# CVE Watcher overview

CVE Watcher tracks vulnerabilities that are being exploited, or are likely to
be exploited soon, and turns them into an actionable feed. Every entry is
enriched with severity, exploitation likelihood, ransomware use, and the CISA
remediation deadline.

The feed is open to every BountyHub plan. Push notifications to your own
channels require a paid plan — see
[CVE Watcher push notifications](/cve-watcher/notifications).

## At a glance

<table>
<thead>
  <tr>
    <th>
      Question
    </th>
    
    <th>
      Field
    </th>
    
    <th>
      Where it comes from
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Is exploitation confirmed?
    </td>
    
    <td>
      Exploit tier <code>
        confirmed
      </code>
    </td>
    
    <td>
      CISA KEV
    </td>
  </tr>
  
  <tr>
    <td>
      Is there public exploit code?
    </td>
    
    <td>
      Exploit tier <code>
        watch
      </code>
      
       / <code>
        likely
      </code>
      
      , flag <code>
        Exploit
      </code>
    </td>
    
    <td>
      NVD reference tags
    </td>
  </tr>
  
  <tr>
    <td>
      How bad is it?
    </td>
    
    <td>
      Severity and <code>
        CVSS
      </code>
    </td>
    
    <td>
      NVD CVSS v3
    </td>
  </tr>
  
  <tr>
    <td>
      How likely is exploitation?
    </td>
    
    <td>
      <code>
        EPSS
      </code>
    </td>
    
    <td>
      FIRST EPSS
    </td>
  </tr>
  
  <tr>
    <td>
      Is it used by ransomware?
    </td>
    
    <td>
      Flag <code>
        Ransomware
      </code>
    </td>
    
    <td>
      CISA KEV
    </td>
  </tr>
  
  <tr>
    <td>
      When must it be fixed?
    </td>
    
    <td>
      KEV added / Due
    </td>
    
    <td>
      CISA KEV
    </td>
  </tr>
</tbody>
</table>

## Data sources

<table>
<thead>
  <tr>
    <th>
      Source
    </th>
    
    <th>
      Adds
    </th>
    
    <th>
      Refresh
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" rel="nofollow">
        CISA KEV catalog
      </a>
    </td>
    
    <td>
      CVE id, vendor, product, description, KEV added date, remediation due date, known ransomware use
    </td>
    
    <td>
      Polled every 5 minutes with a conditional request, so an unchanged feed is skipped
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://nvd.nist.gov" rel="nofollow">
        NVD CVE API v2
      </a>
    </td>
    
    <td>
      CVSS v3 base score, base severity, and <code>
        Exploit
      </code>
      
      -tagged references
    </td>
    
    <td>
      Batched every minute
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://www.first.org/epss/" rel="nofollow">
        FIRST EPSS
      </a>
    </td>
    
    <td>
      Probability that the CVE will be exploited in the next 30 days
    </td>
    
    <td>
      Batched every minute
    </td>
  </tr>
  
  <tr>
    <td>
      NVD exploit sweep
    </td>
    
    <td>
      CVEs modified recently that already have public exploit code, before CISA catalogs them
    </td>
    
    <td>
      Runs with the KEV ingest
    </td>
  </tr>
</tbody>
</table>

NVD data is used under its public API terms; CVE Watcher is not endorsed or
certified by the NVD.

## Feed columns

Click a row in the feed to open the detail drawer with the full description and
an NVD link.

<table>
<thead>
  <tr>
    <th>
      Column
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Severity
      </strong>
    </td>
    
    <td>
      CVSS bucket: critical, high, medium, low, none, or unknown.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Exploit tier
      </strong>
    </td>
    
    <td>
      Confidence that this is exploited in the wild — see below.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Vulnerability
      </strong>
    </td>
    
    <td>
      CVE id, vendor, product, and a one-line description.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        CVSS
      </strong>
    </td>
    
    <td>
      CVSS v3 base score from 0.0 to 10.0.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        EPSS
      </strong>
    </td>
    
    <td>
      Probability of exploitation in the next 30 days, shown as a percentage. Amber at 50% or higher.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        KEV added
      </strong>
    </td>
    
    <td>
      Date CISA added the CVE to the KEV catalog. Empty for CVEs found by the exploit sweep that are not KEV-confirmed yet.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Due
      </strong>
    </td>
    
    <td>
      CISA remediation deadline. Amber when due within 14 days, red when missed in the last 30 days, gray when historical.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Flags
      </strong>
    </td>
    
    <td>
      <code>
        Ransomware
      </code>
      
      , <code>
        Exploit
      </code>
      
       (public exploit code exists), and <code>
        Updated
      </code>
      
       (re-announced after an upgrade).
    </td>
  </tr>
</tbody>
</table>

## Severity

Severity follows NVD's base severity when NVD provides it. When NVD only
provides a score, CVE Watcher derives the same buckets from CVSS v3:

<table>
<thead>
  <tr>
    <th>
      Bucket
    </th>
    
    <th>
      CVSS v3
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Critical
    </td>
    
    <td>
      9.0 – 10.0
    </td>
    
    <td>
      Remotely exploitable, usually with high impact.
    </td>
  </tr>
  
  <tr>
    <td>
      High
    </td>
    
    <td>
      7.0 – 8.9
    </td>
    
    <td>
      Serious impact or easily exploited.
    </td>
  </tr>
  
  <tr>
    <td>
      Medium
    </td>
    
    <td>
      4.0 – 6.9
    </td>
    
    <td>
      Requires specific conditions or has limited impact.
    </td>
  </tr>
  
  <tr>
    <td>
      Low
    </td>
    
    <td>
      0.1 – 3.9
    </td>
    
    <td>
      Limited impact or difficult to exploit.
    </td>
  </tr>
  
  <tr>
    <td>
      None
    </td>
    
    <td>
      0.0
    </td>
    
    <td>
      No security impact recorded.
    </td>
  </tr>
  
  <tr>
    <td>
      Unknown
    </td>
    
    <td>
      —
    </td>
    
    <td>
      NVD has not published a score.
    </td>
  </tr>
</tbody>
</table>

## Exploit tier

The exploit tier is derived from the current data every time you query the
feed, so an entry can move up as new signals arrive.

<table>
<thead>
  <tr>
    <th>
      Tier
    </th>
    
    <th>
      Meaning
    </th>
    
    <th>
      How it is derived
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Confirmed
    </td>
    
    <td>
      Exploitation is confirmed in the wild.
    </td>
    
    <td>
      The CVE is in CISA KEV.
    </td>
  </tr>
  
  <tr>
    <td>
      Likely
    </td>
    
    <td>
      Public exploit code exists and exploitation is probable.
    </td>
    
    <td>
      NVD marks a public exploit reference <strong>
        and
      </strong>
      
       EPSS is 0.5 or higher.
    </td>
  </tr>
  
  <tr>
    <td>
      Watch
    </td>
    
    <td>
      Public exploit code exists, but CISA has not confirmed exploitation.
    </td>
    
    <td>
      NVD marks a public exploit reference.
    </td>
  </tr>
  
  <tr>
    <td>
      None
    </td>
    
    <td>
      No known exploit signal.
    </td>
    
    <td>
      None of the above.
    </td>
  </tr>
</tbody>
</table>

Only **Confirmed** entries are announced by the publish pipeline. `Likely` and
`Watch` entries appear in the feed as early warning, before CISA adds them to
KEV. Use the `tier` search filter to focus on one signal level — see
[Search and filters](/cve-watcher/search).

## How a CVE reaches you

CVE Watcher uses two scheduled workflows and a strict publish order.

1. **Ingest.** Every 5 minutes, the KEV feed is fetched. Each entry is inserted
or refreshed with KEV-only data. The same run sweeps recently modified NVD
records for CVEs with public exploit code and adds them to the feed without
KEV data.
2. **Enrich and publish.** Every minute, a batch of CVEs is enriched from NVD
(CVSS and exploit references), EPSS probabilities are backfilled in batches,
and any KEV-confirmed CVE that is new or materially upgraded is collected for
publication.
3. **Public announcement.** The whole run's pending CVEs are posted as one
digest to [BountyHub's public Discord](https://discord.gg/EnPbMJF4dx)
(chunked to Discord's message size). Each CVE is marked `public_published`.
4. **In-app visibility.** The CVE is marked `user_visible` and appears in every
user's feed.
5. **Paid push.** The CVE is pushed to the channels assigned by paid users, then
marked `notified`.

The order is structural: a later stage cannot run before an earlier one
succeeds. If a stage fails, Temporal retries it; delivery jobs use an
idempotency key that includes the CVE version, so a retry does not double-post
while a new version is a distinct, re-announced event.

### Why a CVE can be re-announced

A CVE is published as **version 1** the first time it is announced. It is
published again, as version 2 or later, when its risk materially increases:

- the severity bucket rises (for example high → critical), or
- the severity bucket stays the same and the CVSS score rises by at least 1.0.

Downgrades, description-only edits, and other metadata changes do not
re-announce. Re-announced entries have `updated = true` and a higher
`published_version`; the feed shows the `Updated` flag.

## Cadence

<table>
<thead>
  <tr>
    <th>
      Task
    </th>
    
    <th>
      Interval
    </th>
    
    <th>
      Notes
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      KEV ingest + exploit sweep
    </td>
    
    <td>
      5 minutes
    </td>
    
    <td>
      Conditional <code>
        If-Modified-Since
      </code>
      
       request; the sweep covers NVD records modified since the last watermark.
    </td>
  </tr>
  
  <tr>
    <td>
      NVD enrichment + EPSS + publish
    </td>
    
    <td>
      1 minute
    </td>
    
    <td>
      5 CVEs per run without an NVD API key, 50 with one; EPSS backfills up to 100 CVEs per pass.
    </td>
  </tr>
  
  <tr>
    <td>
      Public Discord digest
    </td>
    
    <td>
      Per enrichment run with pending CVEs
    </td>
    
    <td>
      Skipped when no public webhook is configured.
    </td>
  </tr>
  
  <tr>
    <td>
      Paid push
    </td>
    
    <td>
      Per published CVE version
    </td>
    
    <td>
      One delivery job per CVE, version, and channel.
    </td>
  </tr>
</tbody>
</table>

Self-hosted deployments can tune the data sources:

<table>
<thead>
  <tr>
    <th>
      Variable
    </th>
    
    <th>
      Effect
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        BOUNTYHUB_NVD_API_KEY
      </code>
    </td>
    
    <td>
      Raises the NVD batch from 5 to 50 CVEs per minute.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        BOUNTYHUB_CVE_PUBLIC_DISCORD_WEBHOOK_URL
      </code>
    </td>
    
    <td>
      Enables the public digest to BountyHub's Discord. When unset, the digest is skipped and only in-app visibility and paid push run.
    </td>
  </tr>
</tbody>
</table>

The Temporal schedules are `cve-watcher-ingest` (300 seconds) and
`cve-watcher-enrich` (60 seconds). Activity and workflow code runs on the
`cve-watcher` task queue.

## Plans and access

<table>
<thead>
  <tr>
    <th>
      Capability
    </th>
    
    <th>
      Free
    </th>
    
    <th>
      Paid
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Browse and search the CVE feed
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      Read CVE details and facets through the API
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      Assign Discord, Slack, email, or Telegram push channels
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      Receive push notifications
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes, while the paid subscription is active or trialing
    </td>
  </tr>
</tbody>
</table>

- Push delivery uses **one channel per integration kind**. Assigning another
channel of the same kind replaces the previous one.
- Assigning a channel requires an active or trialing paid plan. If the plan
lapses, the feed stays available but push delivery stops.
- API access uses the `NotificationRo` scope for the feed and `IntegrationRo` /
`IntegrationRw` for channel assignments — see
[CVE Watcher API and scopes](/cve-watcher/api).

## Related

- [Search and filters](/cve-watcher/search) — the CVE query language.
- [Push notifications](/cve-watcher/notifications) — Discord, Slack, email, and
Telegram setup.
- [Notifications overview](/notifications/overview) — how notification channels
and integrations work across BountyHub.
- [Personal Access Token scopes](/developer/scopes) — the scopes used by the
CVE Watcher API.