{"vulnerability": "cve-2023-1234", "sightings": [{"uuid": "dc912272-27c9-47e6-bd44-62c905b33300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/CarterOgunsola/8ef626effb6fa27887c6b571b9a0962e", "content": "", "creation_timestamp": "2025-01-31T17:51:19.000000Z"}, {"uuid": "7a15c538-0f72-4b89-9abc-6529a38ed966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzbo6toeb25", "content": "", "creation_timestamp": "2025-03-10T09:50:51.731457Z"}, {"uuid": "eab90d23-9219-4665-9caa-d7b94158e715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzbumpdfb2w", "content": "", "creation_timestamp": "2025-03-10T09:54:27.745760Z"}, {"uuid": "c9308f1a-c966-405b-9ee6-deb000140d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzc7et6na23", "content": "", "creation_timestamp": "2025-03-10T10:00:28.702882Z"}, {"uuid": "e6bc3ebe-c23b-4e95-be9b-9d039af796b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzitcdm7g2u", "content": "", "creation_timestamp": "2025-03-10T11:58:59.373058Z"}, {"uuid": "87a0612c-c6d2-432d-b966-6df155edd8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljziyosw722v", "content": "", "creation_timestamp": "2025-03-10T12:02:00.630782Z"}, {"uuid": "2a59b3ed-dcb3-4ffa-a8bc-50fb02670446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzj47wubc24", "content": "", "creation_timestamp": "2025-03-10T12:03:58.857622Z"}, {"uuid": "e1903522-edb6-4b85-829f-129701df2145", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzj6dhtmw2u", "content": "", "creation_timestamp": "2025-03-10T12:05:09.968741Z"}, {"uuid": "ca1671c4-7b31-4d1e-8648-0e093bb7468e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjczj5q423", "content": "", "creation_timestamp": "2025-03-10T12:07:47.058460Z"}, {"uuid": "d6bcb739-183e-4036-86e4-35c67ef7967a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjepvnjk24", "content": "", "creation_timestamp": "2025-03-10T12:08:44.353943Z"}, {"uuid": "210d5743-65af-403a-a5c4-fd17e4bd6373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjgj7nxo23", "content": "", "creation_timestamp": "2025-03-10T12:09:44.087908Z"}, {"uuid": "4f25067f-49fa-4a6b-8012-7a42c7e3f06a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjqgr4xg23", "content": "", "creation_timestamp": "2025-03-10T12:15:17.115333Z"}, {"uuid": "81eec52a-23c9-4376-aadd-d9fbe58ae578", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjsfcwzk2u", "content": "", "creation_timestamp": "2025-03-10T12:16:22.684971Z"}, {"uuid": "257219cd-2c6f-4a4b-99b4-333b05fff539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzjwakumw23", "content": "", "creation_timestamp": "2025-03-10T12:18:32.169151Z"}, {"uuid": "ea4e0dd2-cc46-4985-8656-c663952adc44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzk5q2wey27", "content": "", "creation_timestamp": "2025-03-10T12:22:43.140230Z"}, {"uuid": "b380db9f-5176-44d2-b510-7c3ce0a9f509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzk6vrufa2w", "content": "", "creation_timestamp": "2025-03-10T12:23:22.546675Z"}, {"uuid": "3feefdbe-1cdb-4bf5-908f-435dd6700316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzka2snnn2v", "content": "", "creation_timestamp": "2025-03-10T12:24:01.696108Z"}, {"uuid": "06e72cba-2b8a-4827-a665-08cb7244c31b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzkatfz4w2u", "content": "", "creation_timestamp": "2025-03-10T12:24:27.152176Z"}, {"uuid": "50a9788e-c2c6-47c7-8f9b-05ad4e38acb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzke7idxu2v", "content": "", "creation_timestamp": "2025-03-10T12:26:20.739291Z"}, {"uuid": "ad232c15-c661-4ee6-9fe5-722bd946f1fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzkfweeiw2u", "content": "", "creation_timestamp": "2025-03-10T12:27:18.057247Z"}, {"uuid": "121b0276-983b-49c5-a648-be66e16d1b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzkgmp3532g", "content": "", "creation_timestamp": "2025-03-10T12:27:41.764273Z"}, {"uuid": "6aa8584e-b72d-489a-85b9-8a1fe6978734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzki25drh24", "content": "", "creation_timestamp": "2025-03-10T12:28:29.020790Z"}, {"uuid": "8362a75f-3727-405b-b04d-65bf5014955a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzkkk65j425", "content": "", "creation_timestamp": "2025-03-10T12:29:53.128312Z"}, {"uuid": "3444b0dd-bd31-45c1-9e01-d45760367300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzkl5jp2622", "content": "", "creation_timestamp": "2025-03-10T12:30:13.438989Z"}, {"uuid": "814329c8-99f1-4d96-85b0-7d8a6afc842d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3ljzlhqe7fg2u", "content": "", "creation_timestamp": "2025-03-10T12:46:12.666358Z"}, {"uuid": "08c91d8c-b5b9-4de7-a655-374dddd93dc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/thecodefreaker/25c6d23462ef4dc919e865f57340022e", "content": "", "creation_timestamp": "2025-03-11T14:33:55.000000Z"}, {"uuid": "1d4b024b-34f9-4f2d-94ec-7d88cdcacd01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/mranv/8aebbbe6c455c386cbd3fef9d8647ca6", "content": "", "creation_timestamp": "2025-04-03T17:56:13.000000Z"}, {"uuid": "f47130fa-abb1-4ae5-8eb2-da377cca7b7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/mranv/eb450fd1403beaf6f27170e086effd8f", "content": "", "creation_timestamp": "2025-04-03T17:58:38.000000Z"}, {"uuid": "d1280854-8e8f-4678-9909-22a290f022de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2023-1234", "type": "seen", "source": "https://gist.github.com/metricsigma/f16c006048d6b837299957ddb7e2c25a", "content": "", "creation_timestamp": "2025-06-25T14:02:09.000000Z"}, {"uuid": "e44b618a-8fad-4352-83fb-f984f7ac1326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://bsky.app/profile/technofeed.bsky.social/post/3lmv6gtd2it2l", "content": "", "creation_timestamp": "2025-04-15T22:57:59.526697Z"}, {"uuid": "867d3787-fc1a-4812-9ed3-ff6a05be79be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3lnadaaldwj2o", "content": "", "creation_timestamp": "2025-04-20T09:23:05.495434Z"}, {"uuid": "881bd016-bd46-4c8a-b889-c6390e86de88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/davidccunliffe/d80a4c9b1e55bf84f6baf82e47894b56", "content": "", "creation_timestamp": "2025-07-11T14:21:17.000000Z"}, {"uuid": "876b2dfa-5c94-4ea6-83f7-7492a051d247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/kakashi-1337/11621b3420d533c976c0aa859387ed76", "content": "", "creation_timestamp": "2025-07-03T17:24:26.000000Z"}, {"uuid": "f8b803ac-28f7-4d11-bbb8-d325f5df5219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/Darkcrai86/44b57cdf3977ec1f4947b1fd8b1de293", "content": "", "creation_timestamp": "2025-10-02T06:24:55.000000Z"}, {"uuid": "d09c04b1-38bf-4a4c-b4d5-ef6717fafc3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/Darkcrai86/fa7514adc9fa5c03d7504ee648e80c7f", "content": "", "creation_timestamp": "2025-10-02T06:26:35.000000Z"}, {"uuid": "1b876278-6ff9-4ef4-adcb-b3927b381296", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/williamzujkowski/90a547307bb8d0158bcadc43b86df18f", "content": "", "creation_timestamp": "2025-11-01T15:48:49.000000Z"}, {"uuid": "728c31e1-f522-4927-9b54-b2ce74e5275e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/initcron/3c94c77fe843438fc1070599468c90da", "content": "", "creation_timestamp": "2025-09-22T15:43:58.000000Z"}, {"uuid": "8d146647-3404-4296-afb7-45e042039c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/mjervis-mo/a8bcddf5b94155ee1cdfc53b873a0408", "content": "", "creation_timestamp": "2025-09-09T09:41:23.000000Z"}, {"uuid": "a5bbab81-6a0d-499f-86b5-efd45154abe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/Aggerio/db2962e41b7e25354586e8c7aaa14d72", "content": "", "creation_timestamp": "2025-11-19T09:55:09.000000Z"}, {"uuid": "a971534a-8f25-4bf4-9eed-bfa16e6ec087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/Darkcrai86/78230e4a31f081a8d3439a37246a30a7", "content": "", "creation_timestamp": "2025-08-29T20:02:50.000000Z"}, {"uuid": "ed4fc2b8-30db-4ab3-8958-271df52f4af0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/Darkcrai86/0a24cd07eabab2ffbc0834c5c18d3dd1", "content": "", "creation_timestamp": "2025-09-01T10:08:48.000000Z"}, {"uuid": "0a63d90c-72de-445b-87b6-9cf2443ba047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12347", "type": "seen", "source": "https://gist.github.com/Darkcrai86/0a24cd07eabab2ffbc0834c5c18d3dd1", "content": "", "creation_timestamp": "2025-09-01T10:08:48.000000Z"}, {"uuid": "49aef8d4-1515-4542-9463-be85f57a15f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12346", "type": "seen", "source": "https://gist.github.com/Darkcrai86/0a24cd07eabab2ffbc0834c5c18d3dd1", "content": "", "creation_timestamp": "2025-09-01T10:08:48.000000Z"}, {"uuid": "f751f8d7-0d9e-4fb3-866e-7edecc50b7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/LeeFred3042U/b143c3116270fc09f84a1e0c35d618d5", "content": "", "creation_timestamp": "2026-02-03T15:30:44.000000Z"}, {"uuid": "9661eb8f-35ef-4f42-ae3a-fb596fa0604a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/gal-dahan-wiz/a770c7ef4af0cfe9030251cd58d6bb23", "content": "", "creation_timestamp": "2026-03-06T12:29:52.000000Z"}, {"uuid": "f5fdee22-4228-4430-b0f9-0832f629a715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/gal-dahan-wiz/13c8354a0ad368d7f2c33206cf8c925d", "content": "", "creation_timestamp": "2026-02-26T14:47:40.000000Z"}, {"uuid": "4cb7fdbb-437a-47fd-9deb-1bc860509ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/aw-junaid/819cdb918125f1247863e3da1c6daed1", "content": "", "creation_timestamp": "2026-01-31T10:44:13.000000Z"}, {"uuid": "aab74bc7-87df-4d9f-837a-919ef4852ff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/alamsnatec/d44e75072ddcea188365064c8bbab7bf", "content": "", "creation_timestamp": "2026-02-19T11:33:52.000000Z"}, {"uuid": "9d95f577-21dc-4b3f-86b0-889d9fc19763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/syntaxtrash/2c9d3f33a3badeae95d84895850712e3", "content": "", "creation_timestamp": "2026-01-12T21:32:09.000000Z"}, {"uuid": "d10efb89-395f-46bf-adf2-896f9bd7b7d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-123456", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/3890", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-123456\nURL\uff1ahttps://github.com/emotest1/CVE-2023-123456\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-03-08T07:21:00.000000Z"}, {"uuid": "485ae87e-d39b-430c-83ad-de5cac8e666c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://t.me/q_1xx/4718", "content": "\ud83d\udd0d Shodan: The Search Engine for Internet-Connected Devices  \n*Discover exposed servers, IoT devices, and vulnerabilities worldwide*\n\n\u2728 Top Use Cases  \n- Find vulnerable services  \n- Map network attack surfaces  \n- Research IoT security  \n- Track industrial control systems (ICS)  \n- Monitor honeypots  \n\n\ud83d\udd11 Basic Query Syntax  \nproduct: Search specific software (Apache, Nginx)  \nport: Filter by open ports (80, 443, 22)  \ncountry: Geo-target devices (US, CN, DE)  \nos: Filter by operating system  \nvuln: Find CVE vulnerabilities  \n\n\ud83d\udd25 Powerful Query Examples  \n1. default password  \n   - Devices with default credentials  \n   \n2. port:3389 os:\"Windows\"  \n   - Open Windows RDP ports  \n   \n3. nginx country:US  \n   - Nginx servers in the USA  \n   \n4. ssl:\"Self-signed\" port:443  \n   - HTTPS servers with self-signed certs  \n   \n5. cisco-ios city:\"San Francisco\"  \n   - Cisco devices in SF  \n   \n6. http.title:\"phpMyAdmin\"  \n   - Exposed phpMyAdmin dashboards  \n   \n7. port:23 \"console management\"  \n   - Open Telnet management consoles  \n   \n8. vuln:CVE-2023-1234  \n   - Devices vulnerable to specific CVE  \n\n\ud83d\udca1 Advanced Operators  \n- before/after: Time-based filtering  \n- net: Search entire IP ranges  \n- has_screenshot: Find devices with images  \n- http.status:200 HTTP status filters  \n\n\n\ud83d\udcda Shodan Resources  \n[Official Docs](https://developer.shodan.io)  \n[Query Cheat Sheet](https://www.shodan.io/cheat-sheet)  \n[Exploit Database Integration](https://www.exploit-db.com/shodan)\n\n#shodan", "creation_timestamp": "2025-10-02T12:15:54.000000Z"}, {"uuid": "f8d3c380-da83-40be-8ef9-851d2fec2394", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://t.me/arpsyndicate/1717", "content": "#ExploitObserverAlert\n\nCVE-2023-1234\n\nDESCRIPTION: Exploit Observer has 4 entries related to CVE-2023-1234. Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)\n\nFIRST-EPSS: 0.000590000\nNVD-IS: 1.4\nNVD-ES: 2.8", "creation_timestamp": "2023-12-11T07:54:33.000000Z"}, {"uuid": "9fcceafe-3271-43a2-91bd-37721309dca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "Telegram/OzFKttwZe9n66Bk8pkaj_06BkKK8jwcrw2PP13ouFrfW1C6E8A", "content": "", "creation_timestamp": "2025-05-28T12:25:29.000000Z"}, {"uuid": "76c42295-04e1-4563-a9f2-ae19e2089f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/0d31eb3bb414396539a7c8aeee2112b1", "content": "diff --git a/README.md b/README.md\nindex 57102d1..84866af 100644\n--- a/README.md\n+++ b/README.md\n@@ -90,8 +90,10 @@ Vuls is a tool created to solve the problems listed above. It has the following\n   - [US-CERT](https://www.us-cert.gov/ncas/alerts)\n   - [JPCERT](http://www.jpcert.or.jp/at/2019.html)\n \n-- CISA(Cybersecurity & Infrastructure Security Agency)\n-  - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+- KEV (Known Exploited Vulnerabilities)\n+  - [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+  - [VulnCheck KEV](https://vulncheck.com/)\n+  - See [config.toml.example](./config.toml.example) for enabling KEV reporting\n \n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..5cedb5f\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,64 @@\n+# Vuls configuration example with KEV reporting enabled\n+# Copy this file to config.toml and adjust values for your environment\n+\n+[default]\n+# SSH port for scanning\n+port = \"22\"\n+\n+# Example server definitions\n+[servers.example-server]\n+host = \"192.0.2.10\"\n+port = \"22\"\n+user = \"vuls\"\n+# keyPath = \"/home/vuls/.ssh/id_rsa\"\n+# For password auth, use:\n+# password = \"your_ssh_password\"\n+\n+# KEV (Known Exploited Vulnerabilities) configuration\n+# Enable KEV detection using go-kev\n+# See https://github.com/vulsio/go-kev for database setup\n+[kevuln]\n+# Database type: sqlite3, mysql, postgres, redis, http\n+type = \"sqlite3\"\n+# Path to go-kev SQLite database\n+sqlite3Path = \"/path/to/go-kev.sqlite3\"\n+\n+# Example for HTTP mode (using vulsio/go-kev server)\n+# type = \"http\"\n+# url = \"http://kevuln.example.com:1328\"\n+\n+# Email notification (optional)\n+# [email]\n+# smtpAddr = \"smtp.example.com\"\n+# smtpPort = \"587\"\n+# user     = \"vuls@example.com\"\n+# password = \"your_smtp_password\"\n+# from     = \"vuls@example.com\"\n+# to       = [\"security@example.com\"]\n+\n+# Slack notification (optional)\n+# [slack]\n+# hookURL  = \"https://hooks.slack.com/services/XXX/YYY/ZZZ\"\n+# channel  = \"#security\"\n+# authUser = \"vuls\"\n+\n+# Other vulnerability datasources (optional examples)\n+# [cveDict]\n+# type = \"sqlite3\"\n+# sqlite3Path = \"/path/to/go-cve-dictionary.sqlite3\"\n+#\n+# [ovalDict]\n+# type = \"sqlite3\"\n+# sqlite3Path = \"/path/to/go-oval-dictionary.sqlite3\"\n+#\n+# [gost]\n+# type = \"sqlite3\"\n+# sqlite3Path = \"/path/to/go-gost.sqlite3\"\n+#\n+# [exploit]\n+# type = \"sqlite3\"\n+# sqlite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+#\n+# [metasploit]\n+# type = \"sqlite3\"\n+# sqlite3Path = \"/path/to/go-metasploit.sqlite3\"\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..92d2cb8 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,13 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\tif ok && len(kevulns) > 0 {\n+\t\t\t\t// TODO: Map kevulnmodels.KEVuln to models.KEV properly\n+\t\t\t\t// For now, populate minimal KEV entry to indicate detection\n+\t\t\t\tv.KEVs = append(v.KEVs, models.KEV{\n+\t\t\t\t\tType: models.CISAKEVType,\n+\t\t\t\t})\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +103,10 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n+\t\t\t// TODO: Map kevulnmodels.KEVuln to models.KEV properly\n+\t\t\tvuln.KEVs = append(vuln.KEVs, models.KEV{\n+\t\t\t\tType: models.CISAKEVType,\n+\t\t\t})\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..ed5025f 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,7 +197,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n@@ -205,6 +205,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n \t\tr.FormatAlertSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tpkgs)\n }\n \n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -434,8 +442,11 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n \t\t})\n \t\tr.ScannedCves[k] = v\n \t}\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..2866bcf 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -268,6 +268,7 @@ type VulnInfo struct {\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n \tGitHubSecurityAlerts GitHubSecurityAlerts `json:\"gitHubSecurityAlerts,omitempty\"`\n \tWpPackageFixStats    WpPackageFixStats    `json:\"wpPackageFixStats,omitempty\"`\n@@ -910,24 +911,71 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// KEVType is a type for KEV source\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA KEV\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is VulnCheck KEV\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerabilities information\n+type KEV struct {\n+\tType                       KEVType    `json:\"type,omitempty\"`\n+\tVendorProject              string     `json:\"vendorProject,omitempty\"`\n+\tProduct                    string     `json:\"product,omitempty\"`\n+\tVulnerabilityName          string     `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string     `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string     `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time  `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV   `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck KEV information\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck ReportedExploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..2332dcf 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,8 +566,8 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n+\t\tfor _, kev := range vuln.KEVs {\n+\t\t\tdata = append(data, []string{\"KEV\", fmt.Sprintf(\"%s: %s\", kev.Type, kev.VulnerabilityName)})\n \t\t}\n \n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\ndiff --git a/sample_kev_result.json b/sample_kev_result.json\nnew file mode 100644\nindex 0000000..227c3d6\n--- /dev/null\n+++ b/sample_kev_result.json\n@@ -0,0 +1,61 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"serverName\": \"example-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedAt\": \"2026-07-02T00:00:00Z\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability that is known to be exploited in the wild.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2023-01-15T00:00:00Z\",\n+          \"dueDate\": \"2023-02-05T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Example CISA note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"VulnCheck reported exploitation.\",\n+          \"requiredAction\": \"Apply mitigations.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"12345\",\n+                \"xdbURL\": \"https://example.com/xdb/12345\",\n+                \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-18T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ],\n+      \"cveContents\": {}\n+    }\n+  },\n+  \"packages\": {},\n+  \"config\": {\n+    \"scan\": {},\n+    \"report\": {}\n+  }\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..4bd7295 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,13 +812,13 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n+\t\tif len(vinfo.KEVs) != 0 {\n \t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n+\t\t\t\t\"KEV\",\n+\t\t\t\t\"===\",\n \t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n+\t\t\tfor _, kev := range vinfo.KEVs {\n+\t\t\t\tlines = append(lines, fmt.Sprintf(\"* %s: %s (%s)\", kev.Type, kev.VulnerabilityName, kev.VendorProject))\n \t\t\t}\n \t\t}\n \n", "creation_timestamp": "2026-07-02T07:56:27.845177Z"}, {"uuid": "7ecff67b-e339-459c-a27a-f924d623fa53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/610156a8d2a45916e3136ba8c5a6368d", "content": "diff --git a/README.md b/README.md\nindex 57102d1..2b516c5 100644\n--- a/README.md\n+++ b/README.md\n@@ -99,6 +99,10 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - Libraries\n   - [aquasecurity/vuln-list](https://github.com/aquasecurity/vuln-list)\n \n+## Example Configuration\n+\n+For a ready-to-use example configuration, see [config.toml.example](config.toml.example) at the repository root.\n+\n - WordPress\n   - [wpscan](https://wpscan.com/api)\n \ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..2f18acb\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,5 @@\n+[servers]\n+[servers.localhost]\n+host = \"127.0.0.1\"\n+port = \"22\"\n+user = \"root\"\n\\ No newline at end of file\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..158b026 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,19 +79,11 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n \t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n-\t\t\t\tnKEV++\n+\t\t\t\tif len(kevulns) > 0 {\n+\t\t\t\t\tnKEV++\n+\t\t\t\t}\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n \t\t}\n@@ -108,17 +100,9 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n \t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n+\t\t\t\tnKEV++\n \t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n-\t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\n \t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..aa529f2 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,7 +197,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n@@ -205,6 +205,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n \t\tr.FormatAlertSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tpkgs)\n }\n \n@@ -240,6 +241,17 @@ func (r ScanResult) FormatExploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d poc\", nExploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVs := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVs++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVs)\n+}\n+\n // FormatMetasploitCveSummary returns a summary of exploit cve\n func (r ScanResult) FormatMetasploitCveSummary() string {\n \tnMetasploitCve := 0\n@@ -253,13 +265,9 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -426,6 +434,13 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\t\treturn v.Mitigations[i].URL < v.Mitigations[j].URL\n \t\t})\n \n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n+\n \t\tv.CveContents.Sort()\n \n \t\tsort.Slice(v.AlertDict.USCERT, func(i, j int) bool {\n@@ -434,9 +449,6 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n-\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/scanresults_kev_test.go b/models/scanresults_kev_test.go\nnew file mode 100644\nindex 0000000..6e22a06\n--- /dev/null\n+++ b/models/scanresults_kev_test.go\n@@ -0,0 +1,61 @@\n+package models\n+\n+import (\n+\t\"reflect\"\n+\t\"testing\"\n+)\n+\n+func TestScanResult_Sort_KEV(t *testing.T) {\n+\ttype fields struct {\n+\t\tPackages    Packages\n+\t\tScannedCves VulnInfos\n+\t}\n+\ttests := []struct {\n+\t\tname     string\n+\t\tfields   fields\n+\t\texpected fields\n+\t}{\n+\t\t{\n+\t\t\tname: \"sort KEVs by Type and then VulnerabilityName\",\n+\t\t\tfields: fields{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2014-3591\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"B\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"B\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"A\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"A\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t\texpected: fields{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2014-3591\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"A\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"B\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"A\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"B\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t},\n+\t}\n+\tfor _, tt := range tests {\n+\t\tt.Run(tt.name, func(t *testing.T) {\n+\t\t\tr := &ScanResult{\n+\t\t\t\tPackages:    tt.fields.Packages,\n+\t\t\t\tScannedCves: tt.fields.ScannedCves,\n+\t\t\t}\n+\t\t\tr.SortForJSONOutput()\n+\t\t\tif !reflect.DeepEqual(r.Packages, tt.expected.Packages) {\n+\t\t\t\tt.Errorf(\"act %+v, want %+v\", r.Packages, tt.expected.Packages)\n+\t\t\t}\n+\t\t\tif !reflect.DeepEqual(r.ScannedCves, tt.expected.ScannedCves) {\n+\t\t\t\tt.Errorf(\"act %+v, want %+v\", r.ScannedCves, tt.expected.ScannedCves)\n+\t\t\t}\n+\t\t})\n+\t}\n+}\n\\ No newline at end of file\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..42deb04 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -267,6 +267,7 @@ type VulnInfo struct {\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n \tGitHubSecurityAlerts GitHubSecurityAlerts `json:\"gitHubSecurityAlerts,omitempty\"`\n@@ -912,22 +913,19 @@ type Mitigation struct {\n \n // AlertDict has target cve JPCERT, USCERT and CISA alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\n@@ -1089,3 +1087,54 @@ var (\n \t// FortinetVendorProductMatch is a ranking how confident the CVE-ID was detected correctly\n \tFortinetVendorProductMatch = Confidence{10, FortinetVendorProductMatchStr, 9}\n )\n+\n+// KEVType represents the source of the KEV information\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType indicates CISA Known Exploited Vulnerability\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType indicates VulnCheck Known Exploited Vulnerability\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerability information\n+type KEV struct {\n+\tType                       KEVType    `json:\"type\"`\n+\tVendorProject              string     `json:\"vendorProject,omitempty\"`\n+\tProduct                    string     `json:\"product,omitempty\"`\n+\tVulnerabilityName          string     `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string     `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string     `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time  `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV   `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA specific KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck specific KEV information\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck reported exploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..5b8697f 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_kev_scan.json b/sample_kev_scan.json\nnew file mode 100644\nindex 0000000..6de4b8f\n--- /dev/null\n+++ b/sample_kev_scan.json\n@@ -0,0 +1,36 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"scannedCves\": {\n+    \"CVE-2023-1234\": {\n+      \"cveID\": \"CVE-2023-1234\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Vulnerability Name\",\n+          \"shortDescription\": \"This is a short description of the vulnerability.\",\n+          \"requiredAction\": \"Apply updates.\",\n+          \"dateAdded\": \"2023-01-01T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"CISA specific note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vulnerabilityName\": \"Example VulnCheck Entry\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"123\",\n+                \"xdbURL\": \"https://example.com/123\",\n+                \"dateAdded\": \"2023-01-02T00:00:00Z\",\n+                \"exploitType\": \"RCE\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  }\n+}\n\\ No newline at end of file\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T11:56:22.625605Z"}, {"uuid": "33484f9b-7b56-42c4-8f4d-0359192a08c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/c67caf2f2ef9b2aa4e71af7bfdb25321", "content": "diff --git a/README.md b/README.md\nindex 57102d1..4fa4cd4 100644\n--- a/README.md\n+++ b/README.md\n@@ -93,6 +93,8 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - CISA(Cybersecurity & Infrastructure Security Agency)\n   - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n \n+To enable KEV reporting, see [config.toml.example](config.toml.example) for a ready-to-use configuration.\n+\n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\n \ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..3f0f625\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,27 @@\n+[servers]\n+\n+[servers.localhost]\n+host = \"localhost\"\n+port = \"local\"\n+\n+[cveDict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/cve.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-msfdb.sqlite3\"\n+\n+[kevuln]\n+# KEV (Known Exploited Vulnerabilities) configuration\n+# See https://github.com/vulsio/go-kev\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-kev.sqlite3\"\n+\n+# To fetch via HTTP instead of local DB:\n+# type = \"http\"\n+# url = \"http://127.0.0.1:1327\"\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..4abd46d 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,27 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\tif ok && len(kevulns) > 0 {\n+\t\t\t\tkevs := make([]models.KEV, 0, len(kevulns))\n+\t\t\t\tfor _, k := range kevulns {\n+\t\t\t\t\tdueDate := k.DueDate\n+\t\t\t\t\tkevs = append(kevs, models.KEV{\n+\t\t\t\t\t\tType:                       models.CISAKEVType,\n+\t\t\t\t\t\tVendorProject:              k.VendorProject,\n+\t\t\t\t\t\tProduct:                    k.Product,\n+\t\t\t\t\t\tVulnerabilityName:          k.VulnerabilityName,\n+\t\t\t\t\t\tShortDescription:           k.ShortDescription,\n+\t\t\t\t\t\tRequiredAction:             k.RequiredAction,\n+\t\t\t\t\t\tKnownRansomwareCampaignUse: k.KnownRansomwareCampaignUse,\n+\t\t\t\t\t\tDateAdded:                  k.DateAdded,\n+\t\t\t\t\t\tDueDate:                    &dueDate,\n+\t\t\t\t\t\tCISA: &models.CISAKEV{\n+\t\t\t\t\t\t\tNote: k.Notes,\n+\t\t\t\t\t\t},\n+\t\t\t\t\t})\n+\t\t\t\t}\n+\t\t\t\tv.KEVs = kevs\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +117,26 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n+\t\t\tkevs := make([]models.KEV, 0, len(kevulns))\n+\t\t\tfor _, k := range kevulns {\n+\t\t\t\tdueDate := k.DueDate\n+\t\t\t\tkevs = append(kevs, models.KEV{\n+\t\t\t\t\tType:                       models.CISAKEVType,\n+\t\t\t\t\tVendorProject:              k.VendorProject,\n+\t\t\t\t\tProduct:                    k.Product,\n+\t\t\t\t\tVulnerabilityName:          k.VulnerabilityName,\n+\t\t\t\t\tShortDescription:           k.ShortDescription,\n+\t\t\t\t\tRequiredAction:             k.RequiredAction,\n+\t\t\t\t\tKnownRansomwareCampaignUse: k.KnownRansomwareCampaignUse,\n+\t\t\t\t\tDateAdded:                  k.DateAdded,\n+\t\t\t\t\tDueDate:                    &dueDate,\n+\t\t\t\t\tCISA: &models.CISAKEV{\n+\t\t\t\t\t\tNote: k.Notes,\n+\t\t\t\t\t},\n \t\t\t\t})\n \t\t\t}\n \n-\t\t\tvuln.AlertDict.CISA = alerts\n+\t\t\tvuln.KEVs = kevs\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..efcd251 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,7 +197,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n@@ -205,6 +205,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n \t\tr.FormatAlertSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tpkgs)\n }\n \n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -437,6 +445,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n \t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..a81ccb1 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -266,6 +266,7 @@ type VulnInfo struct {\n \tExploits             []Exploit            `json:\"exploits,omitempty\"`\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n@@ -277,6 +278,57 @@ type VulnInfo struct {\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n }\n \n+// KEVType is the type of KEV\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA KEV\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is VulnCheck KEV\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerabilities information\n+type KEV struct {\n+\tType                       KEVType    `json:\"type,omitempty\"`\n+\tVendorProject              string     `json:\"vendorProject,omitempty\"`\n+\tProduct                    string     `json:\"product,omitempty\"`\n+\tVulnerabilityName          string     `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string     `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string     `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time  `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulnCheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck KEV information\n+type VulnCheckKEV struct {\n+\tXDB                   []VulnCheckXDB                   `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID        string    `json:\"xdbID,omitempty\"`\n+\tXDBURL       string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded    time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType  string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL  string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck ReportedExploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // Alert has CERT alert information\n type Alert struct {\n \tURL   string `json:\"url,omitempty\"`\n@@ -910,24 +962,21 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..5b8697f 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_kev_scan_result.json b/sample_kev_scan_result.json\nnew file mode 100644\nindex 0000000..4cbeed0\n--- /dev/null\n+++ b/sample_kev_scan_result.json\n@@ -0,0 +1,68 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"serverName\": \"example-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability in ExampleProduct allows remote code execution.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2023-01-15T00:00:00Z\",\n+          \"dueDate\": \"2023-02-05T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Example note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability (VulnCheck)\",\n+          \"shortDescription\": \"Actively exploited in the wild.\",\n+          \"requiredAction\": \"Patch immediately.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2023-01-16T00:00:00Z\",\n+          \"vulnCheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"12345\",\n+                \"xdbURL\": \"https://example.com/xdb/12345\",\n+                \"dateAdded\": \"2023-01-16T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-17T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ],\n+      \"cveContents\": {\n+        \"nvd\": [\n+          {\n+            \"type\": \"nvd\",\n+            \"cveID\": \"CVE-2023-12345\",\n+            \"summary\": \"Example vulnerability summary\",\n+            \"cvss3Score\": 9.8,\n+            \"cvss3Vector\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\n+            \"cvss3Severity\": \"CRITICAL\"\n+          }\n+        ]\n+      }\n+    }\n+  },\n+  \"packages\": {}\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T11:56:22.716035Z"}, {"uuid": "79956663-e34e-402f-88f1-c79e95317993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/fb0efb4c6f5b7040d446a21a13daed5e", "content": "diff --git a/README.md b/README.md\nindex 57102d1..f01fb4f 100644\n--- a/README.md\n+++ b/README.md\n@@ -92,6 +92,7 @@ Vuls is a tool created to solve the problems listed above. It has the following\n \n - CISA(Cybersecurity & Infrastructure Security Agency)\n   - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+  - KEV reporting can be enabled via `[kevuln]` in `config.toml` \u2014 see [config.toml.example](config.toml.example)\n \n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..ffca611\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,38 @@\n+# Example config.toml for Vuls with KEV reporting enabled\n+# See https://vuls.io/docs/en/config.toml.html\n+\n+[cveDict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-msfdb.sqlite3\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-kev.sqlite3\"\n+\n+[cti]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-cti.sqlite3\"\n+\n+[servers]\n+\n+[servers.localhost]\n+host = \"127.0.0.1\"\n+port = \"22\"\n+user = \"vuls\"\n+keyPath = \"/home/vuls/.ssh/id_rsa\"\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..f157724 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,8 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\tif ok && len(kevulns) > 0 {\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +98,6 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..347d79b 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of kev cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -437,6 +445,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n \t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..11eecaa 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -256,6 +256,57 @@ type PackageFixStatus struct {\n \tFixedIn     string `json:\"fixedIn,omitempty\"`\n }\n \n+// KEVType is Known Exploited Vulnerabilities type\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA KEV\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is VulnCheck KEV\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerabilities information\n+type KEV struct {\n+\tType                        KEVType                      `json:\"type,omitempty\"`\n+\tVendorProject               string                       `json:\"vendorProject,omitempty\"`\n+\tProduct                     string                       `json:\"product,omitempty\"`\n+\tVulnerabilityName           string                       `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription            string                       `json:\"shortDescription,omitempty\"`\n+\tRequiredAction              string                       `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse  string                       `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                   time.Time                    `json:\"dateAdded,omitempty\"`\n+\tDueDate                     *time.Time                   `json:\"dueDate,omitempty\"`\n+\tCISA                        *CISAKEV                     `json:\"cisa,omitempty\"`\n+\tVulnCheck                   *VulnCheckKEV                `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck KEV information\n+type VulnCheckKEV struct {\n+\tXDB                   []VulnCheckXDB                   `json:\"xdb,omitempty\"`\n+\tReportedExploitation  []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck ReportedExploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // VulnInfo has a vulnerability information and unsecure packages\n type VulnInfo struct {\n \tCveID                string               `json:\"cveID,omitempty\"`\n@@ -275,6 +326,7 @@ type VulnInfo struct {\n \tWindowsKBFixedIns    []string             `json:\"windowsKBFixedIns,omitempty\"`\n \tVulnType             string               `json:\"vulnType,omitempty\"`\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n }\n \n // Alert has CERT alert information\n@@ -910,24 +962,21 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..a2dfbd0 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_kev_scan_result.json b/sample_kev_scan_result.json\nnew file mode 100644\nindex 0000000..2f90169\n--- /dev/null\n+++ b/sample_kev_scan_result.json\n@@ -0,0 +1,54 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"serverName\": \"localhost\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability in ExampleProduct allows remote code execution\",\n+          \"requiredAction\": \"Apply updates per vendor instructions\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2023-01-15T00:00:00Z\",\n+          \"dueDate\": \"2023-02-05T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Example note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability reported by VulnCheck\",\n+          \"requiredAction\": \"Apply patch\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2023-01-16T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"12345\",\n+                \"xdbURL\": \"https://example.com/xdb/12345\",\n+                \"dateAdded\": \"2023-01-16T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-17T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  }\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T15:14:59.062224Z"}, {"uuid": "468efe43-93c3-488d-8f27-ae1908ed27bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/3e873813bbc4615be1b5984942c4fdf1", "content": "diff --git a/README.md b/README.md\nindex 57102d1..5d3254d 100644\n--- a/README.md\n+++ b/README.md\n@@ -38,6 +38,7 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - Informs users of the servers that are affected.\n - Vulnerability detection is done automatically to prevent any oversight.\n - A report is generated on a regular basis using CRON or other methods. to manage vulnerability.\n+- Supports CISA and VulnCheck KEV (Known Exploited Vulnerabilities) reporting. See `config.toml.example` and `sample_kev.json` for details.\n \n ![Vuls-Motivation](img/vuls-motivation.png)\n \ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..0699949\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,25 @@\n+[cisa]\n+url = \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\"\n+\n+[vulncheck]\n+url = \"https://api.vulncheck.com/v3/index/kev\"\n+api_key = \"YOUR_VULNCHECK_API_KEY_HERE\"\n+\n+[slack]\n+hookURL = \"https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\"\n+\n+[chatwork]\n+apiToken = \"YOUR_CHATWORK_TOKEN_HERE\"\n+\n+[email]\n+smtpServer = \"smtp.example.com\"\n+smtpPort = \"587\"\n+user = \"user@example.com\"\n+password = \"YOUR_SMTP_PASSWORD_HERE\"\n+\n+[servers]\n+[servers.example-host]\n+host = \"192.168.1.100\"\n+port = \"22\"\n+user = \"vuls\"\n+sshKeyPath = \"/home/vuls/.ssh/id_rsa\"\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..ca07743 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,7 +197,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n@@ -205,6 +205,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n \t\tr.FormatAlertSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tpkgs)\n }\n \n@@ -253,13 +254,9 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +264,18 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n+}\n+\n+// FormatKEVCveSummary returns a summary of KEV cves\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif len(vuln.KEVs) > 0 {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -437,6 +445,14 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n \t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n \t\t})\n+\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type == v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t})\n+\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/scanresults_kev_test.go b/models/scanresults_kev_test.go\nnew file mode 100644\nindex 0000000..28b0df6\n--- /dev/null\n+++ b/models/scanresults_kev_test.go\n@@ -0,0 +1,51 @@\n+package models\n+\n+import (\n+\t\"reflect\"\n+\t\"testing\"\n+)\n+\n+func TestScanResult_Sort_KEV(t *testing.T) {\n+\ttests := []struct {\n+\t\tname     string\n+\t\tfields   ScanResult\n+\t\texpected ScanResult\n+\t}{\n+\t\t{\n+\t\t\tname: \"sort KEVs by Type then VulnerabilityName\",\n+\t\t\tfields: ScanResult{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2023-1234\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"B-Vuln\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"D-Vuln\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"C-Vuln\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"A-Vuln\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t\texpected: ScanResult{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2023-1234\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"C-Vuln\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"D-Vuln\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"A-Vuln\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"B-Vuln\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t},\n+\t}\n+\tfor _, tt := range tests {\n+\t\tt.Run(tt.name, func(t *testing.T) {\n+\t\t\tr := &tt.fields\n+\t\t\tr.SortForJSONOutput()\n+\t\t\tif !reflect.DeepEqual(*r, tt.expected) {\n+\t\t\t\tt.Errorf(\"SortForJSONOutput() KEVs got = %v, want %v\", r.ScannedCves[\"CVE-2023-1234\"].KEVs, tt.expected.ScannedCves[\"CVE-2023-1234\"].KEVs)\n+\t\t\t}\n+\t\t})\n+\t}\n+}\n\\ No newline at end of file\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..cc5c33c 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -268,6 +268,7 @@ type VulnInfo struct {\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n \tGitHubSecurityAlerts GitHubSecurityAlerts `json:\"gitHubSecurityAlerts,omitempty\"`\n \tWpPackageFixStats    WpPackageFixStats    `json:\"wpPackageFixStats,omitempty\"`\n@@ -910,30 +911,77 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\n \treturn strings.Join(s, \"/\")\n }\n \n+// KEVType represents the source of the KEV data\n+type KEVType string\n+\n+const (\n+\tCISAKEVType      KEVType = \"cisa\"\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV represents Known Exploited Vulnerability information\n+type KEV struct {\n+\tType                       KEVType    `json:\"type\"`\n+\tVendorProject              string     `json:\"vendorProject,omitempty\"`\n+\tProduct                    string     `json:\"product,omitempty\"`\n+\tVulnerabilityName          string     `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string     `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string     `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time  `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time `json:\"dueDate,omitempty\"`\n+\n+\tCISA      *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV contains CISA specific KEV fields\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV contains VulnCheck specific KEV fields\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB represents VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbId,omitempty\"`\n+\tXDBURL      string    `json:\"xdbUrl,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSshUrl,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation represents reported exploitation data\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // Confidences is a list of Confidence\n type Confidences []Confidence\n \ndiff --git a/sample_kev.json b/sample_kev.json\nnew file mode 100644\nindex 0000000..2731b47\n--- /dev/null\n+++ b/sample_kev.json\n@@ -0,0 +1,34 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"lang\": \"en\",\n+  \"serverName\": \"example-host\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedCves\": {\n+    \"CVE-0000-0000\": {\n+      \"cveID\": \"CVE-0000-0000\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"This is a redacted synthetic example KEV.\",\n+          \"requiredAction\": \"Apply updates.\",\n+          \"cisa\": {\n+            \"note\": \"Example note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vulnerabilityName\": \"Example Vulnerability 2\",\n+          \"vulncheck\": {\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/exploit\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  }\n+}\n", "creation_timestamp": "2026-07-03T17:33:43.953962Z"}, {"uuid": "40bc5bef-1d74-42a4-beda-d2c27f3401c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1234", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/1d11b26fe9de8e6b2c5b6b19eb5be804", "content": "diff --git a/README.md b/README.md\nindex 57102d1..af19fc1 100644\n--- a/README.md\n+++ b/README.md\n@@ -163,6 +163,7 @@ Vuls has some options to detect the vulnerabilities\n   - Vuls works well with Continuous Integration since tests can be run every day. This allows you to find vulnerabilities very quickly.\n - Auto-generation of configuration file template\n   - Auto-detection of servers set using CIDR, generate configuration file template\n+  - Example configuration file available at `example-config.toml`\n - Email and Slack notification is possible (supports Japanese language)\n - Scan result is viewable on accessory software, TUI Viewer in a terminal or Web UI ([VulsRepo](https://github.com/ishiDACo/vulsrepo)).\n \ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..6689bdf 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,28 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n \t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\t\tfor _, kev := range kevulns {\n+\t\t\t\t\tk := models.KEV{\n+\t\t\t\t\t\tType:                       models.CISAKEVType,\n+\t\t\t\t\t\tVendorProject:              kev.VendorProject,\n+\t\t\t\t\t\tProduct:                    kev.Product,\n+\t\t\t\t\t\tVulnerabilityName:          kev.VulnerabilityName,\n+\t\t\t\t\t\tShortDescription:           kev.ShortDescription,\n+\t\t\t\t\t\tRequiredAction:             kev.RequiredAction,\n+\t\t\t\t\t\tKnownRansomwareCampaignUse: kev.KnownRansomwareCampaignUse,\n+\t\t\t\t\t\tDateAdded:                  kev.DateAdded,\n+\t\t\t\t\t}\n+\t\t\t\t\tif !kev.DueDate.IsZero() {\n+\t\t\t\t\t\tdueDate := kev.DueDate\n+\t\t\t\t\t\tk.DueDate = &dueDate\n+\t\t\t\t\t}\n+\t\t\t\t\tif kev.Notes != \"\" {\n+\t\t\t\t\t\tk.CISA = &models.CISAKEV{Note: kev.Notes}\n+\t\t\t\t\t}\n+\t\t\t\t\tv.KEVs = append(v.KEVs, k)\n+\t\t\t\t}\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +118,26 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n+\t\t\tfor _, kev := range kevulns {\n+\t\t\t\tk := models.KEV{\n+\t\t\t\t\tType:                       models.CISAKEVType,\n+\t\t\t\t\tVendorProject:              kev.VendorProject,\n+\t\t\t\t\tProduct:                    kev.Product,\n+\t\t\t\t\tVulnerabilityName:          kev.VulnerabilityName,\n+\t\t\t\t\tShortDescription:           kev.ShortDescription,\n+\t\t\t\t\tRequiredAction:             kev.RequiredAction,\n+\t\t\t\t\tKnownRansomwareCampaignUse: kev.KnownRansomwareCampaignUse,\n+\t\t\t\t\tDateAdded:                  kev.DateAdded,\n+\t\t\t\t}\n+\t\t\t\tif !kev.DueDate.IsZero() {\n+\t\t\t\t\tdueDate := kev.DueDate\n+\t\t\t\t\tk.DueDate = &dueDate\n+\t\t\t\t}\n+\t\t\t\tif kev.Notes != \"\" {\n+\t\t\t\t\tk.CISA = &models.CISAKEV{Note: kev.Notes}\n+\t\t\t\t}\n+\t\t\t\tvuln.KEVs = append(vuln.KEVs, k)\n \t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..e9b35eb 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,7 +197,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n@@ -205,6 +205,7 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n \t\tr.FormatAlertSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tpkgs)\n }\n \n@@ -240,6 +241,17 @@ func (r ScanResult) FormatExploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d poc\", nExploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEV := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif len(vuln.KEVs) > 0 {\n+\t\t\tnKEV++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEV)\n+}\n+\n // FormatMetasploitCveSummary returns a summary of exploit cve\n func (r ScanResult) FormatMetasploitCveSummary() string {\n \tnMetasploitCve := 0\n@@ -253,13 +265,9 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -437,6 +445,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n \t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/scanresults_kev_test.go b/models/scanresults_kev_test.go\nnew file mode 100644\nindex 0000000..22ab7a1\n--- /dev/null\n+++ b/models/scanresults_kev_test.go\n@@ -0,0 +1,56 @@\n+package models\n+\n+import (\n+\t\"reflect\"\n+\t\"testing\"\n+)\n+\n+func TestScanResult_Sort_KEV(t *testing.T) {\n+\ttype fields struct {\n+\t\tScannedCves VulnInfos\n+\t}\n+\ttests := []struct {\n+\t\tname     string\n+\t\tfields   fields\n+\t\texpected fields\n+\t}{\n+\t\t{\n+\t\t\tname: \"kev sorting\",\n+\t\t\tfields: fields{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2014-3591\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"vulnb\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"vulna\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"vulnb\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"vulna\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t\texpected: fields{\n+\t\t\t\tScannedCves: VulnInfos{\n+\t\t\t\t\t\"CVE-2014-3591\": VulnInfo{\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"vulna\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"vulnb\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"vulna\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"vulnb\"},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t},\n+\t\t\t},\n+\t\t},\n+\t}\n+\tfor _, tt := range tests {\n+\t\tt.Run(tt.name, func(t *testing.T) {\n+\t\t\tr := &ScanResult{\n+\t\t\t\tScannedCves: tt.fields.ScannedCves,\n+\t\t\t}\n+\t\t\tr.SortForJSONOutput()\n+\t\t\tif !reflect.DeepEqual(r.ScannedCves, tt.expected.ScannedCves) {\n+\t\t\t\tt.Errorf(\"ScanResult.SortForJSONOutput() act %+v, want %+v\", r.ScannedCves, tt.expected.ScannedCves)\n+\t\t\t}\n+\t\t})\n+\t}\n+}\n\\ No newline at end of file\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..c07ebf6 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -275,6 +275,56 @@ type VulnInfo struct {\n \tWindowsKBFixedIns    []string             `json:\"windowsKBFixedIns,omitempty\"`\n \tVulnType             string               `json:\"vulnType,omitempty\"`\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n+}\n+\n+// KEVType represents the KEV source type\n+type KEVType string\n+\n+const (\n+\tCISAKEVType      KEVType = \"cisa\"\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV represents Known Exploited Vulnerability information\n+type KEV struct {\n+\tType                       KEVType\n+\tVendorProject              string\n+\tProduct                    string\n+\tVulnerabilityName          string\n+\tShortDescription           string\n+\tRequiredAction             string\n+\tKnownRansomwareCampaignUse string\n+\tDateAdded                  time.Time\n+\tDueDate                    *time.Time\n+\tCISA                       *CISAKEV\n+\tVulnCheck                  *VulnCheckKEV\n+}\n+\n+// CISAKEV represents CISA specific KEV information\n+type CISAKEV struct {\n+\tNote string\n+}\n+\n+// VulnCheckKEV represents VulnCheck specific KEV information\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB\n+\tReportedExploitation []VulnCheckReportedExploitation\n+}\n+\n+// VulnCheckXDB represents VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string\n+\tXDBURL      string\n+\tDateAdded   time.Time\n+\tExploitType string\n+\tCloneSSHURL string\n+}\n+\n+// VulnCheckReportedExploitation represents VulnCheck reported exploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string\n+\tDateAdded time.Time\n }\n \n // Alert has CERT alert information\n@@ -910,7 +960,7 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT, USCERT alert data\n type AlertDict struct {\n \tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n@@ -919,15 +969,12 @@ type AlertDict struct {\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..5b8697f 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_scan_result.json b/sample_scan_result.json\nnew file mode 100644\nindex 0000000..4975b38\n--- /dev/null\n+++ b/sample_scan_result.json\n@@ -0,0 +1,49 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"lang\": \"en\",\n+  \"serverName\": \"localhost\",\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"scannedCves\": {\n+    \"CVE-2023-1234\": {\n+      \"cveID\": \"CVE-2023-1234\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"This is a sample known exploited vulnerability.\",\n+          \"requiredAction\": \"Apply updates.\",\n+          \"dateAdded\": \"2023-01-01T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Sample note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"This is a sample known exploited vulnerability.\",\n+          \"dateAdded\": \"2023-01-01T00:00:00Z\",\n+          \"vulnCheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"XDB-1234\",\n+                \"xdbURL\": \"https://example.com/xdb-1234\",\n+                \"dateAdded\": \"2023-01-01T00:00:00Z\",\n+                \"exploitType\": \"RCE\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-01T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  }\n+}\n\\ No newline at end of file\ndiff --git a/test_kevuln.go b/test_kevuln.go\nnew file mode 100644\nindex 0000000..542aecb\n--- /dev/null\n+++ b/test_kevuln.go\n@@ -0,0 +1,13 @@\n+package main\n+import (\n+\t\"fmt\"\n+\t\"reflect\"\n+\t\"github.com/vulsio/go-kev/models\"\n+)\n+func main() {\n+\tvar k models.KEVuln\n+\tt := reflect.TypeOf(k)\n+\tfor i := 0; i < t.NumField(); i++ {\n+\t\tfmt.Printf(\"%s %s\\n\", t.Field(i).Name, t.Field(i).Type.String())\n+\t}\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T19:06:02.442588Z"}, {"uuid": "451a5fa6-9cba-4ac0-b5e1-28f16162a779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/02513bd06628d1d402b8c22f6cca3359", "content": "diff --git a/README.md b/README.md\nindex 57102d1..fe28073 100644\n--- a/README.md\n+++ b/README.md\n@@ -156,6 +156,10 @@ Vuls has some options to detect the vulnerabilities\n \n - [Scan WordPress](https://vuls.io/docs/en/usage-scan-wordpress.html)\n \n+## Configuration\n+\n+A ready-to-use synthetic example configuration is available in [config.toml.example](config.toml.example).\n+\n ## MISC\n \n - Nondestructive testing\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..c399f4c\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,28 @@\n+[servers]\n+\n+[servers.synthetic-server]\n+host         = \"192.0.2.100\"\n+port         = \"22\"\n+user         = \"synthetic-user\"\n+keyPath      = \"/synthetic/path/to/id_rsa\"\n+scanMode     = [\"fast\"]\n+\n+[cveDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/go-kev.sqlite3\"\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..f0230da 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,8 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n \t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +98,6 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..85d5808 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -251,15 +251,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKevCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKevCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKevCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +274,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -434,8 +441,11 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n \t\t})\n \t\tr.ScannedCves[k] = v\n \t}\ndiff --git a/models/scanresults_test.go b/models/scanresults_test.go\nindex d429281..fb17f7c 100644\n--- a/models/scanresults_test.go\n+++ b/models/scanresults_test.go\n@@ -225,10 +225,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -288,10 +290,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -354,10 +358,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -417,10 +423,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..85e3f66 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -267,6 +267,7 @@ type VulnInfo struct {\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n \tGitHubSecurityAlerts GitHubSecurityAlerts `json:\"gitHubSecurityAlerts,omitempty\"`\n@@ -910,24 +911,69 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// KEVType is a type of KEV\n+type KEVType string\n+\n+const (\n+\tCISAKEVType      KEVType = \"cisa\"\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerabilities information\n+type KEV struct {\n+\tType                       KEVType      `json:\"type,omitempty\"`\n+\tVendorProject              string       `json:\"vendorProject,omitempty\"`\n+\tProduct                    string       `json:\"product,omitempty\"`\n+\tVulnerabilityName          string       `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string       `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string       `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string       `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time    `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time   `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV     `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA specific KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck specific KEV information\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck Reported Exploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..5b8697f 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample-scan-result.json b/sample-scan-result.json\nnew file mode 100644\nindex 0000000..6fa4d81\n--- /dev/null\n+++ b/sample-scan-result.json\n@@ -0,0 +1,23 @@\n+{\n+  \"serverName\": \"synthetic-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"20.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vulnerabilityName\": \"Test Vulnerability\",\n+          \"shortDescription\": \"This is a test KEV.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\"\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vulnerabilityName\": \"Test VulnCheck KEV\",\n+          \"shortDescription\": \"This is a VulnCheck KEV.\"\n+        }\n+      ]\n+    }\n+  }\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T23:06:30.971043Z"}, {"uuid": "31fe6afb-ef00-44b5-a28d-50874e7cf83d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/5a6ee63a97f27bc7d17f699f8399771e", "content": "diff --git a/README.md b/README.md\nindex 57102d1..2b0c5c0 100644\n--- a/README.md\n+++ b/README.md\n@@ -90,8 +90,10 @@ Vuls is a tool created to solve the problems listed above. It has the following\n   - [US-CERT](https://www.us-cert.gov/ncas/alerts)\n   - [JPCERT](http://www.jpcert.or.jp/at/2019.html)\n \n-- CISA(Cybersecurity & Infrastructure Security Agency)\n-  - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+- KEV (Known Exploited Vulnerabilities)\n+  - [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+  - [VulnCheck KEV](https://vulncheck.com/kev)\n+  - Example config: see [config.toml.example](./config.toml.example)\n \n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..061e670\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,45 @@\n+# config.toml --- Vuls configuration (example)\n+# Copy to config.toml and edit for your environment.\n+# DO NOT commit real credentials.\n+\n+[default]\n+#port = \"22\"\n+#user = \"vuls\"\n+#keyPath = \"/home/vuls/.ssh/id_rsa\"\n+\n+[cvedict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-metasploitdb.sqlite3\"\n+\n+# KEV (Known Exploited Vulnerabilities)\n+# CISA KEV and VulnCheck KEV support\n+[kevuln]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-kev.sqlite3\"\n+# To use HTTP instead:\n+# type = \"http\"\n+# url = \"http://kev-server:1328\"\n+\n+[servers]\n+\n+[servers.localhost]\n+host = \"localhost\"\n+port = \"local\"\n+#scanMode = [\"fast\"]\n+#scanModules = [\"ospackages\", \"wordpress\", \"lockfiles\", \"changelogs\"]\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..3d9df02 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,24 +79,13 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n \t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n \t\t\t\tnKEV++\n \t\t\t}\n-\t\t\tr.ScannedCves[res.request.cveID] = v\n+\t\t\t// TODO: populate r.ScannedCves[res.request.cveID].KEVs from kevulns\n \t\t}\n \t} else {\n-\t\tfor cveID, vuln := range r.ScannedCves {\n+\t\tfor cveID := range r.ScannedCves {\n \t\t\tif cveID == \"\" {\n \t\t\t\tcontinue\n \t\t\t}\n@@ -108,18 +97,8 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n-\t\t\tr.ScannedCves[cveID] = vuln\n+\t\t\t// TODO: populate vuln.KEVs from kevulns\n \t\t}\n \t}\n \ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..cba5227 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -434,8 +442,11 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n \t\t})\n \t\tr.ScannedCves[k] = v\n \t}\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..fde4826 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -257,6 +257,57 @@ type PackageFixStatus struct {\n }\n \n // VulnInfo has a vulnerability information and unsecure packages\n+// KEVType is a type of KEV\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA KEV\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is VulnCheck KEV\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has KEV information\n+type KEV struct {\n+\tType                        KEVType       `json:\"type,omitempty\"`\n+\tVendorProject               string        `json:\"vendorProject,omitempty\"`\n+\tProduct                     string        `json:\"product,omitempty\"`\n+\tVulnerabilityName           string        `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription            string        `json:\"shortDescription,omitempty\"`\n+\tRequiredAction              string        `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse  string        `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                   time.Time     `json:\"dateAdded,omitempty\"`\n+\tDueDate                     *time.Time    `json:\"dueDate,omitempty\"`\n+\tCISA                        *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                   *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck KEV information\n+type VulnCheckKEV struct {\n+\tXDB                   []VulnCheckXDB                   `json:\"xdb,omitempty\"`\n+\tReportedExploitation  []VulnCheckReportedExploitation  `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID        string    `json:\"xdbID,omitempty\"`\n+\tXDBURL       string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded    time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType  string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL  string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck ReportedExploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n type VulnInfo struct {\n \tCveID                string               `json:\"cveID,omitempty\"`\n \tConfidences          Confidences          `json:\"confidences,omitempty\"`\n@@ -275,6 +326,7 @@ type VulnInfo struct {\n \tWindowsKBFixedIns    []string             `json:\"windowsKBFixedIns,omitempty\"`\n \tVulnType             string               `json:\"vulnType,omitempty\"`\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n }\n \n // Alert has CERT alert information\n@@ -910,24 +962,20 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..a2dfbd0 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_kev_result.json b/sample_kev_result.json\nnew file mode 100644\nindex 0000000..e22077b\n--- /dev/null\n+++ b/sample_kev_result.json\n@@ -0,0 +1,60 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"serverName\": \"example-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability in ExampleProduct allows remote code execution.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2023-01-15T00:00:00Z\",\n+          \"dueDate\": \"2023-02-05T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Example note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability (VulnCheck)\",\n+          \"shortDescription\": \"VulnCheck reported exploitation.\",\n+          \"requiredAction\": \"Apply mitigations.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"12345\",\n+                \"xdbURL\": \"https://example.com/xdb/12345\",\n+                \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-21T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ],\n+      \"cveContents\": {},\n+      \"confidences\": [],\n+      \"affectedPackages\": []\n+    }\n+  },\n+  \"packages\": {},\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"reportedAt\": \"2026-07-03T00:00:00Z\"\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-03T23:06:31.102263Z"}, {"uuid": "c25df4aa-1c4a-4a1c-9620-af86bb0372a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2023-1234", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/f5f1eac3b35f981a96c98c590641dea2", "content": "diff --git a/README.md b/README.md\nindex 57102d1..53bff85 100644\n--- a/README.md\n+++ b/README.md\n@@ -93,6 +93,13 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - CISA(Cybersecurity & Infrastructure Security Agency)\n   - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n \n+- VulnCheck\n+  - Known Exploited Vulnerabilities metadata is reported in each vulnerability's `kevs` field when the KEV database is configured.\n+\n+- Example configuration\n+  - Use `config.example` as a starting point for enabling KEV reporting with `go-kev.sqlite3`.\n+  - `sample-kev-scan-result.json` shows the resulting first-class `kevs` output shape.\n+\n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\n \ndiff --git a/config.example b/config.example\nnew file mode 100644\nindex 0000000..337761c\n--- /dev/null\n+++ b/config.example\n@@ -0,0 +1,43 @@\n+# Ready-to-use Vuls configuration with KEV reporting enabled.\n+\n+[cveDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-msfdb.sqlite3\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-kev.sqlite3\"\n+\n+[cti]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-cti.sqlite3\"\n+\n+[default]\n+port = \"22\"\n+user = \"vuls\"\n+keyPath = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+scanModules = [\"ospkg\"]\n+\n+[servers]\n+\n+[servers.localhost]\n+host = \"127.0.0.1\"\n+scanMode = [\"fast-root\"]\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..7288c19 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,9 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\tif ok && len(kevulns) > 0 {\n+\t\t\t\tv.KEVs = append(v.KEVs, cisaKEVs(kevulns)...)\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +99,7 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n+\t\t\tvuln.KEVs = append(vuln.KEVs, cisaKEVs(kevulns)...)\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\n@@ -127,6 +109,50 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \treturn nil\n }\n \n+func cisaKEVs(kevulns []kevulnmodels.KEVuln) (kevs []models.KEV) {\n+\tfor _, kevuln := range kevulns {\n+\t\tvar v struct {\n+\t\t\tVendorProject              string     `json:\"vendorProject\"`\n+\t\t\tProduct                    string     `json:\"product\"`\n+\t\t\tVulnerabilityName          string     `json:\"vulnerabilityName\"`\n+\t\t\tShortDescription           string     `json:\"shortDescription\"`\n+\t\t\tRequiredAction             string     `json:\"requiredAction\"`\n+\t\t\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse\"`\n+\t\t\tDateAdded                  time.Time  `json:\"dateAdded\"`\n+\t\t\tDueDate                    *time.Time `json:\"dueDate\"`\n+\t\t\tNote                       string     `json:\"note\"`\n+\t\t\tNotes                      string     `json:\"notes\"`\n+\t\t}\n+\t\tbs, err := json.Marshal(kevuln)\n+\t\tif err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tif err := json.Unmarshal(bs, &v); err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tnote := v.Note\n+\t\tif note == \"\" {\n+\t\t\tnote = v.Notes\n+\t\t}\n+\n+\t\tkevs = append(kevs, models.KEV{\n+\t\t\tType:                       models.CISAKEVType,\n+\t\t\tVendorProject:              v.VendorProject,\n+\t\t\tProduct:                    v.Product,\n+\t\t\tVulnerabilityName:          v.VulnerabilityName,\n+\t\t\tShortDescription:           v.ShortDescription,\n+\t\t\tRequiredAction:             v.RequiredAction,\n+\t\t\tKnownRansomwareCampaignUse: v.KnownRansomwareCampaignUse,\n+\t\t\tDateAdded:                  v.DateAdded,\n+\t\t\tDueDate:                    v.DueDate,\n+\t\t\tCISA: &models.CISAKEV{\n+\t\t\t\tNote: note,\n+\t\t\t},\n+\t\t})\n+\t}\n+\treturn kevs\n+}\n+\n type kevulnResponse struct {\n \trequest kevulnRequest\n \tjson    string\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..2b8e88c 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of known exploited vulnerability CVEs.\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -425,6 +433,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.Mitigations, func(i, j int) bool {\n \t\t\treturn v.Mitigations[i].URL < v.Mitigations[j].URL\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \n \t\tv.CveContents.Sort()\n \n@@ -434,9 +448,6 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n-\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..8052793 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -263,6 +263,7 @@ type VulnInfo struct {\n \tAffectedPackages     PackageFixStatuses   `json:\"affectedPackages,omitempty\"`\n \tDistroAdvisories     DistroAdvisories     `json:\"distroAdvisories,omitempty\"` // for Amazon, RHEL, Fedora, FreeBSD, Microsoft\n \tCveContents          CveContents          `json:\"cveContents,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tExploits             []Exploit            `json:\"exploits,omitempty\"`\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n@@ -277,6 +278,58 @@ type VulnInfo struct {\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n }\n \n+// KEVType identifies the source of a Known Exploited Vulnerability entry.\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA's Known Exploited Vulnerabilities Catalog.\n+\tCISAKEVType KEVType = \"cisa\"\n+\n+\t// VulnCheckKEVType is VulnCheck's Known Exploited Vulnerabilities data.\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerability information.\n+type KEV struct {\n+\tType                         KEVType        `json:\"type\"`\n+\tVendorProject                string         `json:\"vendorProject,omitempty\"`\n+\tProduct                      string         `json:\"product,omitempty\"`\n+\tVulnerabilityName            string         `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription             string         `json:\"shortDescription,omitempty\"`\n+\tRequiredAction               string         `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse   string         `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                    time.Time      `json:\"dateAdded,omitempty\"`\n+\tDueDate                      *time.Time     `json:\"dueDate,omitempty\"`\n+\tCISA                         *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                    *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA-specific Known Exploited Vulnerability information.\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck-specific Known Exploited Vulnerability information.\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB exploit metadata.\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck reported exploitation metadata.\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // Alert has CERT alert information\n type Alert struct {\n \tURL   string `json:\"url,omitempty\"`\n@@ -910,24 +963,21 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..f165040 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,8 +566,8 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n+\t\tfor _, kev := range vuln.KEVs {\n+\t\t\tdata = append(data, []string{fmt.Sprintf(\"%s KEV\", strings.ToUpper(string(kev.Type))), kev.VulnerabilityName})\n \t\t}\n \n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\ndiff --git a/sample-kev-scan-result.json b/sample-kev-scan-result.json\nnew file mode 100644\nindex 0000000..0fc7068\n--- /dev/null\n+++ b/sample-kev-scan-result.json\n@@ -0,0 +1,59 @@\n+{\n+  \"jsonVersion\": 0,\n+  \"lang\": \"en\",\n+  \"serverName\": \"localhost\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"reportedAt\": \"2026-07-03T00:00:00Z\",\n+  \"scannedCves\": {\n+    \"CVE-2023-1234\": {\n+      \"cveID\": \"CVE-2023-1234\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"Example Product contains a remote code execution vulnerability.\",\n+          \"requiredAction\": \"Apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2026-07-01T00:00:00Z\",\n+          \"dueDate\": \"2026-07-22T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"VulnCheck reports public exploitation metadata for this CVE.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"XDB-123456\",\n+                \"xdbURL\": \"https://vulncheck.com/xdb/XDB-123456\",\n+                \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:vulncheck/xdb-123456.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/research/cve-2023-1234-exploitation\",\n+                \"dateAdded\": \"2026-07-02T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  },\n+  \"packages\": {},\n+  \"errors\": [],\n+  \"warnings\": []\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..7b4c278 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,13 +812,13 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n+\t\tif len(vinfo.KEVs) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n+\t\t\t\t\"KEV\",\n+\t\t\t\t\"===\",\n \t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n+\t\t\tfor _, kev := range vinfo.KEVs {\n+\t\t\t\tlines = append(lines, fmt.Sprintf(\"* %s: %s\", strings.ToUpper(string(kev.Type)), kev.VulnerabilityName))\n \t\t\t}\n \t\t}\n \n", "creation_timestamp": "2026-07-03T23:34:55.488446Z"}, {"uuid": "245feb02-4e47-4249-a45a-4260917a56b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2023-1234", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/f5f1eac3b35f981a96c98c590641dea2", "content": "diff --git a/README.md b/README.md\nindex 57102d1..53bff85 100644\n--- a/README.md\n+++ b/README.md\n@@ -93,6 +93,13 @@ Vuls is a tool created to solve the problems listed above. It has the following\n - CISA(Cybersecurity & Infrastructure Security Agency)\n   - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n \n+- VulnCheck\n+  - Known Exploited Vulnerabilities metadata is reported in each vulnerability's `kevs` field when the KEV database is configured.\n+\n+- Example configuration\n+  - Use `config.example` as a starting point for enabling KEV reporting with `go-kev.sqlite3`.\n+  - `sample-kev-scan-result.json` shows the resulting first-class `kevs` output shape.\n+\n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\n \ndiff --git a/config.example b/config.example\nnew file mode 100644\nindex 0000000..337761c\n--- /dev/null\n+++ b/config.example\n@@ -0,0 +1,43 @@\n+# Ready-to-use Vuls configuration with KEV reporting enabled.\n+\n+[cveDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-msfdb.sqlite3\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-kev.sqlite3\"\n+\n+[cti]\n+type = \"sqlite3\"\n+SQLite3Path = \"/var/lib/vuls/go-cti.sqlite3\"\n+\n+[default]\n+port = \"22\"\n+user = \"vuls\"\n+keyPath = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+scanModules = [\"ospkg\"]\n+\n+[servers]\n+\n+[servers.localhost]\n+host = \"127.0.0.1\"\n+scanMode = [\"fast-root\"]\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..7288c19 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,9 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n+\t\t\tif ok && len(kevulns) > 0 {\n+\t\t\t\tv.KEVs = append(v.KEVs, cisaKEVs(kevulns)...)\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +99,7 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n+\t\t\tvuln.KEVs = append(vuln.KEVs, cisaKEVs(kevulns)...)\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\n@@ -127,6 +109,50 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \treturn nil\n }\n \n+func cisaKEVs(kevulns []kevulnmodels.KEVuln) (kevs []models.KEV) {\n+\tfor _, kevuln := range kevulns {\n+\t\tvar v struct {\n+\t\t\tVendorProject              string     `json:\"vendorProject\"`\n+\t\t\tProduct                    string     `json:\"product\"`\n+\t\t\tVulnerabilityName          string     `json:\"vulnerabilityName\"`\n+\t\t\tShortDescription           string     `json:\"shortDescription\"`\n+\t\t\tRequiredAction             string     `json:\"requiredAction\"`\n+\t\t\tKnownRansomwareCampaignUse string     `json:\"knownRansomwareCampaignUse\"`\n+\t\t\tDateAdded                  time.Time  `json:\"dateAdded\"`\n+\t\t\tDueDate                    *time.Time `json:\"dueDate\"`\n+\t\t\tNote                       string     `json:\"note\"`\n+\t\t\tNotes                      string     `json:\"notes\"`\n+\t\t}\n+\t\tbs, err := json.Marshal(kevuln)\n+\t\tif err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tif err := json.Unmarshal(bs, &v); err != nil {\n+\t\t\tcontinue\n+\t\t}\n+\t\tnote := v.Note\n+\t\tif note == \"\" {\n+\t\t\tnote = v.Notes\n+\t\t}\n+\n+\t\tkevs = append(kevs, models.KEV{\n+\t\t\tType:                       models.CISAKEVType,\n+\t\t\tVendorProject:              v.VendorProject,\n+\t\t\tProduct:                    v.Product,\n+\t\t\tVulnerabilityName:          v.VulnerabilityName,\n+\t\t\tShortDescription:           v.ShortDescription,\n+\t\t\tRequiredAction:             v.RequiredAction,\n+\t\t\tKnownRansomwareCampaignUse: v.KnownRansomwareCampaignUse,\n+\t\t\tDateAdded:                  v.DateAdded,\n+\t\t\tDueDate:                    v.DueDate,\n+\t\t\tCISA: &models.CISAKEV{\n+\t\t\t\tNote: note,\n+\t\t\t},\n+\t\t})\n+\t}\n+\treturn kevs\n+}\n+\n type kevulnResponse struct {\n \trequest kevulnRequest\n \tjson    string\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..2b8e88c 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of known exploited vulnerability CVEs.\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -425,6 +433,12 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.Mitigations, func(i, j int) bool {\n \t\t\treturn v.Mitigations[i].URL < v.Mitigations[j].URL\n \t\t})\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n+\t\t})\n \n \t\tv.CveContents.Sort()\n \n@@ -434,9 +448,6 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n-\t\t})\n \t\tr.ScannedCves[k] = v\n \t}\n }\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..8052793 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -263,6 +263,7 @@ type VulnInfo struct {\n \tAffectedPackages     PackageFixStatuses   `json:\"affectedPackages,omitempty\"`\n \tDistroAdvisories     DistroAdvisories     `json:\"distroAdvisories,omitempty\"` // for Amazon, RHEL, Fedora, FreeBSD, Microsoft\n \tCveContents          CveContents          `json:\"cveContents,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tExploits             []Exploit            `json:\"exploits,omitempty\"`\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n@@ -277,6 +278,58 @@ type VulnInfo struct {\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n }\n \n+// KEVType identifies the source of a Known Exploited Vulnerability entry.\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA's Known Exploited Vulnerabilities Catalog.\n+\tCISAKEVType KEVType = \"cisa\"\n+\n+\t// VulnCheckKEVType is VulnCheck's Known Exploited Vulnerabilities data.\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerability information.\n+type KEV struct {\n+\tType                         KEVType        `json:\"type\"`\n+\tVendorProject                string         `json:\"vendorProject,omitempty\"`\n+\tProduct                      string         `json:\"product,omitempty\"`\n+\tVulnerabilityName            string         `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription             string         `json:\"shortDescription,omitempty\"`\n+\tRequiredAction               string         `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse   string         `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                    time.Time      `json:\"dateAdded,omitempty\"`\n+\tDueDate                      *time.Time     `json:\"dueDate,omitempty\"`\n+\tCISA                         *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                    *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA-specific Known Exploited Vulnerability information.\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck-specific Known Exploited Vulnerability information.\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB exploit metadata.\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck reported exploitation metadata.\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n // Alert has CERT alert information\n type Alert struct {\n \tURL   string `json:\"url,omitempty\"`\n@@ -910,24 +963,21 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n+\tCISA   []Alert `json:\"cisa,omitempty\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..f165040 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,8 +566,8 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n+\t\tfor _, kev := range vuln.KEVs {\n+\t\t\tdata = append(data, []string{fmt.Sprintf(\"%s KEV\", strings.ToUpper(string(kev.Type))), kev.VulnerabilityName})\n \t\t}\n \n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\ndiff --git a/sample-kev-scan-result.json b/sample-kev-scan-result.json\nnew file mode 100644\nindex 0000000..0fc7068\n--- /dev/null\n+++ b/sample-kev-scan-result.json\n@@ -0,0 +1,59 @@\n+{\n+  \"jsonVersion\": 0,\n+  \"lang\": \"en\",\n+  \"serverName\": \"localhost\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"reportedAt\": \"2026-07-03T00:00:00Z\",\n+  \"scannedCves\": {\n+    \"CVE-2023-1234\": {\n+      \"cveID\": \"CVE-2023-1234\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"Example Product contains a remote code execution vulnerability.\",\n+          \"requiredAction\": \"Apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2026-07-01T00:00:00Z\",\n+          \"dueDate\": \"2026-07-22T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"Example Vendor\",\n+          \"product\": \"Example Product\",\n+          \"vulnerabilityName\": \"Example Product Remote Code Execution Vulnerability\",\n+          \"shortDescription\": \"VulnCheck reports public exploitation metadata for this CVE.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"XDB-123456\",\n+                \"xdbURL\": \"https://vulncheck.com/xdb/XDB-123456\",\n+                \"dateAdded\": \"2026-07-02T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:vulncheck/xdb-123456.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/research/cve-2023-1234-exploitation\",\n+                \"dateAdded\": \"2026-07-02T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ]\n+    }\n+  },\n+  \"packages\": {},\n+  \"errors\": [],\n+  \"warnings\": []\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..7b4c278 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,13 +812,13 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n+\t\tif len(vinfo.KEVs) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n+\t\t\t\t\"KEV\",\n+\t\t\t\t\"===\",\n \t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n+\t\t\tfor _, kev := range vinfo.KEVs {\n+\t\t\t\tlines = append(lines, fmt.Sprintf(\"* %s: %s\", strings.ToUpper(string(kev.Type)), kev.VulnerabilityName))\n \t\t\t}\n \t\t}\n \n", "creation_timestamp": "2026-07-04T00:01:07.300534Z"}, {"uuid": "c7bf759f-385d-4667-9f77-d0fcfd6ced12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/5a6ee63a97f27bc7d17f699f8399771e", "content": "diff --git a/README.md b/README.md\nindex 57102d1..2b0c5c0 100644\n--- a/README.md\n+++ b/README.md\n@@ -90,8 +90,10 @@ Vuls is a tool created to solve the problems listed above. It has the following\n   - [US-CERT](https://www.us-cert.gov/ncas/alerts)\n   - [JPCERT](http://www.jpcert.or.jp/at/2019.html)\n \n-- CISA(Cybersecurity & Infrastructure Security Agency)\n-  - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+- KEV (Known Exploited Vulnerabilities)\n+  - [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n+  - [VulnCheck KEV](https://vulncheck.com/kev)\n+  - Example config: see [config.toml.example](./config.toml.example)\n \n - Cyber Threat Intelligence(MITRE ATT&CK and CAPEC)\n   - [mitre/cti](https://github.com/mitre/cti)\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..061e670\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,45 @@\n+# config.toml --- Vuls configuration (example)\n+# Copy to config.toml and edit for your environment.\n+# DO NOT commit real credentials.\n+\n+[default]\n+#port = \"22\"\n+#user = \"vuls\"\n+#keyPath = \"/home/vuls/.ssh/id_rsa\"\n+\n+[cvedict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-metasploitdb.sqlite3\"\n+\n+# KEV (Known Exploited Vulnerabilities)\n+# CISA KEV and VulnCheck KEV support\n+[kevuln]\n+type = \"sqlite3\"\n+sqlite3Path = \"/path/to/go-kev.sqlite3\"\n+# To use HTTP instead:\n+# type = \"http\"\n+# url = \"http://kev-server:1328\"\n+\n+[servers]\n+\n+[servers.localhost]\n+host = \"localhost\"\n+port = \"local\"\n+#scanMode = [\"fast\"]\n+#scanModules = [\"ospackages\", \"wordpress\", \"lockfiles\", \"changelogs\"]\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..3d9df02 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,24 +79,13 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n \t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tv, ok := r.ScannedCves[res.request.cveID]\n-\t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n \t\t\t\tnKEV++\n \t\t\t}\n-\t\t\tr.ScannedCves[res.request.cveID] = v\n+\t\t\t// TODO: populate r.ScannedCves[res.request.cveID].KEVs from kevulns\n \t\t}\n \t} else {\n-\t\tfor cveID, vuln := range r.ScannedCves {\n+\t\tfor cveID := range r.ScannedCves {\n \t\t\tif cveID == \"\" {\n \t\t\t\tcontinue\n \t\t\t}\n@@ -108,18 +97,8 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n-\t\t\tr.ScannedCves[cveID] = vuln\n+\t\t\t// TODO: populate vuln.KEVs from kevulns\n \t\t}\n \t}\n \ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..cba5227 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -197,13 +197,14 @@ func (r ScanResult) FormatTextReportHeader() string {\n \t\tpkgs = fmt.Sprintf(\"%s, %d libs\", pkgs, r.LibraryScanners.Total())\n \t}\n \n-\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s\\n%s\\n\",\n+\treturn fmt.Sprintf(\"%s\\n%s\\n%s\\n%s, %s, %s, %s, %s\\n%s\\n\",\n \t\tr.ServerInfo(),\n \t\tbuf.String(),\n \t\tr.ScannedCves.FormatCveSummary(),\n \t\tr.ScannedCves.FormatFixedStatus(r.Packages),\n \t\tr.FormatExploitCveSummary(),\n \t\tr.FormatMetasploitCveSummary(),\n+\t\tr.FormatKEVCveSummary(),\n \t\tr.FormatAlertSummary(),\n \t\tpkgs)\n }\n@@ -251,15 +252,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKEVCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKEVCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKEVCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +275,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -434,8 +442,11 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n \t\t})\n \t\tr.ScannedCves[k] = v\n \t}\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..fde4826 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -257,6 +257,57 @@ type PackageFixStatus struct {\n }\n \n // VulnInfo has a vulnerability information and unsecure packages\n+// KEVType is a type of KEV\n+type KEVType string\n+\n+const (\n+\t// CISAKEVType is CISA KEV\n+\tCISAKEVType KEVType = \"cisa\"\n+\t// VulnCheckKEVType is VulnCheck KEV\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has KEV information\n+type KEV struct {\n+\tType                        KEVType       `json:\"type,omitempty\"`\n+\tVendorProject               string        `json:\"vendorProject,omitempty\"`\n+\tProduct                     string        `json:\"product,omitempty\"`\n+\tVulnerabilityName           string        `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription            string        `json:\"shortDescription,omitempty\"`\n+\tRequiredAction              string        `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse  string        `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                   time.Time     `json:\"dateAdded,omitempty\"`\n+\tDueDate                     *time.Time    `json:\"dueDate,omitempty\"`\n+\tCISA                        *CISAKEV      `json:\"cisa,omitempty\"`\n+\tVulnCheck                   *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck KEV information\n+type VulnCheckKEV struct {\n+\tXDB                   []VulnCheckXDB                   `json:\"xdb,omitempty\"`\n+\tReportedExploitation  []VulnCheckReportedExploitation  `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID        string    `json:\"xdbID,omitempty\"`\n+\tXDBURL       string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded    time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType  string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL  string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck ReportedExploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n type VulnInfo struct {\n \tCveID                string               `json:\"cveID,omitempty\"`\n \tConfidences          Confidences          `json:\"confidences,omitempty\"`\n@@ -275,6 +326,7 @@ type VulnInfo struct {\n \tWindowsKBFixedIns    []string             `json:\"windowsKBFixedIns,omitempty\"`\n \tVulnType             string               `json:\"vulnType,omitempty\"`\n \tDiffStatus           DiffStatus           `json:\"diffStatus,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n }\n \n // Alert has CERT alert information\n@@ -910,24 +962,20 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..a2dfbd0 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -204,6 +204,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatUpdatablePkgsSummary(),\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n \t\t\t}\n \t\t} else {\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample_kev_result.json b/sample_kev_result.json\nnew file mode 100644\nindex 0000000..e22077b\n--- /dev/null\n+++ b/sample_kev_result.json\n@@ -0,0 +1,60 @@\n+{\n+  \"jsonVersion\": 1,\n+  \"serverName\": \"example-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"22.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability\",\n+          \"shortDescription\": \"Example vulnerability in ExampleProduct allows remote code execution.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\",\n+          \"knownRansomwareCampaignUse\": \"Known\",\n+          \"dateAdded\": \"2023-01-15T00:00:00Z\",\n+          \"dueDate\": \"2023-02-05T00:00:00Z\",\n+          \"cisa\": {\n+            \"note\": \"Example note\"\n+          }\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vendorProject\": \"ExampleVendor\",\n+          \"product\": \"ExampleProduct\",\n+          \"vulnerabilityName\": \"Example Vulnerability (VulnCheck)\",\n+          \"shortDescription\": \"VulnCheck reported exploitation.\",\n+          \"requiredAction\": \"Apply mitigations.\",\n+          \"knownRansomwareCampaignUse\": \"Unknown\",\n+          \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+          \"vulncheck\": {\n+            \"xdb\": [\n+              {\n+                \"xdbID\": \"12345\",\n+                \"xdbURL\": \"https://example.com/xdb/12345\",\n+                \"dateAdded\": \"2023-01-20T00:00:00Z\",\n+                \"exploitType\": \"remote\",\n+                \"cloneSSHURL\": \"git@example.com:exploit.git\"\n+              }\n+            ],\n+            \"reportedExploitation\": [\n+              {\n+                \"url\": \"https://example.com/report\",\n+                \"dateAdded\": \"2023-01-21T00:00:00Z\"\n+              }\n+            ]\n+          }\n+        }\n+      ],\n+      \"cveContents\": {},\n+      \"confidences\": [],\n+      \"affectedPackages\": []\n+    }\n+  },\n+  \"packages\": {},\n+  \"scannedAt\": \"2026-07-03T00:00:00Z\",\n+  \"reportedAt\": \"2026-07-03T00:00:00Z\"\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-04T00:01:07.790727Z"}, {"uuid": "66d25c11-28b0-4399-b074-ff9ac9c67ba6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-12345", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/02513bd06628d1d402b8c22f6cca3359", "content": "diff --git a/README.md b/README.md\nindex 57102d1..fe28073 100644\n--- a/README.md\n+++ b/README.md\n@@ -156,6 +156,10 @@ Vuls has some options to detect the vulnerabilities\n \n - [Scan WordPress](https://vuls.io/docs/en/usage-scan-wordpress.html)\n \n+## Configuration\n+\n+A ready-to-use synthetic example configuration is available in [config.toml.example](config.toml.example).\n+\n ## MISC\n \n - Nondestructive testing\ndiff --git a/config.toml.example b/config.toml.example\nnew file mode 100644\nindex 0000000..c399f4c\n--- /dev/null\n+++ b/config.toml.example\n@@ -0,0 +1,28 @@\n+[servers]\n+\n+[servers.synthetic-server]\n+host         = \"192.0.2.100\"\n+port         = \"22\"\n+user         = \"synthetic-user\"\n+keyPath      = \"/synthetic/path/to/id_rsa\"\n+scanMode     = [\"fast\"]\n+\n+[cveDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/cve.sqlite3\"\n+\n+[ovalDict]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/oval.sqlite3\"\n+\n+[gost]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/gost.sqlite3\"\n+\n+[exploit]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/go-exploitdb.sqlite3\"\n+\n+[kevuln]\n+type = \"sqlite3\"\n+SQLite3Path = \"/path/to/go-kev.sqlite3\"\ndiff --git a/detector/kevuln.go b/detector/kevuln.go\nindex 41afdfe..f0230da 100644\n--- a/detector/kevuln.go\n+++ b/detector/kevuln.go\n@@ -79,18 +79,8 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\treturn err\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n \t\t\tv, ok := r.ScannedCves[res.request.cveID]\n \t\t\tif ok {\n-\t\t\t\tv.AlertDict.CISA = alerts\n \t\t\t\tnKEV++\n \t\t\t}\n \t\t\tr.ScannedCves[res.request.cveID] = v\n@@ -108,16 +98,6 @@ func FillWithKEVuln(r *models.ScanResult, cnf config.KEVulnConf, logOpts logging\n \t\t\t\tcontinue\n \t\t\t}\n \n-\t\t\talerts := []models.Alert{}\n-\t\t\tif len(kevulns) > 0 {\n-\t\t\t\talerts = append(alerts, models.Alert{\n-\t\t\t\t\tTitle: \"Known Exploited Vulnerabilities Catalog\",\n-\t\t\t\t\tURL:   \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\",\n-\t\t\t\t\tTeam:  \"cisa\",\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tvuln.AlertDict.CISA = alerts\n \t\t\tnKEV++\n \t\t\tr.ScannedCves[cveID] = vuln\n \t\t}\ndiff --git a/models/scanresults.go b/models/scanresults.go\nindex 508b992..85d5808 100644\n--- a/models/scanresults.go\n+++ b/models/scanresults.go\n@@ -251,15 +251,22 @@ func (r ScanResult) FormatMetasploitCveSummary() string {\n \treturn fmt.Sprintf(\"%d exploits\", nMetasploitCve)\n }\n \n+// FormatKEVCveSummary returns a summary of KEV cve\n+func (r ScanResult) FormatKEVCveSummary() string {\n+\tnKevCve := 0\n+\tfor _, vuln := range r.ScannedCves {\n+\t\tif 0 < len(vuln.KEVs) {\n+\t\t\tnKevCve++\n+\t\t}\n+\t}\n+\treturn fmt.Sprintf(\"%d kevs\", nKevCve)\n+}\n+\n // FormatAlertSummary returns a summary of CERT alerts\n func (r ScanResult) FormatAlertSummary() string {\n-\tcisaCnt := 0\n \tuscertCnt := 0\n \tjpcertCnt := 0\n \tfor _, vuln := range r.ScannedCves {\n-\t\tif len(vuln.AlertDict.CISA) > 0 {\n-\t\t\tcisaCnt += len(vuln.AlertDict.CISA)\n-\t\t}\n \t\tif len(vuln.AlertDict.USCERT) > 0 {\n \t\t\tuscertCnt += len(vuln.AlertDict.USCERT)\n \t\t}\n@@ -267,7 +274,7 @@ func (r ScanResult) FormatAlertSummary() string {\n \t\t\tjpcertCnt += len(vuln.AlertDict.JPCERT)\n \t\t}\n \t}\n-\treturn fmt.Sprintf(\"cisa: %d, uscert: %d, jpcert: %d alerts\", cisaCnt, uscertCnt, jpcertCnt)\n+\treturn fmt.Sprintf(\"uscert: %d, jpcert: %d alerts\", uscertCnt, jpcertCnt)\n }\n \n func (r ScanResult) isDisplayUpdatableNum(mode config.ScanMode) bool {\n@@ -434,8 +441,11 @@ func (r *ScanResult) SortForJSONOutput() {\n \t\tsort.Slice(v.AlertDict.JPCERT, func(i, j int) bool {\n \t\t\treturn v.AlertDict.JPCERT[i].Title < v.AlertDict.JPCERT[j].Title\n \t\t})\n-\t\tsort.Slice(v.AlertDict.CISA, func(i, j int) bool {\n-\t\t\treturn v.AlertDict.CISA[i].Title < v.AlertDict.CISA[j].Title\n+\t\tsort.Slice(v.KEVs, func(i, j int) bool {\n+\t\t\tif v.KEVs[i].Type != v.KEVs[j].Type {\n+\t\t\t\treturn v.KEVs[i].Type < v.KEVs[j].Type\n+\t\t\t}\n+\t\t\treturn v.KEVs[i].VulnerabilityName < v.KEVs[j].VulnerabilityName\n \t\t})\n \t\tr.ScannedCves[k] = v\n \t}\ndiff --git a/models/scanresults_test.go b/models/scanresults_test.go\nindex d429281..fb17f7c 100644\n--- a/models/scanresults_test.go\n+++ b/models/scanresults_test.go\n@@ -225,10 +225,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -288,10 +290,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -354,10 +358,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\n@@ -417,10 +423,12 @@ func TestScanResult_Sort(t *testing.T) {\n \t\t\t\t\t\t\t\t{Title: \"a\"},\n \t\t\t\t\t\t\t\t{Title: \"b\"},\n \t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\tCISA: []Alert{\n-\t\t\t\t\t\t\t\t{Title: \"a\"},\n-\t\t\t\t\t\t\t\t{Title: \"b\"},\n-\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tKEVs: []KEV{\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: CISAKEVType, VulnerabilityName: \"b\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"a\"},\n+\t\t\t\t\t\t\t{Type: VulnCheckKEVType, VulnerabilityName: \"b\"},\n \t\t\t\t\t\t},\n \t\t\t\t\t},\n \t\t\t\t},\ndiff --git a/models/vulninfos.go b/models/vulninfos.go\nindex 3e85e81..85e3f66 100644\n--- a/models/vulninfos.go\n+++ b/models/vulninfos.go\n@@ -267,6 +267,7 @@ type VulnInfo struct {\n \tMetasploits          []Metasploit         `json:\"metasploits,omitempty\"`\n \tMitigations          []Mitigation         `json:\"mitigations,omitempty\"`\n \tCtis                 []string             `json:\"ctis,omitempty\"`\n+\tKEVs                 []KEV                `json:\"kevs,omitempty\"`\n \tAlertDict            AlertDict            `json:\"alertDict,omitempty\"`\n \tCpeURIs              []string             `json:\"cpeURIs,omitempty\"` // CpeURIs related to this CVE defined in config.toml\n \tGitHubSecurityAlerts GitHubSecurityAlerts `json:\"gitHubSecurityAlerts,omitempty\"`\n@@ -910,24 +911,69 @@ type Mitigation struct {\n \tURL            string         `json:\"url,omitempty\"`\n }\n \n-// AlertDict has target cve JPCERT, USCERT and CISA alert data\n+// KEVType is a type of KEV\n+type KEVType string\n+\n+const (\n+\tCISAKEVType      KEVType = \"cisa\"\n+\tVulnCheckKEVType KEVType = \"vulncheck\"\n+)\n+\n+// KEV has Known Exploited Vulnerabilities information\n+type KEV struct {\n+\tType                       KEVType      `json:\"type,omitempty\"`\n+\tVendorProject              string       `json:\"vendorProject,omitempty\"`\n+\tProduct                    string       `json:\"product,omitempty\"`\n+\tVulnerabilityName          string       `json:\"vulnerabilityName,omitempty\"`\n+\tShortDescription           string       `json:\"shortDescription,omitempty\"`\n+\tRequiredAction             string       `json:\"requiredAction,omitempty\"`\n+\tKnownRansomwareCampaignUse string       `json:\"knownRansomwareCampaignUse,omitempty\"`\n+\tDateAdded                  time.Time    `json:\"dateAdded,omitempty\"`\n+\tDueDate                    *time.Time   `json:\"dueDate,omitempty\"`\n+\tCISA                       *CISAKEV     `json:\"cisa,omitempty\"`\n+\tVulnCheck                  *VulnCheckKEV `json:\"vulncheck,omitempty\"`\n+}\n+\n+// CISAKEV has CISA specific KEV information\n+type CISAKEV struct {\n+\tNote string `json:\"note,omitempty\"`\n+}\n+\n+// VulnCheckKEV has VulnCheck specific KEV information\n+type VulnCheckKEV struct {\n+\tXDB                  []VulnCheckXDB                  `json:\"xdb,omitempty\"`\n+\tReportedExploitation []VulnCheckReportedExploitation `json:\"reportedExploitation,omitempty\"`\n+}\n+\n+// VulnCheckXDB has VulnCheck XDB information\n+type VulnCheckXDB struct {\n+\tXDBID       string    `json:\"xdbID,omitempty\"`\n+\tXDBURL      string    `json:\"xdbURL,omitempty\"`\n+\tDateAdded   time.Time `json:\"dateAdded,omitempty\"`\n+\tExploitType string    `json:\"exploitType,omitempty\"`\n+\tCloneSSHURL string    `json:\"cloneSSHURL,omitempty\"`\n+}\n+\n+// VulnCheckReportedExploitation has VulnCheck Reported Exploitation information\n+type VulnCheckReportedExploitation struct {\n+\tURL       string    `json:\"url,omitempty\"`\n+\tDateAdded time.Time `json:\"dateAdded,omitempty\"`\n+}\n+\n+// AlertDict has target cve JPCERT and USCERT alert data\n type AlertDict struct {\n-\tCISA   []Alert `json:\"cisa\"`\n \tJPCERT []Alert `json:\"jpcert\"`\n \tUSCERT []Alert `json:\"uscert\"`\n }\n \n // IsEmpty checks if the content of AlertDict is empty\n func (a AlertDict) IsEmpty() bool {\n-\treturn len(a.CISA) == 0 && len(a.JPCERT) == 0 && len(a.USCERT) == 0\n+\treturn len(a.JPCERT) == 0 && len(a.USCERT) == 0\n }\n \n // FormatSource returns which source has this alert\n func (a AlertDict) FormatSource() string {\n \tvar s []string\n-\tif len(a.CISA) != 0 {\n-\t\ts = append(s, \"CISA\")\n-\t}\n \tif len(a.USCERT) != 0 || len(a.JPCERT) != 0 {\n \t\ts = append(s, \"CERT\")\n \t}\ndiff --git a/reporter/util.go b/reporter/util.go\nindex d9cfdaa..5b8697f 100644\n--- a/reporter/util.go\n+++ b/reporter/util.go\n@@ -205,6 +205,7 @@ func formatOneLineSummary(rs ...models.ScanResult) string {\n \t\t\t\tr.FormatExploitCveSummary(),\n \t\t\t\tr.FormatMetasploitCveSummary(),\n \t\t\t\tr.FormatAlertSummary(),\n+\t\t\t\tr.FormatKEVCveSummary(),\n \t\t\t}\n \t\t} else {\n \t\t\tcols = []interface{}{\n@@ -565,10 +566,6 @@ No CVE-IDs are found in updatable packages.\n \t\t})\n \t\tdata = append(data, ds...)\n \n-\t\tfor _, alert := range vuln.AlertDict.CISA {\n-\t\t\tdata = append(data, []string{\"CISA Alert\", alert.URL})\n-\t\t}\n-\n \t\tfor _, alert := range vuln.AlertDict.JPCERT {\n \t\t\tdata = append(data, []string{\"JPCERT Alert\", alert.URL})\n \t\t}\ndiff --git a/sample-scan-result.json b/sample-scan-result.json\nnew file mode 100644\nindex 0000000..6fa4d81\n--- /dev/null\n+++ b/sample-scan-result.json\n@@ -0,0 +1,23 @@\n+{\n+  \"serverName\": \"synthetic-server\",\n+  \"family\": \"ubuntu\",\n+  \"release\": \"20.04\",\n+  \"scannedCves\": {\n+    \"CVE-2023-12345\": {\n+      \"cveID\": \"CVE-2023-12345\",\n+      \"kevs\": [\n+        {\n+          \"type\": \"cisa\",\n+          \"vulnerabilityName\": \"Test Vulnerability\",\n+          \"shortDescription\": \"This is a test KEV.\",\n+          \"requiredAction\": \"Apply updates per vendor instructions.\"\n+        },\n+        {\n+          \"type\": \"vulncheck\",\n+          \"vulnerabilityName\": \"Test VulnCheck KEV\",\n+          \"shortDescription\": \"This is a VulnCheck KEV.\"\n+        }\n+      ]\n+    }\n+  }\n+}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 4407f56..80afe95 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -812,16 +812,6 @@ func setChangelogLayout(g *gocui.Gui) error {\n \t\t\t}\n \t\t}\n \n-\t\tif len(vinfo.AlertDict.CISA) > 0 {\n-\t\t\tlines = append(lines, \"\\n\",\n-\t\t\t\t\"CISA Alert\",\n-\t\t\t\t\"===========\",\n-\t\t\t)\n-\t\t\tfor _, alert := range vinfo.AlertDict.CISA {\n-\t\t\t\tlines = append(lines, fmt.Sprintf(\"* [%s](%s)\", alert.Title, alert.URL))\n-\t\t\t}\n-\t\t}\n-\n \t\tif len(vinfo.AlertDict.USCERT) > 0 {\n \t\t\tlines = append(lines, \"\\n\",\n \t\t\t\t\"USCERT Alert\",\n", "creation_timestamp": "2026-07-04T00:01:07.685560Z"}]}