{"vulnerability": "cve-2023-0001", "sightings": [{"uuid": "2ba7914a-dc75-4181-bce8-9e86e7e904ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0001", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3lnhuyhhw2u2a", "content": "", "creation_timestamp": "2025-04-23T09:29:28.629775Z"}, {"uuid": "1bc982d8-afc0-4891-91e7-f4da08b0249b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0001", "type": "seen", "source": "https://gist.github.com/Darkcrai86/aeef21f10ed3a9dfa9729e3990c5c028", "content": "", "creation_timestamp": "2025-09-01T09:10:11.000000Z"}, {"uuid": "0aeffc06-7983-4121-a0ff-3b8e752c86b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0001", "type": "seen", "source": "https://t.me/cibsecurity/57783", "content": "\u203c CVE-2023-0001 \u203c\n\nAn information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-08T20:25:09.000000Z"}, {"uuid": "a39dbeec-7723-4265-8cd0-dad795e5a3f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0001", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/9394dfd700a09b5321dc96df1915e8fc", "content": "diff --git a/README.md b/README.md\nindex 57102d1..bd53909 100644\n--- a/README.md\n+++ b/README.md\n@@ -93,6 +93,10 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - CISA(Cybersecurity & Infrastructure Security Agency)\n   - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n \n+- Known Exploited Vulnerability reporting\n+  - Configure go-kev with the placeholder-only example in [docs/examples/kev-config.toml.example](docs/examples/kev-config.toml.example)\n+  - Review a sample scan result with first-class `kevs` data in [docs/examples/kev-scan-result.json](docs/examples/kev-scan-result.json)\n+\n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\n \ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..50bf2f7 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,9 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n \t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\t\tv.KEVs = append(v.KEVs, convertKEVulnsToModels(kevulns)...)\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +99,7 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n+\t\t\tvuln.KEVs = append(vuln.KEVs, convertKEVulnsToModels(kevulns)...)\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\n@@ -127,6 +109,154 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \treturn nil\n }\n \n+func convertKEVulnsToModels(kevulns []kevulnmodels.KEVuln) (kevs []models.KEV) {\n+\tfor _, kevuln := range kevulns {\n+\t\tb, err := json.Marshal(kevuln)\n+\t\tif err != nil {\n+\t\t\tkevs = append(kevs, models.KEV{Type: models.CISAKEVType})\n+\t\t\tcontinue\n+\t\t}\n+\n+\t\tvar raw map[string]json.RawMessage\n+\t\tif err := json.Unmarshal(b, &raw); err != nil {\n+\t\t\tkevs = append(kevs, models.KEV{Type: models.CISAKEVType})\n+\t\t\tcontinue\n+\t\t}\n+\n+\t\tkev := models.KEV{\n+\t\t\tType:                       kevType(raw),\n+\t\t\tVendorProject:              rawString(raw, \"vendorProject\", \"vendor_project\", \"vendor\"),\n+\t\t\tProduct:                    rawString(raw, \"product\"),\n+\t\t\tVulnerabilityName:          rawString(raw, \"vulnerabilityName\", \"vulnerability_name\", \"name\"),\n+\t\t\tShortDescription:           rawString(raw, \"shortDescription\", \"short_description\", \"description\"),\n+\t\t\tRequiredAction:             rawString(raw, \"requiredAction\", \"required_action\"),\n+\t\t\tKnownRansomwareCampaignUse: rawString(raw, \"knownRansomwareCampaignUse\", \"known_ransomware_campaign_use\"),\n+\t\t\tDateAdded:                  rawTime(raw, \"dateAdded\", \"date_added\"),\n+\t\t\tDueDate:                    rawTimePtr(raw, \"dueDate\", \"due_date\"),\n+\t\t}\n+\n+\t\tif note := rawString(raw, \"note\"); note != \"\" || kev.Type == models.CISAKEVType {\n+\t\t\tkev.CISA = &models.CISAKEV{Note: note}\n+\t\t}\n+\t\tif vulncheck := rawVulnCheckKEV(raw); vulncheck != nil {\n+\t\t\tkev.Type = models.VulnCheckKEVType\n+\t\t\tkev.VulnCheck = vulncheck\n+\t\t\tkev.CISA = nil\n+\t\t}\n+\t\tkevs = append(kevs, kev)\n+\t}\n+\treturn kevs\n+}\n+\n+func kevType(raw map[string]json.RawMessage) models.KEVType {\n+\tswitch rawString(raw, \"type\", \"source\") {\n+\tcase string(models.VulnCheckKEVType):\n+\t\treturn models.VulnCheckKEVType\n+\tdefault:\n+\t\treturn models.CISAKEVType\n+\t}\n+}\n+\n+func rawString(raw map[string]json.RawMessage, keys ...string) string {\n+\tfor _, key := range keys {\n+\t\tb, ok := raw[key]\n+\t\tif !ok {\n+\t\t\tcontinue\n+\t\t}\n+\t\tvar s string\n+\t\tif err := json.Unmarshal(b, &s); err == nil {\n+\t\t\treturn s\n+\t\t}\n+\t}\n+\treturn \"\"\n+}\n+\n+func rawTime(raw map[string]json.RawMessage, keys ...string) time.Time {\n+\tif t := rawTimePtr(raw, keys...); t != nil {\n+\t\treturn *t\n+\t}\n+\treturn time.Time{}\n+}\n+\n+func rawTimePtr(raw map[string]json.RawMessage, keys ...string) *time.Time {\n+\tfor _, key := range keys {\n+\t\tb, ok := raw[key]\n+\t\tif !ok {\n+\t\t\tcontinue\n+\t\t}\n+\t\tvar t time.Time\n+\t\tif err := json.Unmarshal(b, &t); err == nil && !t.IsZero() {\n+\t\t\treturn &t\n+\t\t}\n+\t\tvar s string\n+\t\tif err := json.Unmarshal(b, &s); err != nil || s == \"\" {\n+\t\t\tcontinue\n+\t\t}\n+\t\tfor _, layout := range []string{time.RFC3339, \"2006-01-02\"} {\n+\t\t\tif parsed, err := time.Parse(layout, s); err == nil {\n+\t\t\t\treturn &parsed\n+\t\t\t}\n+\t\t}\n+\t}\n+\treturn nil\n+}\n+\n+func rawVulnCheckKEV(raw map[string]json.RawMessage) *models.VulnCheckKEV {\n+\tvulncheck := models.VulnCheckKEV{\n+\t\tXDB:                  rawVulnCheckXDB(raw, \"xdb\", \"xDB\", \"xDBs\", \"xdbs\"),\n+\t\tReportedExploitation: rawVulnCheckReportedExploitation(raw, \"reportedExploitation\", \"reported_exploitation\"),\n+\t}\n+\tif len(vulncheck.XDB) == 0 && len(vulncheck.ReportedExploitation) == 0 {\n+\t\treturn nil\n+\t}\n+\treturn &vulncheck\n+}\n+\n+func rawVulnCheckXDB(raw map[string]json.RawMessage, keys ...string) (xdbs []models.VulnCheckXDB) {\n+\tfor _, key := range keys {\n+\t\tb, ok := raw[key]\n+\t\tif !ok {\n+\t\t\tcontinue\n+\t\t}\n+\t\tvar entries []map[string]json.RawMessage\n+\t\tif err := json.Unmarshal(b, &entries); err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tfor _, entry := range entries {\n+\t\t\txdbs = append(xdbs, models.VulnCheckXDB{\n+\t\t\t\tXDBID:       rawString(entry, \"xdbID\", \"xdb_id\", \"id\"),\n+\t\t\t\tXDBURL:      rawString(entry, \"xdbURL\", \"xdb_url\", \"url\"),\n+\t\t\t\tDateAdded:   rawTime(entry, \"dateAdded\", \"date_added\"),\n+\t\t\t\tExploitType: rawString(entry, \"exploitType\", \"exploit_type\"),\n+\t\t\t\tCloneSSHURL: rawString(entry, \"cloneSSHURL\", \"clone_ssh_url\"),\n+\t\t\t})\n+\t\t}\n+\t\treturn xdbs\n+\t}\n+\treturn nil\n+}\n+\n+func rawVulnCheckReportedExploitation(raw map[string]json.RawMessage, keys ...string) (exploits []models.VulnCheckReportedExploitation) {\n+\tfor _, key := range keys {\n+\t\tb, ok := raw[key]\n+\t\tif !ok {\n+\t\t\tcontinue\n+\t\t}\n+\t\tvar entries []map[string]json.RawMessage\n+\t\tif err := json.Unmarshal(b, &entries); err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tfor _, entry := range entries {\n+\t\t\texploits = append(exploits, models.VulnCheckReportedExploitation{\n+\t\t\t\tURL:       rawString(entry, \"url\"),\n+\t\t\t\tDateAdded: rawTime(entry, \"dateAdded\", \"date_added\"),\n+\t\t\t})\n+\t\t}\n+\t\treturn exploits\n+\t}\n+\treturn nil\n+}\n+\n type kevulnResponse struct {\n \trequest kevulnRequest\n \tjson    string\ndiff --git a/docs/examples/kev-config.toml.example b/docs/examples/kev-config.toml.example\nnew file mode 100644\nindex 0000000..23d08c2\n--- /dev/null\n+++ b/docs/examples/kev-config.toml.example\n@@ -0,0 +1,38 @@\n+# Example Vuls configuration with KEV reporting enabled.\n+# Replace all placeholder values before use.\n+\n+[default]\n+port = \"22\"\n+\n+[servers.web01]\n+host    = \"192.0.2.10\"\n+port    = \"22\"\n+user    = \"scanner-user\"\n+keyPath = \"/home/scanner-user/.ssh/id_rsa\"\n+\n+[servers.db01]\n+host    = \"192.0.2.11\"\n+port    = \"22\"\n+user    = \"scanner-user\"\n+keyPath = \"/home/scanner-user/.ssh/id_rsa\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+sqlite3Path = \"/var/lib/vuls/go-kev.sqlite3\"\n+\n+[email]\n+smtpAddr = \"smtp.example.com\"\n+smtpPort = \"587\"\n+user     = \"vuls-reporter@example.com\"\n+password = \"replace-with-smtp-password\"\n+from     = \"vuls-reporter@example.com\"\n+to       = [\"security-team@example.com\"]\n+\n+[slack]\n+hookURL  = \"https://hooks.slack.com/services/REPLACE/REPLACE/REPLACE\"\n+authUser = \"vuls\"\n+channel  = \"#security-alerts\"\n+\n+[chatWork]\n+apiToken = \"replace-with-chatwork-token\"\n+room     = \"replace-with-room-id\"\ndiff --git a/docs/examples/kev-scan-result.json b/docs/examples/kev-scan-result.json\nnew file mode 100644\nindex 0000000..6c128aa\n--- /dev/null\n+++ b/docs/examples/kev-scan-result.json\n@@ -0,0 +1,68 @@\n+{\n+  \"jsonVersion\": 4,\n+  \"lang\": \"en\",\n+  \"serverName\": \"web01\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-0001\": {\n+      \"cveID\": \"CVE-2023-0001\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"Example Product contains a remote code execution vulnerability.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2026-07-01T00:00:00Z\",\n+          \"dueDate\": \"2026-07-22T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"Example Product contains a remote code execution vulnerability.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"XDB-000001\",\n+                \"xdbURL\": \"https://example.com/xdb/XDB-000001\",\n+                \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:research/example-exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/advisories/CVE-2023-0001\",\n+                \"dateAdded\": \"2026-07-03T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ],\n+      \"affectedPackages\": [\n+        {\n+          \"name\": \"example-package\",\n+          \"fixedIn\": \"1.2.3-1\"\n+        }\n+      ]\n+    }\n+  },\n+  \"packages\": {\n+    \"example-package\": {\n+      \"name\": \"example-package\",\n+      \"version\": \"1.2.2\",\n+      \"release\": \"1\"\n+    }\n+  }\n+}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..f8e4619 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of known exploited vulnerability CVEs.\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -422,6 +430,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.Metasploits, func(i, j int) bool {\n \t\t\treturn v.Metasploits[i].Name < v.Metasploits[j].Name\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \t\tsort.Slice(v.Mitigations, func(i, j int) bool {\n \t\t\treturn v.Mitigations[i].URL < v.Mitigations[j].URL\n \t\t})\n@@ -434,9 +448,6 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n-\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..8d33fb7 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -265,6 +265,7 @@ type VulnInfo struct {\n \tCveContents          CveContents          `json:\"cveContents,omitempty\"`\n \tExploits             []Exploit            `json:\"exploits,omitempty\"`\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n@@ -284,6 +285,57 @@ type Alert struct {\n \tTeam  string `json:\"team,omitempty\"`\n }\n \n+// KEVType identifies the source of a known exploited vulnerability entry.\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is the CISA Known Exploited Vulnerabilities Catalog source.\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is the VulnCheck KEV source.\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerability information.\n+type KEV struct {\n+\tType                       KEVType       `json:\"type,omitempty\"`\n+\tVendorProject              string        `json:\"vendorProject,omitempty\"`\n+\tProduct                    string        `json:\"product,omitempty\"`\n+\tVulnerabilityName          string        `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string        `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string        `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string        `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time     `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time    `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA-specific Known Exploited Vulnerability information.\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck-specific Known Exploited Vulnerability information.\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck exploit database information.\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck reported exploitation information.\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // GitHubSecurityAlerts is a list of GitHubSecurityAlert\n type GitHubSecurityAlerts []GitHubSecurityAlert\n \n@@ -910,24 +962,20 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..a2dfbd0 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-20T22:28:09.434946Z"}]}