“Are we affected?” You already have the answer.

A critical flaw drops in the morning, it is all over the feeds, and the question lands before noon. At your desk the alert went out before the question did, because your CVE monitoring tracks only the versions you actually run, declared once by hand, from an SBOM or from a URL. Nine feeds re-read continuously, CISA's KEV catalog and CERT-FR alerts among them. And the order of remediation is already settled: observed exploitation first, probability over 30 days next, severity last.

Create a free account See how it works

Processing < 30s 360,000 indexed CVEs Built and hosted in France

Free plan, no credit card Subprocessors published Export your data at any time

Integrations

Slack Microsoft Teams Discord Email In-app notifications HTTP Webhooks REST API

Platform

Three watches to keep. One to read.

Nine vulnerability feeds drive your alerts: CVE List, NVD, CISA's KEV catalog, EPSS, PoC-in-GitHub, GHSA, OSV, CERT-FR advisories and alerts, and the European EUVD database. Twelve editorial sources drive your daily brief. You keep one tab open; we keep the others open for you. How a CVE monitoring scope is built.

01 · Detection Scanning

Every CVE sifted through your stack.

No noise. Our engine compares your technologies and their versions, by CPE identifier (Common Platform Enumeration, the naming scheme that identifies a product and its version), against 360,000 indexed CVE records, reserved and rejected identifiers included. Only what touches your declared components comes through.

critical CVEs affecting your stack of 1,842 published in the last 30 days · signal ratio 0.38%

Your stack · 51 components

php 8.1.28

nginx 1.24.0

postgresql 16.2

ubuntu 22.04

node 20.10

redis 7.2.3

elasticsearch 8.11

docker 24.0.7

kubernetes 1.28.4

openssl 3.2.1

mysql 8.0.35

apache 2.4.58

+ 39 more

7 critical matches

9.8 CVE-2026-1847 KEV

OpenSSL: RCE via cert parsing

Public exploit · patch available

9.1 CVE-2026-1801 KEV

Apache 2.4: SSRF in mod_proxy

Actively exploited · patch available

8.1 CVE-2026-1798

PostgreSQL 16: privilege escalation

EPSS 0.82 · patch available

7.8 CVE-2026-1712

nginx 1.24: HTTP/3 buffer overflow

Mitigation: disable HTTP/3

7.5 CVE-2026-1689

Node.js 20: prototype pollution

EPSS 0.44 · patch available

02 · Anticipation endoflife.date

No end-of-support date catches you out.

Alerts at D-90, D-30 and D-7 for every component of your stack.

days

PHP 8.1

End of security support

Dec 31, 2026

D-94CentOS 7Server OS

D-218Ubuntu 20.04Standard LTS

D-412Node 18 LTSRuntime

D-548MySQL 5.7Database

03 · Summary Every morning at 8:00

A daily brief, not an RSS flood.

We call this brief Patchwork: an 8am email summarizing what our 12 editorial sources published the day before, filtered on your stack. Two minutes of reading instead of twelve tabs.

Patchwork · your daily brief

Your brief for Tuesday, April 14

3 critical CVEs on your stack

PHP 8.1: end of support in 62 days

CERT-FR reports 2 active campaigns

Fortinet publishes 3 major advisories

5 minor patches available

2 min read Sample brief

A day in the life of a CVE

From publication to your channel: under 30 seconds of processing.

Two delays, not to be confused. The synchronization: we re-read CVE List, KEV and EPSS continuously, in cycles of a few minutes. The processing: once the CVE is seen, matching it to your stack, prioritizing it and notifying you takes under 30 seconds. No one can be faster than their own polling interval; we would rather write it down.

T+0

CVE publication

Picked up during a sync cycle on CVE List v5, CISA's KEV catalog or FIRST.org's EPSS.

T+15s

Matching against your stack

CPE vendor / product / version matching against the components you declared, then a minimum-severity filter.

T+20s

Prioritization

Three signals, in this order: is the CVE already being exploited (KEV)? how likely is exploitation within 30 days (EPSS)? how much damage if it happens (CVSS)?

T+30s

Multi-channel notification

Slack, Teams, email, webhook. Workflow: PENDING → ANALYZING → FIXING → RESOLVED.

Workflows

What you redo on every alert, write it once.

Pick a trigger, add your conditions, wire up your actions. From detected CVE to notified team, automatically, without writing a line of code.

Visual editor

From trigger to action, on a canvas.

Build your automations on a canvas: each workflow starts from an event, filters by conditions, then runs actions on your channels.

✓CVE, EOL & certificate triggers new CVE, update, PoC, KEV, end of support…
✓Composable conditions severity, CVSS, EPSS, KEV, product, vendor
✓Multi-channel actions Slack, Teams, email, webhook, case
✓Dry run simulate on a real CVE before activating

Workflow · Critical alerts

New CVE on your stacktrigger.cve_new_match Trigger

CVSS score ≥ 9.0condition.cvss Condition

Listed in the KEV catalogcondition.is_kev Condition

Notify Slack / Teamsaction.fire_webhooks Action

Create a caseaction.create_case Action

AI assistant

Project: Production core

How can I help?

I know the stack, the alerts and the end-of-support tracking of your current project.

What is the most serious CVE on my estate?

Which of this week's alerts should I handle first?

Which products reach end of support this quarter?

Your conversations stay in your workspace. Vigie only sees the technical data of the selected project.

You

What is the most serious CVE on my estate?

AI assistant

CVE-2026-1847 is the priority on your estate right now: CVSS 9.8, exploitation confirmed.

Why it comes first

Added to the KEV catalog on March 12: it is exploited in the wild, not merely rated severe.

EPSS at 97%, the highest score among your 214 open vulnerabilities.

12 of your servers run OpenSSL 3.2.1; the fixed version is 3.2.2.

The vendor has published the fix. I can prepare the remediation tracking; nothing is applied without your approval.

CVE-2026-1847 Critical March 12, 2026 KEV Public PoC

OpenSSL · OpenSSL 3.2.1

Buffer overflow in TLS extension handling, allowing unauthenticated remote code execution.

CVSS 9.8EPSS 97 %12 assets

Ask a question about your estate

Answers may contain mistakes. Check anything important.

AI assistant

247 CVEs published since last night. Vigie points you to one.

A question in plain language, an answer about YOUR inventory: your versions, your alerts, your end-of-support deadlines. An analyst's tone, 250 words at most, and every CVE it cites is checked against the database before it is shown.

Understands your vulnerabilitiesExplains every CVE (CVSS, EPSS, KEV, PoC) and what to fix first.

Knows your contextReads your stack, your alerts, your EOL deadlines and the feeds from the sources you follow.

Invents nothingEvery identifier it cites is read back from the database: if it does not exist, no card is shown.

Proposes, you approveUpdating a version, tracking an end of support: Vigie prepares the action, you confirm with one click.

Built and hosted in France · understand EPSS in five minutes

Understand

Four concepts, twenty minutes. Enough to defend a priority call in a meeting.

You do not sell a prioritization tool to someone you never explained prioritization to. These four guides read in this order; they are free, require no sign-up, and contain not one word of sales copy.

1. The CVE, the identifier

What exactly is designated by CVE-2021-44228, who assigns that number, and why two tools can describe the same flaw differently.

What a CVE really is

2. CVSS, the severity

How to read a vector field by field, and why a 9.8 is not a priority instruction but a measure of potential damage.

How to read a CVSS vector

3. EPSS, the probability

What a score of 0.92 means, why it is recomputed every morning, and what it emphatically does not predict.

How EPSS estimates risk

4. KEV, the observed fact

CISA's catalog predicts nothing: it lists flaws whose exploitation has been observed. It is the hardest signal of the four.

What the KEV catalog requires

API v1 · Pro and Business plans

CVE REST API: monitoring moves down into your delivery pipeline.

Twenty documented REST endpoints: read your alerts, query the CVE database, view your inventory, block a deployment when a critical CVE has not been handled. The API is included in the Pro and Business plans. Bearer authentication, per-plan quotas, examples in curl, Python, JavaScript and GitHub Actions.

Wire TechWatchAlert into your delivery pipeline.

Fetch your alerts, query the CVE database, read your watchlist, cases and statistics. Your entire monitoring is available read-only via the API (GET), to block a deployment on a critical CVE.

✓Bearer auth revocable keys, format twa_…
✓Read-only (GET) 5,000 calls per hour on Pro, no hourly quota on Business
✓Starlight docs curl, Python, JS, GitHub Actions examples
✓Outbound webhooks HMAC signatures, exponential retries

Get started in three steps API reference

cURL
Python
JavaScript
GitHub Actions
Copy
# Fetch a project's critical alerts
curl "https://app.techwatchalert.com/api/v1/organizations/org_x7y8/projects/prj_a1b2/alerts?severity=critical&status=pending" \
  -H "Authorization: Bearer twa_xK9...f2q" \
  -H "Accept: application/json"

# Response
{
  "items": [{
    "cve_id": "CVE-2026-1847",
    "severity": "CRITICAL",
    "cvss_score": 9.8,
    "epss_percentile": 0.97,
    "is_kev": true,
    "has_poc": true,
    "status": "PENDING"
  }],
  "total": 3, "page": 1
}
import httpx

client = httpx.Client(
    base_url="https://app.techwatchalert.com/api/v1",
    headers={"Authorization": f"Bearer {API_KEY}"}
)

# List a project's monitored stack
r = client.get(
    f"/organizations/{org_id}/projects/{project_id}/stack"
)

for tech in r.json()["items"]:
    print(f"{tech['vendor']}/{tech['product']}")
// Search CVEs by vendor + severity
const res = await fetch(
  'https://app.techwatchalert.com/api/v1/cves?' +
  new URLSearchParams({
    vendor: 'nginx',
    severity: 'critical,high',
    is_kev: true
  }),
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`
    }
  }
);

const { items, total } = await res.json();
console.log(`${total} active vulnerabilities on nginx`);
# .github/workflows/security-gate.yml
name: Security Gate

on: [push, pull_request]

jobs:
  check-cves:
    runs-on: ubuntu-latest
    steps:
      - name: Block on critical CVEs
        run: |
          COUNT=$(curl -s \
            -H "Authorization: Bearer ${{ secrets.TWA_KEY }}" \
            "$TWA_URL/organizations/$ORG/projects/$PRJ/alerts?severity=critical&status=pending" \
            | jq '.total')
          if [ "$COUNT" -gt "0" ]; then
            echo "❌ $COUNT unresolved critical CVE(s)"
            exit 1
          fi

360K

indexed CVE records, the whole programme since 1999, reserved and rejected identifiers included

vulnerability feeds cross-checked against each other, because none is complete on its own

editorial sources for the daily brief. They never trigger an alert

100%

of the infrastructure in France: application, CVE database and your inventories

Pricing

Cybersecurity monitoring pricing: simple, transparent, no surprises.

Four plans, from one person's watch to the team that has to prove what it fixes. CVE alerts are never billed by volume: what changes is the number of tracked components, the size of the team and the features. Prices exclude VAT, which is added at checkout based on your country. See the full price table.

Free

0 € with no time limit

To get started. One monitored project, no credit card.

Start for free

✓1 project
✓3 entered stack components
✓1 alert webhook
✓1 SBOM application
✓5 end-of-life trackings
✓Email alerts
✓Daily watch brief

Team

49 € excl. tax / month

Vulnerability watch for teams. Sort alerts together and keep a record.

Choose Team →

✓5 projects · 10 members
✓200 entered stack components
✓Remediation cases Jira, GitLab, GitHub tickets
✓PDF reports 12 months of history
✓Slack, Teams, signed webhooks

Pro Recommended

99 € excl. tax / month

Watch + NIS2 evidence. Show how you handle your vulnerabilities.

Choose Pro →

✓Everything in Team, with no limit on projects or members
✓NIS2 module remediation deadlines, accepted risks, incidents, management report
✓Inventory connectors GLPI and Intune
✓REST API v1 5,000 calls per hour
✓Audit log kept for 1 year

Business

from 249 € excl. tax / month

SSO, audit, procurement. Beyond that, on quote.

Choose Business →

✓Everything in Pro, plus:
✓OIDC single sign-on with verified domains
✓Audit log kept for 5 years
✓Guided onboarding priority email support
✓Purchase order signed DPA, Chorus Pro on request

No commitment, change plans at any time, prorated on switch. Prices exclude VAT. Managed service provider? The Partner plan is billed per client. Before you choose, compare: five competing tools, our criteria, our verification dates.

Compare

Six tools, the same criteria for all. Here is where we come out ahead.

OpenCVE needs a server. We need an email address.

It is software to deploy, update and monitor. We have costed what that self-hosting really takes, engineering hours included.

The OpenCVE comparison, with numbers

Cyberwatch scans the network. We start from your inventory.

An active scanner means an agent to install, network access to obtain and a scan window to negotiate. Here, you declare your components and the first alert goes out at the next synchronization.

The Cyberwatch comparison

On CVEDetails, you search. Here, the alert finds you.

A lookup database waits for your query, in English. We start from your declared versions and write to you, in your language, when one of them is hit.

The CVEDetails comparison

All six tools side by side, identical criteria

Stack targeting, prioritization, data freshness, real pricing, hosting. Method and verification date shown, including where a competitor comes out ahead of us.

The full 2026 comparison

Security & sovereignty

Your inventory is a map of your information system. We guard it as one.

Who runs what, in which version, with which flaws still open: that is the first thing an attacker tries to reconstruct. Hosting in France, AES-256 encryption at rest, TLS 1.3 in transit, two-factor authentication, audit log of sensitive actions. The details, subprocessors included, are on our Security page.

TOTP two-factor authentication

Google Authenticator, Authy, 1Password, RFC 6238 compatible.

AES-256 encryption

At rest and TLS 1.3 in transit. Short-lived JWT + refresh token in Redis.

Hosted in France

Application, CVE database and inventories in the Paris region, with OVHcloud. Our subprocessors and their safeguards are published on the Security page.

Audit log

Sensitive actions logged: actor, entity, JSON details, timestamp.

Native rate limiting

10 attempts / 60s per IP. Automatic alerts if brute-force is detected.

Isolated network

Data services on a private network. Only the frontend and API are exposed over HTTPS.

DPA available

Data processing agreement (DPA) on request from Team up, signed with Business. Full export of your data at any time, without asking us.

Availability: 99.5% target

Monthly target written into the Terms of use, article 11.1. It is a published target, not a commitment backed by penalties.

FAQ

The questions that keep coming up.

If yours is not here, ask us: we answer within 24 working hours.

How do you know which CVEs concern me?

You declare your components (operating systems, appliances, frameworks, libraries) by hand, by importing a CycloneDX or SPDX SBOM, or by detection from a public URL. Every published CVE is matched against that inventory by CPE identifier (vendor, product, version). A CVE that touches none of your components is never sent to you.

How fast am I told?

Two delays, not to be confused. We re-read the feeds continuously, in cycles of a few minutes: that is synchronization. Once the CVE is seen, matching, prioritization and notification take under 30 seconds: that is processing. No one can be faster than their own polling interval, and we would rather write that than publish a figure our own documentation contradicts.

Which sources feed your alerts?

Nine vulnerability feeds: CVE List, NVD, CISA's KEV catalog (Known Exploited Vulnerabilities, flaws with observed exploitation), FIRST.org's EPSS, PoC-in-GitHub, GHSA, OSV, CERT-FR advisories and alerts, and ENISA's European vulnerability database (EUVD). Separately, twelve editorial sources (the CERT-FR feed, vendor blogs, trade press) feed the daily brief. They never trigger an alert. The detail is on the data sources page.

Should a CVSS 9.8 be fixed before a 7.5?

Not necessarily, and this is the most common trap. CVSS measures potential damage, not the likelihood of attack. Most critical CVEs are never exploited. We look first at whether the CVE is in the KEV catalog (exploitation observed), then at its EPSS score (probability of exploitation within 30 days), and only then at CVSS.

Is my inventory data confidential?

Your inventory serves exactly one purpose: filtering the CVE feed. It is not resold, not used to train a model, not shared with a third party. Hosting in the Paris region, AES-256 encryption at rest, TLS 1.3 in transit. Our subprocessors, three of which are established outside the European Union, are listed with their safeguards on the Security page. A data processing agreement (DPA) is signable on request.

Can I try without a credit card?

Yes. The Free plan asks for no payment method: an email address is enough. It covers 1 project, 3 entered stack components, 1 alert webhook, 1 SBOM application and 5 end-of-life trackings, with email alerts. That is enough to see whether the filtering delivers on your stack.

What is included in the API?

The API is included in the Pro and Business plans: alerts, CVE database, inventory, cases, statistics, read-only (GET endpoints). Pro allows 5,000 calls per hour, Business has no hourly quota. Bearer authentication with revocable keys. From the Team plan up, alerts can also go to Slack, Teams and HMAC-signed webhooks.

And if I want to leave?

You can export your data at any time, without asking us and at no cost: inventory, alerts, cases, audit log. Plan changes work both ways, prorated. Nothing is deleted when you move down a plan: only the higher plan's features stop being available.

Free plan, no credit card

The next CVE that concerns you is one you will receive.

Two minutes to declare your components. After that, we read the other forty thousand.

Hosted in France · subprocessors published · export your data at any time