CISA's KEV catalogue has no RSS feed, so here is one (and which npm, PyPI and Maven packages are on it)

Description and use

CISA KEV catalog lacks an RSS feed and lists vendors, so the author built two Atom feeds, a JSON join mapping CVEs to npm, PyPI, and Maven packages, and a lockfile scanner with a GitHub Action for CI.

Problem

CISA’s KEV catalogue lacks a feed and references vendors instead of package names, making it hard to monitor vulnerable packages in lockfiles.

Outcome

Developers can now subscribe to KEV updates via RSS, query vulnerable packages in JSON, and automatically fail CI when a dependency is on the KEV list.

Workflow

• 1. Build Atom feeds: https://crawatch.dev/kev/all.xml and https://crawatch.dev/kev/feed.xml
• 2. Create JSON join at https://crawatch.dev/kev/packages.json
• 3. Use Cloudflare Worker to hourly fetch new KEV entries and daily re‑read older ones via OSV.dev API
• 4. Provide scan endpoint https://crawatch.dev/scan for lockfiles and GitHub Action that fails on vulnerable dependencies

Evidence

CISA publishes the catalogue as a JSON file and a CSV file. Fine for scripts, but nothing a feed reader, Slack's RSS app or an RSS-to-email service can subscribe to.

Source

It names vendors, not packages. An entry says "Vite Vitejs Improper Access Control". Your lockfile says vite 4.5.0. Joining the two means looking every CVE up in an advisory database.

Source

Every new KEV entry, all vendors: https://crawatch.dev/kev/all.xml (the newest 100, updated within the hour of CISA publishing)

Source

Only the entries that name an open-source package (npm, PyPI, Maven, Go, Composer, NuGet, RubyGems): https://crawatch.dev/kev/feed.xml

Source

https://crawatch.dev/kev/packages.json has, for each entry, the CVE, CISA's dates and ransomware flag, the GitHub advisory, and every package it names with the affected range and the fixed versions. CORS is open.

Source

A Cloudflare Worker does this every hour for new entries and re-reads three older ones a day, so ranges stay current when an advisory gains a new fixed version.

Source

If you would rather check than read: paste a lockfile at https://crawatch.dev/scan (19 formats, no account), run npx crawatch package-lock.json, or add the GitHub Action, which fails a build when a dependency is on the list.

Source