CVE feeds for the vendors you actually use.

Composable RSS and JSON feeds, merged from four official sources, de-duplicated and filtered by CVSS severity. Free, with no sign-up and no authentication.

Build your feed Read the API reference →

Responses are cached for one hour. Each CVE links to its entry in the National Vulnerability Database.

A feed URL

https://cve.assurestart.co/api/feed.xml?term=slack,jira,salesforce&cvss_min=9

[CRITICAL 9.4] CVE-2026-2298
[HIGH 8.2] CVE-2025-52454
[CRITICAL 9.8] CVE-2026-22582
[CRITICAL 9.8] CVE-2026-22583

One feed from four official sources

Give a list of vendor or product names and get back one merged, de-duplicated feed of matching CVEs, newest first: as RSS 2.0 for any feed reader, or as JSON for a SIEM, ticketing system or monitoring pipeline.

NVDThe National Vulnerability Database: CVSS scores, weaknesses and affected product ranges.CVE List v5The authoritative CVE catalogue from the CVE Program.CISA KEVKnown Exploited Vulnerabilities: confirmed exploitation in the wild.CISA VulnrichmentEnrichment with CVSS, CPE and CWE before NVD processes an entry.

Built and run by Assure Start as a free resource for the GRC and security community. Data comes straight from these sources, with no third-party intermediary.

Quick start

Copy a URL into your feed reader, browser or HTTP client.

Critical CVEs across your SaaS stack, as RSS to subscribe to anywhere.

https://cve.assurestart.co/api/feed.xml?term=slack,jira,salesforce&cvss_min=9

High and critical Microsoft and Atlassian CVEs, as JSON to ingest into a SIEM or ticketing pipeline.

https://cve.assurestart.co/api?term=microsoft,atlassian&cvss_min=7&limit=50

Recent CVEs

Live from the feed: high and critical CVEs for confluence, jira and salesforce.

Severity	CVE	Description	Score	Published
Critical	CVE-2026-2298	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud…	9.4	23 Mar 2026
High	CVE-2025-52454	Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules)…	8.2	25 Jul 2025
Critical	CVE-2026-22582	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud…	9.8	24 Jan 2026
Critical	CVE-2026-22583	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud…	9.8	24 Jan 2026
Critical	CVE-2026-22585	Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a…	9.8	24 Jan 2026

Showing 5 of 26 results.

Open this feed →

Build your feed

Enter your vendors and options to get a feed URL you can use straight away.

Your feed URL

Enter at least one vendor or product above.

API reference

Both endpoints take the same parameters and return the same results; only the format differs. The OpenAPI 3.1 spec is at cve.assurestart.co.

Endpoint	Response	Use for
`GET /api/feed.xml`	RSS 2.0	Feed readers
`GET /api`	JSON	SIEM, ticketing and pipelines

Parameter	Required	Default	Description
`term`	Yes	None	Comma-separated vendor or product names: 1 to 10 terms, each 2 to 64 characters. Terms are normalised to lowercase ASCII, so `Slack` and `slack` are the same term.
`cvss_min`	No	`0`	Inclusive CVSS floor, 0 to 10, using the highest available version for each CVE (v4.0, then v3.1, v3.0, v2.0). Use `7` for high and critical, `9` for critical only.
`limit`	No	`50`	Maximum results after de-duplication and sorting by recency, 1 to 100.

Up to 10 terms per request. More than that returns 422: “You can subscribe to as many feeds as you want, but you need to use a new request per 10 vendors/products.” Check meta.unmatched_terms and meta.ambiguous_terms in the JSON response to see how your terms resolved before you subscribe to the RSS URL.

The response

JSON has three top-level keys: meta, matches and data. RSS carries the same CVEs, with score and severity in each item title and severity and vendor categories for filtering.

meta.unmatched_terms: Terms that matched no CVE target. Check the spelling or try a more specific name.
meta.ambiguous_terms: Terms that matched more than one target. The service includes every match rather than guess the wrong one.
matches[].matched[].source: How a term resolved: alias, exact_vendor or fuzzy_vendor. Fuzzy matches are worth a second look.
data[].updated_at: Used as the RSS pubDate when present, so a CVE that gains a CVSS score or enrichment after publication comes back to the top. Falls back to created_at.

Example response, shortened

{
  "meta": {
    "canonical_query": "term=jira%2Cslack&cvss_min=7",
    "canonical_terms": ["jira", "slack"],
    "cache_ttl": 3600,
    "count": 2,
    "limit": 50,
    "unmatched_terms": [],
    "ambiguous_terms": []
  },
  "matches": [
    {
      "input": "jira",
      "normalized": "jira",
      "matched": [{ "type": "product", "vendor": "atlassian",
        "product": "jira", "source": "alias", "confidence": 1 }],
      "ambiguous": false,
      "unmatched": false
    }
  ],
  "data": [
    {
      "cve_id": "CVE-2025-12345",
      "title": "Remote code execution in Jira Data Center",
      "description": "A critical RCE vulnerability in Jira Data Center...",
      "created_at": "2025-03-01T00:00:00+00:00",
      "updated_at": "2025-03-10T12:00:00+00:00",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weaknesses": ["CWE-94"],
      "vendors": ["atlassian"],
      "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12345"
    }
  ]
}

Limits, caching and privacy

Rate limits

30 requests a minute per IP address
Over the limit returns 429: “Too many requests. Please retry later.”
For pipelines, poll at the cache interval of 60 minutes

Caching

Cached for one hour (Cache-Control: public, max-age=3600, with an ETag)
A stale copy is served for up to six hours if the upstream CVE data is unavailable

Usage analytics

Search terms and daily request counts are recorded with a hashed client identifier derived from your IP address and user agent. These statistics are pseudonymous; connection data may also appear in operational or security logs
Analytics are kept for up to 180 days
Details are in our privacy notice

A term not resolving to the right vendor or product? We can add a curated alias.

Get in touch →