There are tens of thousands of CVEs. You will never patch all of them, and you shouldn’t try. The number that actually matters is much smaller: the ones being exploited in the wild right now. CISA tracks exactly that in its Known Exploited Vulnerabilities (KEV) catalog — and the gap between “a bug exists” and “a bug is on KEV” is the difference between theoretical risk and someone-is-in-your-network.

The Progress Kemp LoadMaster case this month is the perfect illustration: CVE-2026-8037 racked up 792 exploit attempts and two full months of public warning before it landed on KEV. Everyone who was watching KEV had a clear signal to prioritize it. Everyone who wasn’t found out the hard way. Meanwhile CISA gave agencies just three days to patch a CVSS 10 SD-WAN bug when it hit the catalog.

You can have that same early-warning signal, for free, on your own gear. This tutorial builds a personal KEV watchlist: a script that knows what software you run and pings you the moment any of it shows up as actively exploited.

The Idea in One Sentence

CISA publishes the whole KEV catalog as a public JSON feed. You maintain a small list of the products you actually run. A script downloads the feed, matches it against your list, and shouts if there’s a hit. That’s it — and it’s dramatically more useful than a generic vulnerability scanner screaming about 4,000 low-severity findings.

Step 1: Build Your Inventory

You can’t match against your software if you don’t know what you run. Make a plain-text inventory of your internet-facing and important gear. If you did the attack-surface audit already, you have most of this from your nmap output.

Create inventory.txt — one keyword per line, matching vendor or product names as they’d appear in a CVE:

fortinet
fortios
cisco
kemp
loadmaster
n-able
n-central
windchill
wordpress
openssh
citrix
ivanti
vmware

Keep it to what you actually run. The whole point is signal, not noise — a match should mean “this is about me.”

Step 2: The Watchlist Script

Here’s a self-contained Python script. It pulls the KEV feed, matches it against your inventory, and reports hits — newest first, with the exact “patch by” due date CISA assigned.

#!/usr/bin/env python3
"""kev-watch.py — match CISA KEV against your own software inventory."""
import json, sys, urllib.request
from pathlib import Path

KEV_URL = ("https://www.cisa.gov/sites/default/files/feeds/"
           "known_exploited_vulnerabilities.json")

def load_inventory(path="inventory.txt"):
    terms = [l.strip().lower() for l in Path(path).read_text().splitlines()
             if l.strip() and not l.startswith("#")]
    return terms

def fetch_kev():
    with urllib.request.urlopen(KEV_URL, timeout=30) as r:
        return json.load(r)["vulnerabilities"]

def match(kev, terms):
    hits = []
    for v in kev:
        haystack = f"{v['vendorProject']} {v['product']} {v['vulnerabilityName']}".lower()
        if any(t in haystack for t in terms):
            hits.append(v)
    # Newest additions first
    hits.sort(key=lambda v: v.get("dateAdded", ""), reverse=True)
    return hits

def main():
    terms = load_inventory()
    hits = match(fetch_kev(), terms)
    if not hits:
        print("✅ No KEV entries match your inventory right now.")
        return
    print(f"⚠️  {len(hits)} actively-exploited CVE(s) match your inventory:\n")
    for v in hits:
        print(f"  {v['cveID']}  [{v['dateAdded']}]  {v['vendorProject']} {v['product']}")
        print(f"      {v['vulnerabilityName']}")
        print(f"      PATCH BY: {v.get('dueDate','?')}  |  Action: {v.get('requiredAction','')[:80]}")
        print()
    sys.exit(1)   # non-zero exit = 'something needs attention', handy for automation

if __name__ == "__main__":
    main()

Run it:

python3 kev-watch.py

If you run anything on your list that’s being exploited, you get the CVE, the date CISA confirmed exploitation, the deadline they set for federal agencies (a great proxy for “how urgent is this”), and the required action. No account, no API key, no cost.

Step 3: Automate It (Set-and-Forget)

A watchlist you have to remember to run isn’t a watchlist. Schedule it to run daily and email you only when there’s a hit. On Linux/macOS, a cron job:

# Edit your crontab
crontab -e

# Run every morning at 8am; email output only if there are matches (non-zero exit)
0 8 * * * cd /home/you/kev && python3 kev-watch.py 2>&1 | mail -s "KEV ALERT" you@example.com

Prefer a push notification? Pipe the output to an ntfy.sh topic or a Slack/Discord webhook instead of email:

0 8 * * * cd /home/you/kev && out=$(python3 kev-watch.py) || \
  curl -s -d "$out" ntfy.sh/your-private-kev-topic

Now you get a phone buzz the day something you run becomes actively exploited — the same signal CISA acts on, delivered to your pocket.

Step 4: Turn a Hit Into Action

When the script fires, you have a decision tree, not a panic:

  1. Confirm you’re actually affected. Match the version — not every version of a product is vulnerable. Check the CVE details and the vendor advisory.
  2. Patch if a fix exists. KEV entries usually mean a patch is available. Apply it, prioritizing anything internet-facing first.
  3. Mitigate if there’s no patch yet. Sometimes (like the Minnesota water controllers) there’s no fix. Then you reduce exposure: take it off the internet, restrict access, add a WAF rule, disable the vulnerable feature.
  4. Verify. Re-scan or re-check the version after patching. Don’t trust that the update applied — confirm it.

Why This Beats a Generic Scanner

Full vulnerability scanners have their place, but for an individual or a small shop they mostly generate overwhelm: thousands of findings, most of them theoretical, no clear “do this first.” A KEV watchlist inverts that. Every alert means a real attacker is really using this against real targets right now. That’s the highest-signal patching prioritization that exists, and it’s the exact data source CISA itself uses to set mandatory federal deadlines. You’re not guessing what matters — you’re following the ground truth.

The Bottom Line

Kemp LoadMaster gave defenders two months and 792 exploit attempts of warning before it hit KEV, and plenty of people still got caught because nobody was watching the one feed that mattered. Patching everything is impossible; patching what’s actively exploited is a solved problem. Fifty lines of Python and a cron job put you on the same early-warning system the government runs on — and turn “I hope I’m not running anything vulnerable” into a signal that reaches your phone the morning it stops being hypothetical.

See how long the Kemp LoadMaster bug was exploited before it hit the catalog on breached.company: 792 Exploit Attempts and Two Months of Warning.