RSS setup · government security advisories
CISA RSS feeds: which URL should you subscribe to?
For general advisory monitoring, start with All CISA Advisories:https://www.cisa.gov/cybersecurity-advisories/all.xmlPaste this URL into your feed reader's “Add feed” option. You do not need a ThreatFilter account.
The advisory and alert feeds below returned valid RSS in our check, as did News and Blog. That is a dated availability check, not a guarantee of future access or complete coverage.
CISA feed URLs and what each one is for
Choose by purpose. Subscribing to every stream adds overlap and agency news to your advisory queue.
All CISA Advisories
Start here for the broad advisory stream.
https://www.cisa.gov/cybersecurity-advisories/all.xmlIncludes several advisory types; it is not a list of every CVE. Directory entry and copy button.
CISA Alerts
Follow the alerts stream separately.
https://www.cisa.gov/cybersecurity-advisories/alerts.xmlCan overlap with the all-advisories feed. Check before importing both. Directory entry and copy button.
CISA News
Follow agency announcements and news.
https://www.cisa.gov/news.xmlDoes not replace technical advisories for affected products. Directory entry and copy button.
CISA Blog
Read longer explanations and guidance posts.
https://www.cisa.gov/blog.xmlA quiet feed does not mean there are no new vulnerabilities. Directory entry and copy button.
Subscribe without filling your reader with duplicates
- Add the all-advisories URL above as a single subscription. Check that the reader shows advisory entries, rather than importing the CISA webpage URL.
- Open an entry on CISA's website and confirm its affected products, mitigation and publication date. Match the advisory against your inventory before making a patching decision.
- Add News or Blog only if you want those streams. If you also add Alerts, compare original entry URLs before treating overlapping entries as separate events.
- For a wider watchlist, import the vulnerability-monitoring starter OPML. It includes CISA advisories and a small selection of vendor feeds. TheCERT category OPML includes other national advisory publishers.
OPML is a subscription list, not a feed or an article archive. Import it using your reader's file-import option; do not paste the OPML URL into its single-feed field.
Is there a CISA KEV RSS feed here?
The KEV endpoint in this directory is a JSON catalogue, not RSS:https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.jsonUse it in a script or integration that understands JSON. It is intentionally excluded from our RSS/Atom OPML downloads.
CISA's KEV catalogueidentifies selected vulnerabilities with evidence of exploitation in the wild. An advisory feed has a different purpose and is not a complete mirror of KEV. Absence from either does not establish that a system is safe.
For a product-specific watchlist, the CVE RSS setup guidecompares vendor advisories, NVD and KEV. ThreatFilter's cross-source CVE indexconnects qualified CVEs to reporting; it is not an exhaustive vulnerability database.
Old US-CERT links, 403 errors or a quiet feed
If you have an older US-CERT subscription, compare its final address and entries with the CISA URLs above. Update the subscription only after checking the new feed, then remove the duplicate in your reader. Do not assume that every historical endpoint still redirects.
A 403 or parsing error in one reader does not prove the publisher has retired the feed. Check theoriginal advisory pageand the directory's coverage observations. Different networks or clients can receive different responses. Retry later using your reader's normal settings; do not bypass access controls.
A successful feed can also have no newer entries. Compare the latest item's date with the publisher's website. A successful fetch is not a promise that every CISA notification is distributed through RSS.