Exploited Now feeds

CISA-confirmed only:
  RSS   https://data.exploitednow.org/kev.xml
  JSON  https://data.exploitednow.org/kev.json

CISA plus the EU's exploited list:
  RSS   https://data.exploitednow.org/all.xml
  JSON  https://data.exploitednow.org/all.json

Early signs, UNCONFIRMED (reported as exploited, not on CISA's list yet):
  RSS   https://data.exploitednow.org/early.xml
  JSON  https://data.exploitednow.org/early.json

One vendor only: add ?vendor= with CISA's vendor name, like https://data.exploitednow.org/kev.xml?vendor=apple

P0-P2 in titles is Exploited Now's own order from public signals, not CISA's.
The page: https://exploitednow.org/