// about
Vulnerability alerts, filtered to the software you actually run.
instantCVE is a vulnerability alerting service for builders. Most CVE tools are databases you go to and search. instantCVE is the opposite: you set your stack once, and it comes to you - the moment a new vulnerability matches, by email or webhook, triaged by severity.
Signal, not the firehose
Hundreds of CVEs are published every week. Almost none affect you. You tell instantCVE the products, vendors and keywords in your stack; it tells you only the advisories that match.
Severity-first
Every alert carries its CVSS severity and score, with the context that matched - so you handle critical before noise, and ignore what doesn't apply.
Not just your repos
Dependency scanners only see packages declared in your repositories. instantCVE watches by vendor, product and keyword - the nginx, OpenSSL build, OS package or appliance you run, manifest or not.
Built for builders
Email or webhook delivery, hourly coverage from the official CVE feed, and a clean interface. Set it up in minutes; no platform to stand up.
Under the hood
instantCVE ingests the official CVEProject/cvelistV5 feed every hour, matches each new advisory against your tags, and delivers what's relevant. It runs serverless on AWS - Lambda, DynamoDB and CloudFront, deployed with CDK - and is built by Si Novi.