Analyst workflow · RSS and vulnerability monitoring
CVE RSS feeds: build a useful vulnerability watchlist
Start with the vendors you actually run, add an advisory source, and keep exploitation evidence separate from severity. Here is a small feed-reader setup you can use without an account.
Which CVE RSS feed should I use?
There is no single feed here that represents every vulnerability, every update and every exploited product. Vendor advisories explain affected versions and fixes. Government advisories add mitigation guidance. Research and news help explain campaigns, but their headlines are not a patch inventory.
Choose the relevant vendor rows below rather than subscribing to all of them by default. These are publishers' RSS endpoints from the source directory. They include security announcements beyond CVEs, and publisher availability can change.
| Publisher and RSS URL | Use it for | Keep in mind |
|---|---|---|
| CISA Cybersecurity Advisorieshttps://www.cisa.gov/cybersecurity-advisories/all.xml | Government advisories and mitigation guidance | Selected advisories, not every CVE. |
| Microsoft MSRChttps://api.msrc.microsoft.com/update-guide/rss | Microsoft security updates for a Microsoft estate | Read the affected product and version details. |
| Cisco PSIRThttps://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml | Cisco product security advisories | Separate from Cisco Talos research. |
| Fortinet PSIRThttps://filestore.fortinet.com/fortiguard/rss/ir.xml | Fortinet product security advisories | Match the affected releases to your inventory. |
Set up a small, maintainable reader
- List your exposed products. Start with internet-facing devices, identity services, operating systems and software your team maintains. A short relevant list is easier to review.
- Import the matching subscriptions. Add an RSS URL above using your reader's “Add feed” option. For a ready-made folder, import the operating-system OPMLor firewall OPML. The full OPML catalogueincludes broader news and research; it is a subscription list, not an article archive.
- Keep direct and aggregated feeds in separate folders. Direct subscriptions are retrieved by your reader from each publisher. ThreatFilter's merged feed adds its own ingestion, retrieval bounds and keyword matching. Subscribing to both can produce duplicate coverage.
- Review a real entry. Open its original advisory, confirm the product and affected versions, and check that the fix or mitigation applies to your environment.
Prefer a single filtered RSS feed?
Select vendors in the ThreatFilter advisory feed, choose a timeframe and copy “RSS feed (filtered)”. For example, this URL combines Microsoft and Cisco matches over 7 days:
https://threatfilter.dev/feed.xml?v=microsoft,cisco&tf=7d
The merged feed contains up to 60 matching entries from a bounded retrieval window. Timeframes use when ThreatFilter first received a record, which can differ from the publisher's date. A longer timeframe does not guarantee complete historical coverage. Vendor tags are keyword matches and may miss an entry or include an unrelated one. This is an advisory stream, not a CVE-only feed. Supported options are in the RSS parameter reference.
How NVD and CISA KEV differ from RSS
NVD's CVE APIsupplies structured vulnerability records for integrations. Its JSON response cannot be pasted into a normal RSS subscription. Applications must follow NVD's pagination, update-window and request-limit guidance. A CVE record or a high CVSS score alone does not demonstrate active exploitation.
The CISA Known Exploited Vulnerabilities catalogue is a selected set with evidence of exploitation in the wild, available through CISA's published downloads. It is not a complete list of vulnerabilities and its JSON catalogue is not an RSS feed. Absence from KEV is not evidence that a vulnerability is safe.
ThreatFilter's cross-source CVE index is a third, narrower view: a page appears once at least three distinct tracked sources report the same CVE. Several publishers can repeat one upstream announcement, so distinct coverage does not establish independent technical verification.
Turn an alert into a triage decision
For each relevant advisory, record the affected asset and version, whether it is exposed, the source's exploitation evidence, the proposed fix and the person responsible for follow-up. Keep severity, exploitation and relevance separate: a severe vulnerability in software you do not run is different from an exploited flaw on an exposed system you operate.
Use the original vendor advisory for remediation instructions. If a report includes indicators, the IOC aggregator and ATT&CK group profilercan help you investigate related context. A malware-family association or an IOC match is a lead; validate it before changing detections or blocking traffic.
Missing entries, duplicates or an empty feed?
- The reader says “not a feed”.
- Confirm that you copied the RSS or Atom URL, not a JSON API, an HTML directory page or the OPML import file. OPML belongs in the reader's import function.
- A publisher has an advisory that ThreatFilter does not show.
- Check thecoverage and source-status snapshot, your selected vendors and the retrieval window. A recent polling attempt does not guarantee a complete fetch. A publisher can also update an existing entry without creating a new item.
- The same CVE appears several times.
- Different publishers, revised advisories and overlapping direct/merged subscriptions can cover the same CVE. Compare the original URLs and versions before treating the entries as separate incidents.
- The filtered feed is empty or temporarily unavailable.
- An empty successful response can mean no matches in the retrieved window. Try a broader selection. A temporary server failure returns an error so readers can preserve their previous entries; retry later rather than deleting the subscription.