13 advisories, 0 reporting triggers: severity is not exploitation under the EU CRA

Description and use

Teams often misinterpret all critical CVE findings from scanners as CRA reporting triggers. In reality, only KEV‑listed vulnerabilities require notification. Using cra‑watch to intersect advisories with KEV and scheduling regular runs helps identify the true reporting list and avoid over‑reporting.

Problem

Teams misinterpret vulnerability scanner output as the trigger for EU Cyber Resilience Act (CRA) reporting, leading to over‑reporting and wasted effort.

Outcome

By intersecting advisories with KEV and scheduling the check, teams can focus on a short list of true reporting triggers, avoid over‑reporting, and comply with CRA requirements efficiently.

Workflow

• Run a dependency scan to list all components with advisories.
• Intersect the advisory list with the KEV catalogue to identify actively exploited vulnerabilities.
• Schedule the intersection run regularly (e.g., CI pipeline) rather than on push.
• Define a clear decision owner for reporting before the 24‑hour clock starts.
• Document the decision and its timing for audit purposes.

Evidence

Thirteen components with published advisories. Zero on the known‑exploited list.

Source

One component. Two known‑exploited CVEs. That's the one that deserves a human in the room.

Source