BountyHub Docs

CVE Watcher Overview

How CVE Watcher combines CISA KEV, NVD CVSS, and FIRST EPSS into an exploit-focused feed, how CVEs are published and re-announced, and what each plan can do.

CVE Watcher overview

CVE Watcher tracks vulnerabilities that are being exploited, or are likely to be exploited soon, and turns them into an actionable feed. Every entry is enriched with severity, exploitation likelihood, ransomware use, and the CISA remediation deadline.

The feed is open to every BountyHub plan. Push notifications to your own channels require a paid plan — see CVE Watcher push notifications.

#At a glance

Question	Field	Where it comes from
Is exploitation confirmed?	Exploit tier `confirmed`	CISA KEV
Is there public exploit code?	Exploit tier `watch` / `likely`, flag `Exploit`	NVD reference tags
How bad is it?	Severity and `CVSS`	NVD CVSS v3
How likely is exploitation?	`EPSS`	FIRST EPSS
Is it used by ransomware?	Flag `Ransomware`	CISA KEV
When must it be fixed?	KEV added / Due	CISA KEV

#Data sources

Source	Adds	Refresh
CISA KEV catalog	CVE id, vendor, product, description, KEV added date, remediation due date, known ransomware use	Polled every 5 minutes with a conditional request, so an unchanged feed is skipped
NVD CVE API v2	CVSS v3 base score, base severity, and `Exploit`-tagged references	Batched every minute
FIRST EPSS	Probability that the CVE will be exploited in the next 30 days	Batched every minute
NVD exploit sweep	CVEs modified recently that already have public exploit code, before CISA catalogs them	Runs with the KEV ingest

NVD data is used under its public API terms; CVE Watcher is not endorsed or certified by the NVD.

#Feed columns

Click a row in the feed to open the detail drawer with the full description and an NVD link.

Column	Meaning
Severity	CVSS bucket: critical, high, medium, low, none, or unknown.
Exploit tier	Confidence that this is exploited in the wild — see below.
Vulnerability	CVE id, vendor, product, and a one-line description.
CVSS	CVSS v3 base score from 0.0 to 10.0.
EPSS	Probability of exploitation in the next 30 days, shown as a percentage. Amber at 50% or higher.
KEV added	Date CISA added the CVE to the KEV catalog. Empty for CVEs found by the exploit sweep that are not KEV-confirmed yet.
Due	CISA remediation deadline. Amber when due within 14 days, red when missed in the last 30 days, gray when historical.
Flags	`Ransomware`, `Exploit` (public exploit code exists), and `Updated` (re-announced after an upgrade).

#Severity

Severity follows NVD's base severity when NVD provides it. When NVD only provides a score, CVE Watcher derives the same buckets from CVSS v3:

Bucket	CVSS v3	Meaning
Critical	9.0 – 10.0	Remotely exploitable, usually with high impact.
High	7.0 – 8.9	Serious impact or easily exploited.
Medium	4.0 – 6.9	Requires specific conditions or has limited impact.
Low	0.1 – 3.9	Limited impact or difficult to exploit.
None	0.0	No security impact recorded.
Unknown	—	NVD has not published a score.

#Exploit tier

The exploit tier is derived from the current data every time you query the feed, so an entry can move up as new signals arrive.

Tier	Meaning	How it is derived
Confirmed	Exploitation is confirmed in the wild.	The CVE is in CISA KEV.
Likely	Public exploit code exists and exploitation is probable.	NVD marks a public exploit reference and EPSS is 0.5 or higher.
Watch	Public exploit code exists, but CISA has not confirmed exploitation.	NVD marks a public exploit reference.
None	No known exploit signal.	None of the above.

Only Confirmed entries are announced by the publish pipeline. Likely and Watch entries appear in the feed as early warning, before CISA adds them to KEV. Use the tier search filter to focus on one signal level — see Search and filters.

#How a CVE reaches you

CVE Watcher uses two scheduled workflows and a strict publish order.

Ingest. Every 5 minutes, the KEV feed is fetched. Each entry is inserted or refreshed with KEV-only data. The same run sweeps recently modified NVD records for CVEs with public exploit code and adds them to the feed without KEV data.
Enrich and publish. Every minute, a batch of CVEs is enriched from NVD (CVSS and exploit references), EPSS probabilities are backfilled in batches, and any KEV-confirmed CVE that is new or materially upgraded is collected for publication.
Public announcement. The whole run's pending CVEs are posted as one digest to BountyHub's public Discord (chunked to Discord's message size). Each CVE is marked public_published.
In-app visibility. The CVE is marked user_visible and appears in every user's feed.
Paid push. The CVE is pushed to the channels assigned by paid users, then marked notified.

The order is structural: a later stage cannot run before an earlier one succeeds. If a stage fails, Temporal retries it; delivery jobs use an idempotency key that includes the CVE version, so a retry does not double-post while a new version is a distinct, re-announced event.

#Why a CVE can be re-announced

A CVE is published as version 1 the first time it is announced. It is published again, as version 2 or later, when its risk materially increases:

the severity bucket rises (for example high → critical), or
the severity bucket stays the same and the CVSS score rises by at least 1.0.

Downgrades, description-only edits, and other metadata changes do not re-announce. Re-announced entries have updated = true and a higher published_version; the feed shows the Updated flag.

#Cadence

Task	Interval	Notes
KEV ingest + exploit sweep	5 minutes	Conditional `If-Modified-Since` request; the sweep covers NVD records modified since the last watermark.
NVD enrichment + EPSS + publish	1 minute	5 CVEs per run without an NVD API key, 50 with one; EPSS backfills up to 100 CVEs per pass.
Public Discord digest	Per enrichment run with pending CVEs	Skipped when no public webhook is configured.
Paid push	Per published CVE version	One delivery job per CVE, version, and channel.

Self-hosted deployments can tune the data sources:

Variable	Effect
`BOUNTYHUB_NVD_API_KEY`	Raises the NVD batch from 5 to 50 CVEs per minute.
`BOUNTYHUB_CVE_PUBLIC_DISCORD_WEBHOOK_URL`	Enables the public digest to BountyHub's Discord. When unset, the digest is skipped and only in-app visibility and paid push run.

The Temporal schedules are cve-watcher-ingest (300 seconds) and cve-watcher-enrich (60 seconds). Activity and workflow code runs on the cve-watcher task queue.

#Plans and access

Capability	Free	Paid
Browse and search the CVE feed	Yes	Yes
Read CVE details and facets through the API	Yes	Yes
Assign Discord, Slack, email, or Telegram push channels	No	Yes
Receive push notifications	No	Yes, while the paid subscription is active or trialing

Push delivery uses one channel per integration kind. Assigning another channel of the same kind replaces the previous one.
Assigning a channel requires an active or trialing paid plan. If the plan lapses, the feed stays available but push delivery stops.
API access uses the NotificationRo scope for the feed and IntegrationRo / IntegrationRw for channel assignments — see CVE Watcher API and scopes.

Search and filters — the CVE query language.
Push notifications — Discord, Slack, email, and Telegram setup.
Notifications overview — how notification channels and integrations work across BountyHub.
Personal Access Token scopes — the scopes used by the CVE Watcher API.