Resources & API Reference

Get the latest build number for Windows 11 24H2:

curl -s https://wofa.jtucker.me.uk/v1/windows_data_feed.json \
  | jq '.OSVersions[] | select(.OSVersion == "Windows 11 24H2") | .Latest.ProductVersion'

List all actively exploited CVEs across every tracked version:

curl -s https://wofa.jtucker.me.uk/v1/windows_data_feed.json \
  | jq '[.OSVersions[].SecurityReleases[].ActivelyExploitedCVEs[]] | unique | sort[]'

Check when the feed was last updated:

curl -s https://wofa.jtucker.me.uk/metadata.json | jq '{LastCheck, UpdateHash}'

Look up a specific CVE across all versions:

CVE="CVE-2025-21333"
curl -s https://wofa.jtucker.me.uk/v1/cve_index.json \
  | jq --arg cve "$CVE" '.[$cve] | {severity, cvss_score, in_kev, affected: [.affected[].os]}'

Fetch the feed and print exploited CVEs per OS version:

import requests

FEED_URL = "https://wofa.jtucker.me.uk/v1/windows_data_feed.json"

feed = requests.get(FEED_URL, timeout=30).json()

for os_entry in feed["OSVersions"]:
    latest = os_entry["Latest"]
    exploited = latest.get("ActivelyExploitedCVEs", [])
    print(f"{os_entry['OSVersion']}: {len(exploited)} exploited CVEs")
    for cve in exploited:
        print(f"  {cve}")

Alert when a new patch drops by polling the metadata hash:

import requests, time

METADATA_URL = "https://wofa.jtucker.me.uk/metadata.json"

def get_hash():
    return requests.get(METADATA_URL, timeout=10).json()["UpdateHash"]

last_hash = get_hash()
print(f"Watching for updates (current hash: {last_hash[:12]})")

while True:
    time.sleep(3600)  # check every hour
    current = get_hash()
    if current != last_hash:
        print(f"Feed updated! New hash: {current[:12]}")
        last_hash = current
        # trigger your downstream workflow here

Search the CVE index for CISA KEV entries:

import requests

INDEX_URL = "https://wofa.jtucker.me.uk/v1/cve_index.json"

index = requests.get(INDEX_URL, timeout=30).json()

kev_cves = {
    cve_id: data
    for cve_id, data in index.items()
    if data.get("in_kev")
}

print(f"CISA KEV CVEs in current feed: {len(kev_cves)}")
for cve_id, data in sorted(kev_cves.items()):
    versions = [a["os"] for a in data["affected"]]
    print(f"  {cve_id} ({data['severity']}) — {', '.join(set(versions))}")

Get the latest build number for all tracked versions:

$feed = Invoke-RestMethod "https://wofa.jtucker.me.uk/v1/windows_data_feed.json"

$feed.OSVersions | Select-Object OSVersion, @{
    Name = "LatestBuild"; Expression = { $_.Latest.ProductVersion }
}, @{
    Name = "ReleaseDate"; Expression = { $_.Latest.ReleaseDate }
} | Format-Table -AutoSize

Find all actively exploited CVEs and output a report:

$feed = Invoke-RestMethod "https://wofa.jtucker.me.uk/v1/windows_data_feed.json"

$feed.OSVersions | ForEach-Object {
    $os = $_.OSVersion
    $_.SecurityReleases | ForEach-Object {
        $rel = $_
        $rel.ActivelyExploitedCVEs | ForEach-Object {
            [PSCustomObject]@{
                OSVersion   = $os
                CVE         = $_
                KB          = $rel.UpdateName
                ReleaseDate = $rel.ReleaseDate
            }
        }
    }
} | Sort-Object CVE -Unique | Format-Table -AutoSize

Check if a specific CVE affects any tracked version:

$cveId = "CVE-2025-21333"
$index = Invoke-RestMethod "https://wofa.jtucker.me.uk/v1/cve_index.json"

$entry = $index.$cveId
if ($entry) {
    Write-Host "$cveId found:" -ForegroundColor Yellow
    Write-Host "  Severity : $($entry.severity)"
    Write-Host "  CVSS     : $($entry.cvss_score)"
    Write-Host "  CISA KEV : $($entry.in_kev)"
    Write-Host "  Affected :"
    $entry.affected | ForEach-Object {
        Write-Host "    $($_.os) — KB$($_.kb) ($($_.release_date))"
    }
} else {
    Write-Host "$cveId not found in current feed." -ForegroundColor Green
}