---
title: "CVE exploit scan detection with a 7-day look-back · camada"
description: "camada matches your traffic against CVE exploit signatures refreshed daily from CISA KEV and open rule sets, and looks back 7 days when a new CVE appears."
url: https://www.camada.app/use-cases/cve-exploits
last_updated: 2026-10-31
---

Use case

# Find the clients probing your app for known CVEs

When a CVE is published, scanners try it on every app they can reach within hours. camada checks your traffic against exploit signatures refreshed every day, and when a new CVE appears it looks back over the last 7 days to tell you who probed for it before anyone had a signature.

[Get started free](https://my.camada.app/) [How camada works →](https://www.camada.app/how-it-works)

The pattern

## What it looks like in your traffic

- Requests for exploit paths of products you may not even run.
- Payloads in the query string or headers that match a published exploit template.
- One client trying several CVEs in a row, then moving on.

Detection

## How camada scores it

| What camada looks for | Score |
| --- | --- |
| A request matched a CVE that CISA lists as actively exploited (KEV) | `+60` |
| A request matched a CVE signature that is not on the KEV list | `+30` |
| Web shell or exploit-kit path (shell.php, /vendor/phpunit, /boaform) | `+60` |
| Secret or config file probe | `+30 per path, up to 60` |

Signatures are compiled every day from CISA Known Exploited Vulnerabilities, CrowdSec virtual-patching rules, the Emerging Threats Open rule set and nuclei templates. A finding names the CVE and, when camada knows your stack, says whether you run the affected product.

A sample of the rules, with their default weights. The full pipeline and more rules are on [how it works](https://www.camada.app/how-it-works).

Setup

## Set it up

1. Install the SDK for your framework. Nothing else to configure: every project gets the signature feed. [Framework quickstarts →](https://www.camada.app/frameworks)
2. Tell camada what you run, so a finding says "you run Confluence" or "not your stack". [Memory →](https://www.camada.app/docs/memory)
3. Send alerts to email, Slack or a signed webhook, depending on your plan. [Webhook payload →](https://www.camada.app/docs/webhooks)

Limits

## What camada does not do

- camada does not patch your code. Patch the CVE; camada finds and blocks the clients probing for it.
- A single exploit request reaches your app. camada blocks the client from the next run, once enforcement is on.
- Signatures match the path, the query and some request headers. Request bodies, cookies and Authorization values never leave your app, so signatures on them cannot match.

Questions

## Common questions

### What does the 7-day look-back do?

Every day camada claims the CVEs its feed listed for the first time. It then re-scans each project's last 7 days of raw events for requests that matched those CVEs before they were listed, and sends one alert per project when it finds any.

### Where do the signatures come from?

CISA Known Exploited Vulnerabilities (for the actively exploited flag), CrowdSec hub virtual-patching rules, the Emerging Threats Open rule set and nuclei templates. They are refreshed once a day.

### Is this a WAF?

No. A WAF inspects each request before your app answers. camada scores clients over a window, then your app blocks the ones judged malicious. You can keep a WAF or CDN in front of your app and run camada inside it.

Other attacks camada handles: [Credential stuffing](https://www.camada.app/use-cases/credential-stuffing) · [Scraping](https://www.camada.app/use-cases/scraping) · [AI agent abuse](https://www.camada.app/use-cases/ai-agents). Plans and the 14-day trial: [pricing](https://www.camada.app/pricing).

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)