Sources
Every feed and database Watch Floor reads, and whether each one is working right now. Status comes from the last run of each source; times are relative, hover for UTC.
Vulnerability databases
- NVD API 2.0OKCVE records, CVSS scores and CPE product data.
- CISA KEVOKKnown-exploited flag and the date CISA added each CVE.
- GitHub Advisories (GHSA)OKPackage advisories, often before NVD; covers OSV lineage.
- CVE.org (CVE Services)OKCVSS backfill for CVEs that have no score yet (NVD is the fallback).
- ENISA EUVDOKEU vulnerability database: EUVD ids, CVE aliases and scores.
- EUVD exploitedOKEU vulnerability database: EUVD ids, CVE aliases and scores.
Exploits & detections
- Nuclei templatesOKPublic exploit-check templates, matched to CVEs.
- Metasploit modulesOKReady-made exploit modules, matched to CVEs.
- Exploit-DBOKPublished exploit write-ups and code, matched to CVEs.
- GitHub PoC searchOKPublic proof-of-concept repositories per CVE.
- VulnCheck XDBSkipped, no keySecond public-PoC index, shown beside Nuclei, Metasploit and Exploit-DB.
- Emerging Threats rulesOKNetwork detection rules that name a CVE.
- Sigma rulesOKLog detection rules that name a CVE.
- YARA rulesOKFile and memory detection rules that name a CVE.
Official advisories
- Zero Day InitiativeOKUpcoming and published ZDI advisories: bugs reported and not yet fixed (the zero-day tracker).
- CCCS (Canada)OKSecurity advisories, attached to the CVEs they name.
- CISAOKSecurity advisories, attached to the CVEs they name.
- CERT/CCOKSecurity advisories, attached to the CVEs they name.
- CERT-EUOKSecurity advisories, attached to the CVEs they name.
- Microsoft MSRCOKMicrosoft security advisories, attached to the CVEs they name.
- Cisco PSIRTOKCisco security advisories, attached to the CVEs they name.
- Fortinet PSIRTOKFortinet security advisories, attached to the CVEs they name.
- Palo Alto NetworksOKPalo Alto Networks security advisories, attached to the CVEs they name.
- oss-securityOKSecurity advisories, attached to the CVEs they name.
- AppleOKApple security advisories, attached to the CVEs they name.
- Chrome ReleasesOKGoogle security advisories, attached to the CVEs they name.
- OracleOKOracle security advisories, attached to the CVEs they name.
- SAPOKSAP security advisories, attached to the CVEs they name.
- Broadcom VMSAOKVMware security advisories, attached to the CVEs they name.
- AtlassianOKAtlassian security advisories, attached to the CVEs they name.
- GitLabOKGitLab security advisories, attached to the CVEs they name.
- OktaOKOkta security advisories, attached to the CVEs they name.
- IvantiOKIvanti security advisories, attached to the CVEs they name.
- Juniper SIRTOKJuniper security advisories, attached to the CVEs they name.
- SonicWall PSIRTOKSonicWall security advisories, attached to the CVEs they name.
- VeeamOKVeeam security advisories, attached to the CVEs they name.
- SynologyOKSynology security advisories, attached to the CVEs they name.
- QNAPOKQNAP security advisories, attached to the CVEs they name.
- AWSOKAmazon security advisories, attached to the CVEs they name.
- Google Kubernetes EngineOKGoogle security advisories, attached to the CVEs they name.
- KubernetesOKKubernetes security advisories, attached to the CVEs they name.
Chatter & news
- Hacker NewsOKBreakout discussion of vulnerabilities (Algolia search).
- MastodonOKResearcher posts on infosec.exchange and security hashtags.
- BlueskyOKResearcher posts from the public AppView.
- RedditOKr/netsec, r/blueteamsec and related security subreddits.
- Shadowserver exposure countsOKPublic "IPs still vulnerable" counts per CVE, read from Shadowserver's Bluesky posts.
- Research blogsOKSecurity research blog posts that name CVEs.
- Security newsOKSecurity news sites that name CVEs.
Threats
- Ransomware leak sitesOKVictim posts by group, sector and country.
- SANS ISC / DShieldOKMost-scanned ports now against a week ago.
- Threat-actor directoryOKNamed actors, aliases and the CVEs tied to them.
- Data breachesOKNewly disclosed breaches with size and industry.
- abuse.ch (ThreatFox, URLhaus, MalwareBazaar)On demandIndicator lookups for signed-in members.
- GreyNoise CommunityOn demandWhether an IP is scanning the internet (IP lookups only).
Outages
- Status pages and internet disruptionOKAWS, Azure, Google Cloud and Workspace, Slack, Statuspage vendors, IODA internet disruptions, carriers and NWS alerts.
- Cloudflare RadarOKRouting hijacks and leaks, outage annotations.
Enrichment
- FIRST EPSSOKProbability that a CVE will be exploited in the next 30 days.
- AttackerKB (Rapid7)Skipped, no keyAttacker value and exploitability ratings.
- OSV and CERT/CC vendor statusOn demandAffected packages with fixed versions, and per-vendor Affected / Not Affected, fetched when a CVE panel is opened.
Machine-readable: /api/sources.