feat(threat-intel): recognize the CISA Known Exploited Vulnerabilities (KEV) catalog - #133

Merged

seonghobae merged 19 commits into

mainfrom

feat/cisa-kev-catalog-ingest

Aug 31, 2026

Commits on Aug 30, 2026

feat(threat-intel): add CISA KEV catalog ingestion adapter
claude
committed
8fd83bc
fix(waf): never content-match CVE threat indicators in scoring
claude
committed
1414f89
fix(shutdown): port SIGTERM/Ctrl-C race fix from PR #132
claude
committed
477b638
docs(research): ground CISA KEV severity policy in EPSS/BOD literature
claude
committed
449bc73
fix(security): don't route request-supplied kev_url into the fetch by default
claude
committed
65d60a9
fix(kev): stop validating kev_url when it won't be used
claude
committed
c2ae3d7
fix(security): remove kev_url from the request contract entirely
claude
committed
1cf1010
fix(kev): decouple KEV catalog fetch from the shared request-URL sink
claude
committed
8915b16
fix(kev): restrict KEV_CATALOG_URL to CISA's own host
claude
committed
3a47ce8
docs(kev): correct stale "internal mirror" language for the new host allowlist
claude
committed
0760e7b
fix: validate CVE ID syntax on KEV import; scope Windows cfg precisely
claude
committed
9494144
Merge origin/main into feat/cisa-kev-catalog-ingest
codex
committed
192ffba
fix(threat-feeds): don't reap indicators still owned by another feed
claude
committed
64dcbfc
fix(kev): fail closed without write creds
codex
committed
e36a198
fix(kev): reject mostly-unparsable catalogs; scope credential source to admin creds
claude
committed
40453f3
fix(kev): remove runtime catalog URL override
codex
committed
b5115dc
fix(kev): preserve operator indicators on feed refresh
codex
committed
3c6eed6
fix(kev): preserve operator-owned threat payloads
codex
committed
8b7954d
fix(threat-feeds): report actual upserted count, not submitted count
claude
committed
c4f4526

Navigation Menu

Uh oh!

feat(threat-intel): recognize the CISA Known Exploited Vulnerabilities (KEV) catalog - #133

feat(threat-intel): recognize the CISA Known Exploited Vulnerabilities (KEV) catalog#133
seonghobae merged 19 commits into
mainfrom
feat/cisa-kev-catalog-ingest

Commits on Aug 30, 2026

feat(threat-intel): add CISA KEV catalog ingestion adapter

fix(waf): never content-match CVE threat indicators in scoring

fix(shutdown): port SIGTERM/Ctrl-C race fix from PR #132

docs(research): ground CISA KEV severity policy in EPSS/BOD literature

fix(security): don't route request-supplied kev_url into the fetch by default

fix(kev): stop validating kev_url when it won't be used

fix(security): remove kev_url from the request contract entirely

fix(kev): decouple KEV catalog fetch from the shared request-URL sink

fix(kev): restrict KEV_CATALOG_URL to CISA's own host

docs(kev): correct stale "internal mirror" language for the new host allowlist

fix: validate CVE ID syntax on KEV import; scope Windows cfg precisely

Merge origin/main into feat/cisa-kev-catalog-ingest

fix(threat-feeds): don't reap indicators still owned by another feed

fix(kev): fail closed without write creds

fix(kev): reject mostly-unparsable catalogs; scope credential source to admin creds

fix(kev): remove runtime catalog URL override

fix(kev): preserve operator indicators on feed refresh

fix(kev): preserve operator-owned threat payloads

fix(threat-feeds): report actual upserted count, not submitted count