the same facts as HTML with a subject line.
Email subjects look like:
Messages only include the fields that are known. Wording and formatting may change; treat the CVE id and NVD link as the stable identifiers.
#When you receive an alert
| Event | Alert |
|---|---|
| A CVE is added to KEV and enriched | Yes, as version 1 |
| Severity bucket rises (for example high → critical) | Yes, as a new version with the Updated flag |
| CVSS rises by at least 1.0 within the same bucket | Yes, as a new version |
| EPSS or exploit references change without a publishable upgrade | No |
| Description-only edit | No |
| CVE appears in the exploit sweep but is not in KEV | No |
See How a CVE reaches you for the full pipeline and versioning rules.
#Plans and plan changes
- Assigning a channel requires an active or trialing paid plan.
- Delivery only targets users whose subscription is active or trialing on a non-free plan. If your plan lapses, existing assignments remain but no new pushes are delivered until the subscription is active again.
- The feed remains readable on the free plan.
#Troubleshooting
| Symptom | Check |
|---|---|
| Notifications tab is disabled | Push requires a paid plan. |
| No channels to pick from | Create an integration and notification channel of that kind under Notifications first. |
| Assignment exists but nothing arrives | Confirm the subscription is active or trialing, and that the CVE is KEV-confirmed rather than a watch / likely early entry. |
| Discord or Slack returns an error | Re-check the webhook URL in the notification channel, and that the webhook still exists in the destination workspace. |
| Email does not arrive | Check the destination address and spam folder; email uses the channel email value. |
| Telegram does not arrive | Check bot_token and chat_id, and that the bot can post in that chat. |
| A webhook channel never receives CVE pushes | Webhook delivery is not implemented for CVE Watcher yet. |
Server operators can find skipped-channel warnings (missing webhook_url,
missing email, missing bot_token / chat_id) in the hub logs.
#Related
- CVE Watcher overview — sources, tiers, and the publish pipeline.
- Notifications overview — integrations and notification channels.
- CVE Watcher API and scopes — assign channels programmatically.