# CVE Watcher push notifications

CVE Watcher can push every new or materially upgraded known-exploited
vulnerability to your own Discord, Slack, email, or Telegram channel. Push
notifications require a paid plan; the feed itself stays available on every
plan.

## How delivery works

1. A KEV-confirmed CVE finishes NVD enrichment and is published to BountyHub's
public Discord.
2. The CVE becomes visible in the in-app feed.
3. A delivery job is queued for each assigned channel on an active or trialing
paid plan.
4. The job sends one message to that channel.

Push happens **after** the public announcement and in-app visibility, so your
channel never gets a CVE that is not already visible in BountyHub. Each CVE
version is delivered at most once per channel; retries do not double-send, and a
re-announced upgrade arrives as a new message.

Only **KEV-confirmed** CVEs are pushed. The exploit sweep's early `likely` and
`watch` entries appear in the feed but do not trigger notifications until CISA
adds them to KEV.

## Set up a channel

1. Create the integration and notification channel under **Notifications** —
see [Notifications overview](/notifications/overview). A CVE Watcher
assignment always points at an existing notification channel.
2. Open **CVE Watcher** and select the **Notifications** tab. The tab is
disabled on the free plan.
3. Find the integration kind, choose **Assign**, and select the channel.
4. Assigning a channel replaces any previous channel of the same kind. Use the
item menu to remove an assignment.

You can have one Discord, one Slack, one email, and one Telegram channel
assigned at the same time.

## Supported channels

<table>
<thead>
  <tr>
    <th>
      Kind
    </th>
    
    <th>
      Delivered
    </th>
    
    <th>
      Channel must provide
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Discord
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      A webhook URL (<code>
        webhook_url
      </code>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      Slack
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      A webhook URL (<code>
        webhook_url
      </code>
      
       or <code>
        incoming_webhook_url
      </code>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      Email
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      A destination address (<code>
        email
      </code>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      Telegram
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      A bot token (<code>
        bot_token
      </code>
      
      ) and chat id (<code>
        chat_id
      </code>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      Webhook
    </td>
    
    <td>
      Not yet
    </td>
    
    <td>
      —
    </td>
  </tr>
</tbody>
</table>

Values are read from the notification channel's configuration first, then from
the integration's configuration. A channel that is missing a required value is
skipped with a warning in the server log; fix the configuration and the next
CVE will deliver normally.

Webhook channels can be selected in the UI, but CVE Watcher does not currently
deliver pushes through them. Use Discord, Slack, email, or Telegram for alerts.

## What a message contains

Discord, Slack, and Telegram receive a Markdown message; email receives the same
facts as HTML with a subject line.

```text
🚨 CVE-2024-3400 — Palo Alto Networks PAN-OS
Severity: CRITICAL
CVSS: 10.0
Known ransomware campaign use
Public exploit available
Command injection in the GlobalProtect feature...
https://nvd.nist.gov/vuln/detail/CVE-2024-3400
```

Email subjects look like:

```text
[CVE Watcher] CVE-2024-3400 (CVSS 10.0, KEV ransomware)
```

Messages only include the fields that are known. Wording and formatting may
change; treat the CVE id and NVD link as the stable identifiers.

## When you receive an alert

<table>
<thead>
  <tr>
    <th>
      Event
    </th>
    
    <th>
      Alert
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      A CVE is added to KEV and enriched
    </td>
    
    <td>
      Yes, as version 1
    </td>
  </tr>
  
  <tr>
    <td>
      Severity bucket rises (for example high → critical)
    </td>
    
    <td>
      Yes, as a new version with the <code>
        Updated
      </code>
      
       flag
    </td>
  </tr>
  
  <tr>
    <td>
      CVSS rises by at least 1.0 within the same bucket
    </td>
    
    <td>
      Yes, as a new version
    </td>
  </tr>
  
  <tr>
    <td>
      EPSS or exploit references change without a publishable upgrade
    </td>
    
    <td>
      No
    </td>
  </tr>
  
  <tr>
    <td>
      Description-only edit
    </td>
    
    <td>
      No
    </td>
  </tr>
  
  <tr>
    <td>
      CVE appears in the exploit sweep but is not in KEV
    </td>
    
    <td>
      No
    </td>
  </tr>
</tbody>
</table>

See [How a CVE reaches you](/cve-watcher/overview#how-a-cve-reaches-you) for the
full pipeline and versioning rules.

## Plans and plan changes

- Assigning a channel requires an active or trialing paid plan.
- Delivery only targets users whose subscription is active or trialing on a
non-free plan. If your plan lapses, existing assignments remain but no new
pushes are delivered until the subscription is active again.
- The feed remains readable on the free plan.

## Troubleshooting

<table>
<thead>
  <tr>
    <th>
      Symptom
    </th>
    
    <th>
      Check
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Notifications tab is disabled
    </td>
    
    <td>
      Push requires a paid plan.
    </td>
  </tr>
  
  <tr>
    <td>
      No channels to pick from
    </td>
    
    <td>
      Create an integration and notification channel of that kind under Notifications first.
    </td>
  </tr>
  
  <tr>
    <td>
      Assignment exists but nothing arrives
    </td>
    
    <td>
      Confirm the subscription is active or trialing, and that the CVE is KEV-confirmed rather than a <code>
        watch
      </code>
      
       / <code>
        likely
      </code>
      
       early entry.
    </td>
  </tr>
  
  <tr>
    <td>
      Discord or Slack returns an error
    </td>
    
    <td>
      Re-check the webhook URL in the notification channel, and that the webhook still exists in the destination workspace.
    </td>
  </tr>
  
  <tr>
    <td>
      Email does not arrive
    </td>
    
    <td>
      Check the destination address and spam folder; email uses the channel <code>
        email
      </code>
      
       value.
    </td>
  </tr>
  
  <tr>
    <td>
      Telegram does not arrive
    </td>
    
    <td>
      Check <code>
        bot_token
      </code>
      
       and <code>
        chat_id
      </code>
      
      , and that the bot can post in that chat.
    </td>
  </tr>
  
  <tr>
    <td>
      A webhook channel never receives CVE pushes
    </td>
    
    <td>
      Webhook delivery is not implemented for CVE Watcher yet.
    </td>
  </tr>
</tbody>
</table>

Server operators can find skipped-channel warnings (`missing webhook_url`,
`missing email`, `missing bot_token` / `chat_id`) in the hub logs.

## Related

- [CVE Watcher overview](/cve-watcher/overview) — sources, tiers, and the
publish pipeline.
- [Notifications overview](/notifications/overview) — integrations and
notification channels.
- [CVE Watcher API and scopes](/cve-watcher/api) — assign channels
programmatically.