Public threat feed. Free, open, machine-readable.
Safeguard publishes a public threat feed covering high-severity supply-chain CVEs, malicious-package alerts, and exploit-availability changes — free for any team to consume. RSS is live today, from Safeguard Gold. JSON for automation, STIX 2.1 for SIEM and TIP ingest and a Slack webhook for an incident channel are coming soon.
One feed, four shapes.
Same content, different transports. RSS is live today; the other three are coming soon.
GET https://gold.safeguard.sh/feed/trending.xmlLive now, from Safeguard Gold. RSS 2.0 with CVEs newly added to CISA's Known Exploited Vulnerabilities catalog and recent open-source supply-chain attacks. Gold also publishes /feed/kev.xml and /feed/malware.xml for each on its own.
For automation: the same items as JSON. Until it ships, poll the RSS feed.
For SIEM and TIP ingest: each item as a STIX 2.1 indicator bundle.
For your incident channel: filtered items posted to Slack.
Six categories of actionable signal.
No raw CVE firehose. Every item is filtered through the same pipeline that powers the platform — high signal, structured, prioritised for impact.
Newly-disclosed CVEs with EPSS + KEV
High-severity CVEs surfaced as they hit NVD and OSV, annotated with current EPSS score and a KEV flag when the CVE is on CISA's Known Exploited Vulnerabilities list.
Malicious-package detections
Malware in npm, PyPI, Maven, NuGet, and crates.io as we observe takedowns, install-time hook patterns, and typosquat campaigns. Each item carries package coordinates and the trigger that flagged it.
Exploit-availability changes
When a public proof-of-concept is published, or when a CVE crosses the threshold to in-the-wild exploitation. Useful for prioritising fixes against active risk, not theoretical risk.
Significant SBOM-affecting library compromises
Compromised releases of widely-depended-on libraries — typically catastrophic-blast-radius events where a single bad version becomes a transitive dependency for a meaningful slice of the ecosystem.
Maintainer-takeover alerts
Suspicious maintainer changes on widely-used packages — fresh accounts publishing under aged identities, dormant accounts suddenly releasing, registry-handle handoffs without provenance trail.
Our own coordinated disclosures
When Safeguard's research team publishes an advisory, the same item appears on the feed with the CVE, ecosystem, and link to the full write-up on /research.
One entry, end to end.
The fields a JSON item will carry when that shape ships. STIX 2.1 will wrap the same payload in an indicator bundle.
{
"id": "sg-tf-2026-09812",
"published_at": "2026-04-28T14:22:11Z",
"title": "Unsafe deserialization in popular Node logging library",
"ecosystem": "npm",
"severity": "critical",
"cve": "CVE-2026-12345",
"epss": 0.86,
"kev": false,
"affected_versions": ">=3.0.0 <4.2.1",
"fixed_versions": ">=4.2.1",
"suspected_malicious": false,
"source": "safeguard.research",
"references": [
"https://safeguard.sh/research/cve-2026-12345",
"https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
"https://osv.dev/vulnerability/CVE-2026-12345"
]
}Today's RSS feed carries each item's title, link, description and category.
Continuous, rolling, versioned.
Free to use, with attribution.
The feed is free for any team to consume — startup, enterprise, hobbyist, or academic. Attribution is required when you republish derived content: Source: Safeguard Threat Feed, https://safeguard.sh/threat-feed. Commercial redistribution as a standalone product requires written permission. The feed is provided without warranty; verify items against your own threat model before acting on them.
Wire it into your pipeline.
Subscribe in the shape that fits your stack. Need the same signal scoped to your SBOM? That's what the platform does.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.