Weekly CISA KEV patch digest for n8n

By Runbook Foundry.

Every Monday at 08:00, this n8n workflow downloads the public CISA Known Exploited Vulnerabilities (KEV) JSON feed and emails your team an HTML digest of the entries added in the previous week (Mon-Sun). Vendors on your watchlist are starred and listed first. Each row shows the CVE, product, date added, CISA due date, known ransomware use and required action. No API key is needed.

Download the workflow JSON

How the date window works

CISA's dateAdded field is a date only, with no time or time zone. The workflow compares it with the run's UTC date, as strings: dateAdded >= start && dateAdded < today, where start is 7 days before today. A Monday run therefore covers the previous Monday to Sunday, and anything CISA adds on the Monday itself shows up in the next Monday's digest. Each entry is reported exactly once, as long as the workflow runs every Monday. A missed or failed run loses that week.

Time zone. "Every Monday 08:00" uses the workflow's time zone: workflow Settings > Timezone or, if unset, the instance's GENERIC_TIMEZONE, which defaults to America/New_York (self-hosted; on n8n Cloud the default is the owner's detected time zone, or GMT). The window is based on the run's UTC date. If your time zone is more than 8 hours ahead of UTC (for example Tokyo, Sydney, Auckland), Monday 08:00 local is still Sunday in UTC, so each digest covers Sunday–Saturday and the email says "from <date> to <date>". Entries are still reported once. For a Monday–Sunday window there, set the trigger hour to at least your UTC offset, rounded up, using your summer offset if you have daylight saving (e.g. 09:00 in Tokyo, 11:00 in Sydney, 13:00 in Auckland). If a Monday run fails, that week isn't re-sent automatically. Re-run it on the same UTC date by executing the workflow from the Every Monday 08:00 node; Test workflow only does a dry run and sends nothing.

Use it

1. Download kev-patch-digest.json and import it in n8n (Workflows > Import from File). It imports inactive, with no credentials attached.
2. In Filter & build digest, edit WATCHLIST. Leave LOOKBACK_DAYS at 7 for the weekly schedule.
3. Attach an SMTP credential to Email digest and replace REPLACE-patch-team@example.com.
4. Click Test workflow. It downloads the live feed and stops before sending anything. When the output looks right, activate the workflow.

Tested on self-hosted n8n 2.44.7 against the live feed. Not tested on n8n Cloud or n8n 1.x.

Setup notes are in the sticky notes inside the workflow.

Data

CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CC0 1.0. Use of this data does not imply endorsement by CISA or DHS.

AI-use disclosure: Runbook Foundry built this workflow with AI assistance. It was imported and test-run in n8n.

Not affiliated with, endorsed by, or sponsored by CISA or n8n GmbH. n8n is a trademark of n8n GmbH.

License: free to use and adapt for one organization's internal use. You may share it unmodified with attribution to Runbook Foundry. Not for resale, and not for republishing as a template or product.

Provided as is, without warranty. Review it and test it before you rely on it.