Here are solid RSS feeds focused on zero-day (0-day) and actively exploitable vulnerabilities. True 0-days (unpatched, actively exploited or publicly disclosed with no fix yet) are rare and often appear first via coordinated disclosure programs, exploit databases, or known-exploited lists rather than generic CVE feeds.
zerodayinitiative.comTop recommendations for 0-day / exploitable issues
- Zero Day Initiative (ZDI) – Upcoming Advisories
https://www.zerodayinitiative.com/rss/upcoming/
Excellent for early heads-up. Vulnerabilities appear here once the vendor is notified and the public-disclosure countdown starts (often before a patch or full advisory). - Zero Day Initiative (ZDI) – Published Advisories
https://www.zerodayinitiative.com/rss/published/
Released advisories (many involve high-impact bugs that started as 0-days). - ZDI Blog
https://www.zerodayinitiative.com/blog?format=rss (or https://www.thezdi.com/blog?format=rss)
Research write-ups, Pwn2Own results, and deeper analysis. - Exploit-DB
https://www.exploit-db.com/rss.xml
Public exploits, PoCs, and many 0-day / remote/local/webapp issues as they are published. Very practical for “exploitable right now.” community.emergingthreats.net - Full Disclosure mailing list
https://seclists.org/rss/fulldisclosure.rss
Raw researcher disclosures; frequently includes new or unpatched issues.
Known Exploited / high-priority (often recent 0-days that hit the wild)CISA’s official KEV RSS was discontinued, so use these maintained alternatives:
- https://cisa.kevintel.com/rss.xml (community-maintained, updates frequently)
- https://vulnerability.circl.lu/known-exploited-vulnerabilities.rss (or .atom)
- CVEDatabase KEV additions: https://cvedatabase.com/feed/cve/kev
Other useful high-signal feeds
- Talos Vulnerability Reports: https://www.talosintelligence.com/vulnerability_reports/feed
- watchTowr Labs: https://labs.watchtowr.com/feed (or /rss/)
- Critical/high CVEs (broader but useful filter):
- https://cvedatabase.com/feed/cve/critical
- https://cvedatabase.com/feed/cve/high
- Recent CVEs: https://cvedatabase.com/feed/cve/recent
Quick tips
- Subscribe to the ZDI upcoming + Exploit-DB + a KEV feed combination for the best coverage of true 0-days and actively exploited issues.
- Use a good RSS reader (Feedly, Inoreader, NewsBlur, or a self-hosted option like FreshRSS/Tiny Tiny RSS) and apply keyword filters (e.g., “0-day”, “zero-day”, “RCE”, “unauthenticated”, high CVSS) if the volume is high.
- Pair with X/Twitter lists of vulnerability researchers or Project Zero for the absolute earliest chatter, then cross-check the RSS items.
- HITCON ZeroDay has some community RSS generators on GitHub if you want additional regional coverage, but the ones above are the most reliable mainstream sources.
These should keep you current without drowning in every low-severity CVE. Start with the ZDI upcoming and Exploit-DB feeds.