Is this package affected by a known exploited vulnerability?
Firetruck is an API that checks a package and version against CISA's Known Exploited Vulnerabilities (KEV) list. Call it from a build step the day you find it.
Try it below by uploading a lockfile. It hits the same API you'd put in CI.
Already on GitHub? Add uses: shaps/kev_check@v0 to a workflow and the build fails when a locked dependency is on the KEV list. Works with npm, Go, Python, Rust, Ruby, PHP and Gradle lockfiles, and CycloneDX or SPDX SBOMs. Beta, and it runs without an API key. See the GitHub Action →
Try it
Upload a lockfile to see which of its packages are tied to a CISA Known Exploited Vulnerability.
Supported: package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, go.mod, Pipfile.lock, poetry.lock, uv.lock, Cargo.lock, Gemfile.lock, composer.lock, gradle.lockfile, requirements.txt.
Pulled from CISA's catalog, last synced Nov 2, 2026.
Fresh from the feed
The newest entries in the catalog. This updates on every sync.
Latest KEVs
| CVE ID | Vulnerability | Due date | Added |
|---|---|---|---|
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti / Connect Secure | Due Nov 2, 2026 | 3 days ago |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti / Connect Secure | Due Nov 13, 2026 | 3 days ago |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software | Overdue Nov 1, 2026 | 4 days ago |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability GitLab / Community Edition and Enterprise Edition | Overdue Nov 1, 2026 | 4 days ago |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability Broadcom / VMware ESX | Due Nov 11, 2026 | 5 days ago |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability Linux / Kernel | Overdue Oct 31, 2026 | 5 days ago |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability Google / Brotli | Due Nov 10, 2026 | 6 days ago |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Adobe / Commerce and Magento | Due Nov 10, 2026 | 6 days ago |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability PHP Group / PHP | Overdue Oct 29, 2026 | 7 days ago |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability PHP Group / PHP | Overdue Oct 29, 2026 | 7 days ago |
Latest CVEs
| CVE ID | KEV | Updated |
|---|---|---|
| CVE-2026-14330 | — | 14 minutes ago |
| CVE-2026-71226 | — | 14 minutes ago |
| CVE-2026-33818 | — | 19 minutes ago |
| CVE-2026-42504 | — | 19 minutes ago |
| CVE-2026-78410 | — | 23 minutes ago |
Calling Firetruck from code?
Sign in with your email and create an API key. Send it in the X-API-Key header and your requests get a higher hourly limit than anonymous ones. Add teammates to your organization and each of them can create their own key.
Why I built this
CISA's KEV catalog lists the CVEs being actively exploited, but it has no package or version awareness and nothing you can call from a build step. People cross-reference it against NVD by hand, or buy a full SCA platform and onboard all of it for this one check.
Firetruck answers one question about a package and version: is it on the KEV list? You get yes, no or unverified, with the CVEs when there are any. It is one endpoint with an OpenAPI spec, and there are no seats to buy.
This is early and I'm still working out the final features. I run it against my own repos every day, so if it breaks or goes stale, I'm the first to notice.