Know when your Plex box has a CVE.
Not when your Debian base image has 400.

A small open-source agent inventories what your Linux hosts and containers actually run. The hosted service alerts you when one of those things has a vulnerability, and tells you when the fix lands.

one command per host, like Tailscale
How it works

Three steps. Nothing to configure.

  1. 01

    Install the agent

    One command per host or container. It runs as its own user, outbound only, and reads what the package manager and container runtime already know.

    curl -fsSL https://cvewatch.sh | sh
  2. 02

    It uploads an SBOM

    An inventory, not file contents: package names and versions, container image names, listening ports. Re-sent when something changes. Print it first with cvewatch inventory --dry-run.

  3. 03

    You get confirmed, prioritized alerts

    Every new advisory is re-matched against your stored inventory. You hear about it when your exact version is affected, with the fixed version named, ranked by KEV, EPSS and exposure.

Exact alert · hours · backport-aware
CVE Watchapp09:41 hostnas packageopenssl 3.0.15-1~deb12u1 cveCVE-2026-XXXXX · High fixavailable: 3.0.15-1~deb12u2 exposureexposed on 0.0.0.0:443

No alarm when Debian already backported the fix into the version you have.

Fast alert · minutes · unconfirmed
09:12 New advisory for Plex Media Server affected versions not yet confirmed · 2 hosts run Plex

Sent the moment an advisory names something you run. Followed by the exact alert, or by nothing if you're not affected.

Why this instead of a CVE mailing list

A feed tells you a product has a CVE. An inventory tells you whether you do.

Vendor / product alert feedsCVE Watch
Knows your exact versionsNo. Alerts for every version of the product.Yes. Matched against the versions you have installed.
Understands distro backportsNo. Debian's 3.0.15-1~deb12u2 looks "old" to a feed.Yes. Uses the distro security trackers, not just upstream version ranges.
Detects self-hosted apps inside containersNo. You subscribe per product and keep the list current.Yes. Finds Plex, Vaultwarden, Immich and others in images and on hosts.
Shows fix availabilitySometimes, as prose.Yes. The fixed version is named in the alert.
Prioritizes by KEV, EPSS and exposed portsNo. Severity only.Yes. A High on 0.0.0.0:443 ranks above a High on localhost.
One alert for 50 identical containersOne per subscription, regardless.One alert listing all 50 hosts.

The left column is useful and we do it too: that's the fast tier. The right column is what having your inventory adds.

What it detects

Base systems, package ecosystems, and the apps self-hosters run.

OS, images, packages
  • Debian
  • Ubuntu
  • Alpine
  • RHEL / Rocky / Fedora
  • Docker & Podman images
  • Go / Python / Node / Rust / Java packages
Self-hosted apps, inside or outside containers
  • Plex
  • Jellyfin
  • Vaultwarden
  • Immich
  • Nextcloud
  • Home Assistant
  • Gitea / Forgejo
  • Pi-hole
  • Portainer
  • Traefik
  • Caddy
  • Grafana
  • Uptime Kuma
  • Paperless-ngx
  • Sonarr / Radarr
  • qBittorrent
  • Syncthing
  • Proxmox VE
Dashed: detector planned for the alpha.

Detectors are YAML files in the open-source repo. Missing yours? You'll be able to add it.

What the agent does on your machine

You can read the source and watch the traffic.

Open source

Agent is Apache 2.0. Signed releases, reproducible builds.

Outbound only

No listening ports. Runs as its own user.

Dry run first

Print exactly what it sends before it sends anything: cvewatch inventory --dry-run

What leaves the machine

Package names and versions, container image names, and listening ports. Never file contents, env vars, or command lines.

Pricing preview

Free for 3 hosts. Paid for more hosts and faster delivery.

Free
$0
  • 3 hosts
  • Daily email digest
  • Full data, same matching as paid
Pro
$19/mo
  • 15 hosts
  • Instant alerts: Slack, Discord, ntfy, webhooks
  • Prioritization by KEV, EPSS, exposure
  • Suppression rules
Team
$79/mo
  • 50 hosts
  • Seats and roles, OIDC
  • API
  • 1-year history

Launch pricing, may change. Free tier never gets delayed or degraded data.

Waitlist

Join the waitlist.

Private alpha in Q1 2027, public beta after. The optional answers decide which detectors get written first.

Star the agent repo placeholder · repo opens with the alpha
Roughly how many hosts?

FAQ

Is the agent really open source?

Yes. Apache 2.0, with signed releases and reproducible builds so you can verify the binary matches the source. The hosted matching service is not open source at launch.

What data leaves my machine?

Package names and versions, container image names and tags, and listening ports. Never file contents, environment variables, or command lines. Run cvewatch inventory --dry-run to print the exact payload before anything is sent.

Does it work on Proxmox / inside LXC?

Yes. Proxmox VE hosts are Debian underneath and are detected as such, pve packages included, since they come from the same package database; a dedicated Proxmox detector is planned. Inside LXC the agent runs as a normal unprivileged process; no nesting or special permissions needed.

Why not just use Trivy or Grype?

We use Grype inside. What this adds is continuous re-matching of your stored inventory as new advisories arrive, detection of self-hosted apps, prioritization, and alerting. A one-off scan tells you about today; this tells you when tomorrow's CVE lands on something you already run.

Will there be a self-hosted version?

Not at launch. It is being considered.

When does it launch?

Private alpha in Q1 2027, public beta after. The waitlist gets one email when the beta opens.