KEV and CVE alerts with verdicts

DomainGuard ingests the CISA Known Exploited Vulnerabilities catalogue and the NVD CVE feed every hour and matches them against every account's observed software and watchlist. The matching is not plan-gated; on Free the inventory only advances when you scan by hand.

Where

Web: Security, Alerts; the advisory page for each entry.
iOS: a domain's Vulnerabilities module, Alerts segment. Three buckets across the account: Affects you (confirmed on your domains), Watching (software on your watchlist no scan has seen running), News (the public feed, which carries no verdict about you and says so).
API/MCP: GET /api/vulnapps/alerts, /alerts/summary, PATCH /api/vulnapps/alerts/:id, GET /api/vulnapps/feed, GET /api/vulnapps/history; tools list_software_alerts, get_software_alert_summary, update_software_alert, get_vulnerability_feed, get_software_advisory_history.

The feeds

KEV is fetched with a conditional request so an unchanged catalogue costs nothing. NVD is pulled as a modified-since delta and self-throttled to every two hours. Both are stored in full so the advisory pages and the News feed can show the whole catalogue, whatever your account tracks.

Watch-forward

An entry the feed presented before a watch existed is catalogue data, not an alert. When a watch is created its baseline is recorded, and only entries the feed adds afterwards raise alerts: KEV by the date it was added, NVD by last-modified. Without this, a new watchlist matched against the whole KEV history produced roughly 1,800 years-old alerts at once. The baseline is written once; deleting and re-adding a watch re-baselines it. At most 200 new alerts are raised per ingest as a subrequest guard.

The four verdicts

Every alert carries an exposure verdict derived from the account's own scan evidence:

Verdict	Meaning
Confirmed	A scan cited this CVE, or the affected product was observed at a version inside the affected range
Possible	The product is observed running but its version is unknown, or the version could not be compared
Not affected	The product is observed and every observed version is outside the affected range. The only verdict that claims safety, and only issued on evidence
Unconfirmed	No scan on this account has ever observed the product. "We have not looked", not "you are safe"

Only a KEV entry confirmed on your own domain gets the red treatment. Advisories still being compared are never shown as findings.

The advisory page

The score tile and the "exploited in the wild" badge lead; CISA's deadline says how many days you have; "Does this affect you?" gives the verdict with the evidence behind it; the fix is numbered steps taken from what CISA or the vendor published; and a note says nothing is marked fixed until the next scan re-checks it. Mark as fixed is on every advisory; Monitor adds the product to the watchlist so the next advisory against it alerts.

Alert status

update_software_alert sets an alert to remediated (the fix was applied) or dismissed (it will not be). Dismissals with a reason are covered in Findings and dismissals.

The global feed

News is one searchable column of every KEV and NVD entry held: the whole KEV catalogue plus sixty days of NVD. Search by CVE, product or vendor; filter to actively exploited or by severity. Its ON YOUR STACK / WATCHING / NOT SEEN tags are name matches and carry no verdict.

Common questions

I got no alert for a CVE published last year. It predates your watch. Open the product's advisory history to see everything ever published against it.

Why is a critical CVE "possible" rather than "confirmed"? Your site did not expose the version. Check it on the server and mark the alert accordingly, or run a Standard scan, which reads more version sources.