Skip to main content
The Threat Feed lists the CVEs that need attention now: how urgent each one is, how far exploitation has gone, and how to fix it. Click Check if we’re vulnerable to check a CVE against your environment.
The Threat Feed with CVE cards and Check if we're vulnerable buttons

​
What’s in the feed

The feed shows the 100 most urgent CVEs and refreshes every five minutes. Enclave ranks them by:
  • Exploited: confirmed by CISA or the EU Vulnerability Database, or seen by honeypots in the last 30 days.
  • Breaking: new, critical, and reachable over the network without credentials.
  • Trending: discussed this week in security news, social media, Hacker News, and GitHub.
The feed is the same for everyone and never includes your data.

​
Read a card

Each card shows the affected product, a summary, the fixed version, and a timeline. Cards can also show Ransomware, New, and the US federal patch deadline when CISA lists the CVE as exploited. Click a CVE’s title to open its page with the full timeline, affected versions, fix, and sources.

​
Search and filter

Search by CVE ID or product, or filter by time. Search covers every CVE in the latest refresh, not just the 100 shown. To link to one CVE, use /threat-feed?cve=<CVE-ID>.

​
Check if we’re vulnerable

Click Check if we’re vulnerable on a card or CVE page. Enclave opens a Research session and:
  1. Works out where the affected software could run.
  2. Tells you what it can and can’t see, and offers to connect what’s missing.
  3. Checks your repositories, organization graph, cloud accounts, and servers in parallel.
  4. Answers with a verdict: Affected, Not found in what I checked, Not affected, or Can’t tell yet, plus what to fix first.
The check is read-only. Places Enclave couldn’t check are reported as unknown, never as safe.

​
Share the feed

The Threat Feed and CVE pages are public. Click the link icon on a card to copy its link. Visitors who click Check if we’re vulnerable sign up first, and the check starts when they’re done.