CVE feed and watchlist

Your own code is half the problem. The other half arrives through the products and libraries you depend on, and it arrives as CVEs. The feed carries every CVE published in the last six months, refreshed from the National Vulnerability Database several times a day.

Browsing the feed

The feed is newest first and loads fifty at a time; asking for more appends to the list without moving you back to the top. You can filter by severity and by CWE, and search across identifiers, affected products and summaries. Every locale also has an RSS feed if you would rather read it in a reader.

The watchlist

Add a term and the feed starts working for you instead of the other way round. Two kinds of term are supported:

• A keyword — a product, vendor or technology name such as nginx, openssl or postgres. It matches affected products, CVE identifiers and summaries.
• A weakness class — a CWE identifier such as CWE-89. It matches the weakness the CVE was classified under.

Each term can carry a minimum severity, so you can watch a noisy product only for high and critical issues. Matches appear on the CVE page of your dashboard with a badge showing which of your terms caught them.

The digest email

Every six hours we check for CVEs published since your last digest that match your terms. If there are any, you get one email — never one per CVE — listing what matched, in the language saved on your account. Nothing matched means nothing is sent.

The first digest looks back one day rather than six months, so adding terms does not bury you in backlog. You can switch the digest off in Settings, or with the one-click unsubscribe link in the email itself.

Your own weaknesses

The CVE page also lists the CWEs that appear most often in your own audits, as filters. It is a quick way to see whether the weakness classes you keep writing are the same ones being exploited in the wild this month.