> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Threat Feed

> The most urgent CVEs right now, and whether they affect you.

The Threat Feed lists the CVEs that need attention now: how urgent each one is, how far exploitation has gone, and how to fix it. Click **Check if we're vulnerable** to check a CVE against your environment.

![The Threat Feed with CVE cards and Check if we're vulnerable buttons](https://mintcdn.com/enclave/bhnFMg4ldiTYrwZX/images/product/threat-feed.png?fit=max\&auto=format\&n=bhnFMg4ldiTYrwZX\&q=85\&s=c793843c7d3c82e8867566cca20757a8)

## What's in the feed

The feed shows the 100 most urgent CVEs and refreshes every five minutes. Enclave ranks them by:

* **Exploited:** confirmed by CISA or the EU Vulnerability Database, or seen by honeypots in the last 30 days.
* **Breaking:** new, critical, and reachable over the network without credentials.
* **Trending:** discussed this week in security news, social media, Hacker News, and GitHub.

The feed is the same for everyone and never includes your data.

## Read a card

Each card shows the affected product, a summary, the fixed version, and a timeline.

| Urgency | Meaning |
| - | - |
| **Act today** | Exploited, reachable without a login, and new in the last 7 days |
| **This week** | Exploited but older or behind a login, or critical with no attacks yet |
| **Watching** | Everything else |

| Exploitation | Meaning |
| - | - |
| **In the wild** | Exploitation is confirmed |
| **Reported** | Reported, but not confirmed |
| **Public** | Exploit code is public |
| **None known** | No known exploit |

Cards can also show **Ransomware**, **New**, and the US federal patch deadline when CISA lists the CVE as exploited.

Click a CVE's title to open its page with the full timeline, affected versions, fix, and sources.

## Search and filter

Search by CVE ID or product, or filter by time. Search covers every CVE in the latest refresh, not just the 100 shown. To link to one CVE, use `/threat-feed?cve=<CVE-ID>`.

## Check if we're vulnerable

Click **Check if we're vulnerable** on a card or CVE page. Enclave opens a [Research session](https://docs.enclave.ai/research/sessions.md) and:

1. Works out where the affected software could run.
2. Tells you what it can and can't see, and offers to connect what's missing.
3. Checks your repositories, organization graph, cloud accounts, and servers in parallel.
4. Answers with a verdict: **Affected**, **Not found in what I checked**, **Not affected**, or **Can't tell yet**, plus what to fix first.

The check is read-only. Places Enclave couldn't check are reported as unknown, never as safe.

## Share the feed

The Threat Feed and CVE pages are public. Click the link icon on a card to copy its link. Visitors who click **Check if we're vulnerable** sign up first, and the check starts when they're done.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.