kev-check

A small, deliberately narrow tool: paste CVE identifiers, get back which of them appear in CISA’s Known Exploited Vulnerabilities catalogue. It’s free: enter your email address and sign in with the one-time code sent to it. No password, nothing to register.

Why it exists

The KEV catalogue is published as a machine-readable feed, which is great if you have a pipeline and unhelpful if you have a spreadsheet from a scanner and twenty minutes. The gap between “the data is public” and “I can act on it right now” is where most small tools live.

How it is built

• FastAPI with Jinja2 templates, served by Gunicorn
• Azure App Service
• Cloudflare in front, with a Worker that forwards to Azure
• Cloudflare Access with an email one-time PIN as the only way in
• The app answers only requests that come through the Worker, so going to Azure directly doesn’t get around the sign-in
• The KEV feed cached for 24 hours rather than fetched per request
• Every change passes code scanning, dependency scanning and tests before it can merge; a dependency with a known high or critical vulnerability blocks the deploy

Closed source, free to use.

Why there is a sign-in

The tool is free, so the sign-in is not a paywall. It started as a guest list, where only invited addresses got a code. Asking first turned out to be more friction than the tool was worth, so now any address gets one. Every request still comes from someone who proved they hold a real mailbox, which gives me a short audit trail and shuts out anonymous scripts that would otherwise hammer the app. A one-time PIN keeps the cost low on your side: no password to create, nothing to remember next time. The address is used only to sign you in.

What it deliberately does not do

It does not tell you what to patch. KEV membership is one input to prioritization, not the answer. Exposure and asset criticality are yours to supply.