CVE & Advisory Monitor

Get alerted when a new vulnerability lands in software you actually run — not a firehose of every CVE published that day.

Two sources, deliberately

Source	Strength
NIST NVD	the authoritative CVE record, CVSS scores and vectors
GitHub Security Advisories	far better package-level targeting: ecosystem, package name, first patched version

Query both, or either. Both are free and need no key (an optional NVD key raises rate limits).

Targeting it at your stack

• keywords — products and vendors: nginx, postgresql, wordpress
• ecosystems — npm, pip, maven, go, rubygems, nuget, composer, rust
• packages — your actual dependencies: lodash, django
• minSeverity — low / medium / high / critical, defaults to high and above

The severity floor is applied on top of whatever the APIs return, so a source that ignores a severity filter still gets filtered here.

What you get

source · id (CVE-… or GHSA-…) · cve · severity · score · vector · title · packages[] · patchedVersions[] · publishedAt / updatedAt · references[] · url

Announced exactly once

A ledger of reported CVE and GHSA ids means a vulnerability that stays in the feed for weeks is never re-sent. The first run records a baseline rather than alerting you to every historical CVE matching your stack — but it does not run silent: it pushes one baseline-summary row plus up to baselineSampleSize (default 10, set to 0 to disable) of the vulnerabilities currently matching your filters, each tagged isBaseline: true so they're never mistaken for a real "new vulnerability" alert. That keeps the run's dataset genuinely non-empty and useful instead of silently returning nothing on day one. Every run after that reports only genuinely new entries.

Typical uses

Security and platform teams tracking their dependency tree · MSPs monitoring client stacks · compliance evidence that vulnerabilities are actively monitored · engineering leads who want a Slack ping for critical issues instead of a weekly digest nobody reads.

Schedule it

Daily for most stacks; hourly if you run something internet-facing and high-risk. Point webhookUrl at a security channel and it becomes a standing control.