n8n Workflow: Scan Dependency CVEs with OSV.dev & CISA KEV

Scan Dependency CVEs Daily with OSV.dev + CISA KEV (and get only high-risk alerts)

This n8n workflow automatically checks your listed dependencies against OSV.dev vulnerabilities and the CISA Known Exploited Vulnerabilities (KEV) catalog, uses Anthropic Claude to assess applicability and draft fixes, logs everything to Google Sheets, and emails high-risk items via Gmail.

What this workflow does

• Runs daily on a schedule (or manually for testing) to load your monitored dependency inventory and versions.
• Pulls the CISA KEV feed and submits your dependency list to the OSV.dev batch query API.
• Expands results per vulnerability, then retrieves full advisory details for each finding from OSV.dev.
• Deduplicates items already reported in previous runs, flags advisories whose CVEs appear in CISA KEV, and collects a capped list of new findings.
• Uses Anthropic Claude to evaluate whether each vulnerability likely applies to your specific stack and to draft concrete upgrade/configuration fixes.
• Logs every assessed finding to Google Sheets and marks vulnerability IDs as reported so they aren’t re-sent.
• Filters alerts to items that are actively exploited or critical/high and then sends an HTML digest through Gmail.

Use cases

• SaaS teams that need continuous dependency risk monitoring without a full security platform.
• Automation engineers building CVEs-to-actions pipelines with n8n and AI-assisted triage.
• Ops teams who want fast visibility into actively exploited vulnerabilities affecting their current stack.

Technical details

• n8n nodes/tools used: Code, HTTP Request, Google Sheets, Gmail, Manual Trigger, and support notes via Sticky Note.
• External systems: OSV.dev (batch query + advisory details), CISA KEV feed, Anthropic Claude for vulnerability applicability and fix drafting.
• Output: Google Sheets audit log + Gmail email alerts for high-risk findings.

Setup: Add credentials for Anthropic (Claude API), Google Sheets, and Gmail, then update your dependency list (ecosystem, package name, and exact versions).