Watch feeds · RSS 2.0 and JSON Feed 1.1 · no login
Watch a vendor, a technique, or KEV
Paste a feed URL into any reader, Slack or Teams RSS app, or a SIEM that polls feeds. Each feed carries the newest 50 items: a CVE appears when it is published and again when CISA adds it to KEV. Each item includes KEV status, EPSS and linked ATT&CK techniques. Feeds update with each data build.
Site-wide
- Newest CISA KEV additions50 most recent additions, with EPSS, ransomware use and ATT&CK contexthttps://patchfirst.co/feed/kev.xml
Vendors
288 vendors with a KEV listing or at least 25 CVEs288 feeds
ATT&CK techniques
178 techniques with at least one linked CVE- T1190 Exploit Public-Facing Application888 CVEs · 799 in KEVhttps://patchfirst.co/feed/technique/T1190.xml
- T1059 Command and Scripting Interpreter820 CVEs · 736 in KEVhttps://patchfirst.co/feed/technique/T1059.xml
- T1068 Exploitation for Privilege Escalation411 CVEs · 357 in KEVhttps://patchfirst.co/feed/technique/T1068.xml
- T1499.004 Application or System Exploitation146 CVEs · 84 in KEVhttps://patchfirst.co/feed/technique/T1499.004.xml
- T1203 Exploitation for Client Execution123 CVEs · 110 in KEVhttps://patchfirst.co/feed/technique/T1203.xml
- T1548 Abuse Elevation Control Mechanism29 CVEs · 27 in KEVhttps://patchfirst.co/feed/technique/T1548.xml
- T1565.001 Stored Data Manipulation28 CVEs · 14 in KEVhttps://patchfirst.co/feed/technique/T1565.001.xml
- T1210 Exploitation of Remote Services21 CVEs · 21 in KEVhttps://patchfirst.co/feed/technique/T1210.xml
- T1543 Create or Modify System Process11 CVEs · 11 in KEVhttps://patchfirst.co/feed/technique/T1543.xml
- T1553.005 Mark-of-the-Web Bypass11 CVEs · 11 in KEVhttps://patchfirst.co/feed/technique/T1553.005.xml
- T1195.002 Compromise Software Supply Chain10 CVEs · 10 in KEVhttps://patchfirst.co/feed/technique/T1195.002.xml
- T1555 Credentials from Password Stores10 CVEs · 10 in KEVhttps://patchfirst.co/feed/technique/T1555.xml
- T1566.001 Spearphishing Attachment9 CVEs · 8 in KEVhttps://patchfirst.co/feed/technique/T1566.001.xml
- T1563 Remote Service Session Hijacking7 CVEs · 0 in KEVhttps://patchfirst.co/feed/technique/T1563.xml
- T1027 Obfuscated Files or Information5 CVEs · 5 in KEVhttps://patchfirst.co/feed/technique/T1027.xml
- T1091 Replication Through Removable Media5 CVEs · 2 in KEVhttps://patchfirst.co/feed/technique/T1091.xml
- T1212 Exploitation for Credential Access5 CVEs · 5 in KEVhttps://patchfirst.co/feed/technique/T1212.xml
- T1011 Exfiltration Over Other Network Medium4 CVEs · 4 in KEVhttps://patchfirst.co/feed/technique/T1011.xml
- T1048 Exfiltration Over Alternative Protocol4 CVEs · 4 in KEVhttps://patchfirst.co/feed/technique/T1048.xml
- T1213 Data from Information Repositories4 CVEs · 3 in KEVhttps://patchfirst.co/feed/technique/T1213.xml
- T1558 Steal or Forge Kerberos Tickets4 CVEs · 4 in KEVhttps://patchfirst.co/feed/technique/T1558.xml
- T1565.002 Transmitted Data Manipulation4 CVEs · 1 in KEVhttps://patchfirst.co/feed/technique/T1565.002.xml
- T1037 Boot or Logon Initialization Scripts3 CVEs · 3 in KEVhttps://patchfirst.co/feed/technique/T1037.xml
- T1499.002 Service Exhaustion Flood3 CVEs · 2 in KEVhttps://patchfirst.co/feed/technique/T1499.002.xml
- T1003.008 /etc/passwd and /etc/shadow2 CVEs · 1 in KEVhttps://patchfirst.co/feed/technique/T1003.008.xml
- T1047 Windows Management Instrumentation2 CVEs · 2 in KEVhttps://patchfirst.co/feed/technique/T1047.xml
- T1055.001 Dynamic-link Library Injection2 CVEs · 1 in KEVhttps://patchfirst.co/feed/technique/T1055.001.xml
- T1140 Deobfuscate/Decode Files or Information2 CVEs · 2 in KEVhttps://patchfirst.co/feed/technique/T1140.xml
- T1550 Use Alternate Authentication Material2 CVEs · 2 in KEVhttps://patchfirst.co/feed/technique/T1550.xml
- T1574.008 Path Interception by Search Order Hijacking2 CVEs · 1 in KEVhttps://patchfirst.co/feed/technique/T1574.008.xml
- T1016 System Network Configuration Discovery1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1016.xml
- T1036.005 Match Legitimate Resource Name or Location1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1036.005.xml
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1048.003.xml
- T1049 System Network Connections Discovery1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1049.xml
- T1222 File and Directory Permissions Modification1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1222.xml
- T1484.001 Group Policy Modification1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1484.001.xml
- T1547 Boot or Logon Autostart Execution1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1547.xml
- T1547.001 Registry Run Keys / Startup Folder1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1547.001.xml
- T1548.002 Bypass User Account Control1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1548.002.xml
- T1550.001 Application Access Token1 CVE · 0 in KEVhttps://patchfirst.co/feed/technique/T1550.001.xml
- T1552.006 Group Policy Preferences1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1552.006.xml
- T1589 Gather Victim Identity Information1 CVE · 0 in KEVhttps://patchfirst.co/feed/technique/T1589.xml
- T1590 Gather Victim Network Information1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1590.xml
- T1598.002 Spearphishing Attachment1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1598.002.xml
- T1602 Data from Configuration Repository1 CVE · 1 in KEVhttps://patchfirst.co/feed/technique/T1602.xml
178 feeds
Formats
RSS items have a [KEV] title prefix when the event is a KEV listing, a plain-text description with the context, and categories for kev, ransomware, public-exploit and each technique id. JSON Feed items add a _patchfirst object with priority, KEV, EPSS, CVSS and technique ids. Item ids are stable, so a CVE that is later added to KEV arrives as a new item (CVE-…#kev).