Patch what attackers are using

Thousands of CVEs are published every month; a few hundred are ever exploited. Get every new CVE with its score and affected products, and know the moment one is confirmed exploited in the wild.

For security teams, MSPs, IT departments and the agents that triage for them.

Get these events How it works

The events

What your agent listens to

  • New vulnerability (CVE)

    vulnerability.published

    Ready National vulnerability database, worldwide

    CVE-2026-41027 (critical, 9.8): remote code execution in Nordvik EdgeGate

  • Vulnerability exploited in the wild

    vulnerability.exploited

    Ready Government list of exploited vulnerabilities, worldwide

    Exploited in the wild: CVE-2026-41027 (Nordvik EdgeGate)

  • Open-source security advisory

    vulnerability.advisory_published

    Ready Open-source security advisories, worldwide

    GHSA-7x2q-4m9c-hv3p (high): Path traversal in nordvik-uploads

  • Exploit published

    exploit.published

    Ready Public exploit archive, worldwide

    Exploit published: Nordvik EdgeGate 4.2.0 - Remote Code Execution

How it works

From event to action

  1. A CVE is published, or one is confirmed exploited in the wild.
  2. Your agent checks the affected vendors and products against your inventory.
  3. It ranks by exploitation, severity and exposure, and opens a ticket with the fix.
  4. Exploited ones come with the fix deadline US agencies are given, a sensible deadline for you too.

Wake your agents up. Each event can start Claude Code, Codex or your own script the moment it lands, one by one or in batches: no polling, no cron, no dashboard to check.

Events carry text from public sources. Run agents that act on them isolated, with only the access the task needs. Run them safely

Create your own stream

Tell your agent
npx worldsignals watch --type vulnerability.published,vulnerability.exploited,vulnerability.advisory_published,exploit.published \
    --agent claude --prompt ./brief.md

# brief.md
When a CVE affects anything in our software inventory, open a ticket with the severity and the fix; if it is exploited in the wild, page the on-call engineer.

Questions

About this use case

Where do the vulnerabilities come from?

New CVEs from the national vulnerability database, with CVSS scores, weaknesses and affected products; exploited ones from the US government’s list of vulnerabilities exploited in the wild.

Is it real time?

New CVEs are read every 15 minutes and the exploited list every hour.

Can I filter by severity or vendor?

Every event carries the CVSS score and severity, the weaknesses and the affected vendors and products.

More use cases

Give your agents something to notice

Join the waiting list, free during early access. Pick these events and we’ll email you when you’re in.

Get these events See the live stream