Vulnerabilities and exposure
KEV and CVE alerts with verdicts
How the CISA KEV and NVD feeds are ingested, why only new entries alert (watch-forward), the four exposure verdicts, the advisory page, and the global feed.
Updated · 4 min read
DomainGuard reads the CISA Known Exploited Vulnerabilities catalogue and the CVE list every 15 minutes, and the NVD feed (scores and affected version ranges) every two hours, and matches them against every account's observed software and watchlist. The matching is not plan-gated; on Free the inventory only advances when you scan by hand.
Where
- Web: Software, Your software (Needs a look), and an application's page for its open advisories, each with Mark as read, Mark fixed and Dismiss; Software, Advisory feed for the whole CISA KEV and NVD feed. The old App Vulnerabilities page (
/vuln-apps) still opens and points to Software. A domain with a confirmed advisory on any host, subdomains included, also shows a red banner at the top of its page; each host in it opens the advisory. - iOS: Monitoring, Software; under the list, More, Advisories, hosts and network targets, Alerts. Three buckets across the account: Affects you (confirmed on your domains), Watching (software on your watchlist no scan has seen running), News (the public feed, which carries no verdict about you and says so).
- API/MCP:
GET /api/vulnapps/alerts,/alerts/summary,PATCH /api/vulnapps/alerts/:id,GET /api/vulnapps/feed,GET /api/vulnapps/history; toolslist_software_alerts,get_software_alert_summary,update_software_alert,get_vulnerability_feed,get_software_advisory_history.
The feeds
KEV is fetched with a conditional request so an unchanged catalogue costs nothing. NVD is pulled as a modified-since delta and self-throttled to every two hours. Both are stored in full so the advisory pages and the News feed can show the whole catalogue, whatever your account tracks.
Watch-forward
An entry the feed presented before a watch existed is catalogue data, not an alert. When a watch is created its baseline is recorded, and only entries the feed adds afterwards raise alerts: KEV by the date it was added, NVD by last-modified. Without this, a new watchlist matched against the whole KEV history produced roughly 1,800 years-old alerts at once. The baseline is written once; deleting and re-adding a watch re-baselines it. At most 200 new alerts are raised per ingest as a subrequest guard.
The four verdicts
Every alert carries an exposure verdict derived from the account's own scan evidence:
| Verdict | Meaning |
|---|---|
| Confirmed | A scan cited this CVE, or the affected product was observed at a version inside the affected range |
| Possible | The product is observed running but its version is unknown, or the version could not be compared |
| Not affected | The product is observed and every observed version is outside the affected range. The only verdict that claims safety, and only issued on evidence |
| Unconfirmed | No scan on this account has ever observed the product. "We have not looked", not "you are safe" |
Only a KEV entry confirmed on your own domain gets the red treatment. Advisories still being compared are never shown as findings.
The advisory page
The score tile and the "exploited in the wild" badge lead; CISA's deadline says how many days you have; "Does this affect you?" gives the verdict with the evidence behind it; the fix is numbered steps taken from what CISA or the vendor published; and a note says that whichever reason you pick when marking it, the alert is hidden on every future scan and is not re-checked, until you restore it. Mark as fixed is on every advisory; Monitor adds the product to the watchlist so the next advisory against it alerts.
Alert status
update_software_alert (or Mark fixed and Dismiss on the application's page) sets an alert to remediated (the fix was applied) or dismissed (it will not be). A scan that reads a version outside the affected range closes the alert itself and says so with a "Fixed" alert. A fixed alert that a later scan still confirms (evidence dated after the fix) is reopened, because the fix did not take; a possible reading never reopens it. A dismissed alert stays dismissed until you restore it. Dismissals with a reason are covered in Findings and dismissals.
The global feed
News is one searchable column of every KEV and NVD entry held: the whole KEV catalogue plus sixty days of NVD. Search by CVE, product or vendor; filter to actively exploited or by severity. Its ON YOUR STACK / WATCHING / NOT SEEN tags are name matches and carry no verdict.
Common questions
I got no alert for a CVE published last year. It predates your watch. Open the product's advisory history to see everything ever published against it.
Why is a critical CVE "possible" rather than "confirmed"? Your site did not expose the version. Check it on the server and mark the alert accordingly, or run a Standard scan, which reads more version sources.
Keep reading
Related articles
- The alerts feedHow alerts are listed, what Open and Read mean, swipe to Read or Mute 7 d, the alert detail page, and the account History ledger.Alerts ·Updated
- The software watchlistTrack a product so the next KEV or CVE against it alerts you: sources, severity filter, and the split between site software and device software.Vulnerabilities and exposure ·Updated
- Notification settingsEvery alert switch, its default, the plan it needs, and what reads it. Every alert lands in the Alerts feed and is pushed to the iPhone app; there is no alert email.Alerts ·Updated