# CVE Watcher

CVE Watcher is BountyHub's built-in feed of **known exploited vulnerabilities** —
CVEs with evidence that attackers are already using them, not just CVEs with a
high severity score. It starts from CISA's Known Exploited Vulnerabilities
(KEV) catalog and enriches each entry with NVD and FIRST EPSS data, so the feed
answers the questions that decide what you patch first:

- Is this being exploited in the wild?
- How bad is it if it is?
- How likely is exploitation, even before CISA confirms it?
- What is the remediation deadline?

Open **CVE Watcher** from the Hub navigation, or start with the
[CVE Watcher overview](/cve-watcher/overview).

<table>
<thead>
  <tr>
    <th>
      Page
    </th>
    
    <th>
      What it covers
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <a href="/cve-watcher/overview">
        Overview
      </a>
    </td>
    
    <td>
      Data sources, feed columns, severity and exploit tiers, the publish pipeline, cadence, and plans.
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="/cve-watcher/search">
        Search and filters
      </a>
    </td>
    
    <td>
      The query language used by the feed and the <code>
        search
      </code>
      
       API field.
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="/cve-watcher/notifications">
        Push notifications
      </a>
    </td>
    
    <td>
      Channel setup, delivery rules, and troubleshooting.
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="/cve-watcher/api">
        API and scopes
      </a>
    </td>
    
    <td>
      <code>
        CveWatcherService
      </code>
      
       RPCs, message fields, pagination, and PAT scopes.
    </td>
  </tr>
</tbody>
</table>

The feed is readable on every plan. Push notifications require a paid plan.