CERT advisories and KEV

National CERT advisories

vuln.mlab.sh reads the public feeds of the national CERTs and CSIRTs of Europe (EU-27, the UK, Switzerland, Norway and Iceland) every 30 minutes and links each advisory to the CVEs it cites. Browse them at /advisories, the teams behind them at /authorities, and the advisories citing a CVE on its page.

Which CERTs mention a CVE

curl "https://vuln.mlab.sh/api/v1/advisories?cve=CVE-2021-44228"

{
  "cve": "CVE-2021-44228",
  "advisories": [
    { "country": "FR", "team": "CERT-FR", "title": "...", "link": "https://www.cert.ssi.gouv.fr/...", "published": "2021-12-10" }
  ]
}

At most 50, newest first.

The latest stream

curl "https://vuln.mlab.sh/api/v1/advisories?country=DE&limit=20"

Advisories citing at least one CVE come first, each group newest first. Each item has country, team, title, link, summary (as published, in its own language), lang, published (YYYY-MM-DD HH:MM UTC) and cve_ids. An unknown country or CVE returns an empty list, never an error.

Known exploited vulnerabilities

Two catalogues list CVEs exploited in the wild:

• CISA KEV, with a remediation deadline for US federal agencies;
• the EU KEV, published by ENISA.

Every CVE record says whether it is in either: in_kev (CISA, with kev_date_added and kev_due_date) and in_eu_kev. A known-exploited CVE gets a risk_score of 100. /kev lists both catalogues with their deadlines.

# Known-exploited CVEs matching a search
curl "https://vuln.mlab.sh/api/v1/cve?q=ivanti&kevOnly=1"

# As an RSS feed
curl "https://vuln.mlab.sh/rss?kevOnly=1"

To be told when a CVE you care about joins a catalogue, use a watchlist with the kev trigger. An SBOM project ranks its findings by known exploitation first.