CVE alerts · for your stack

Only the vulnerabilities in the software you run.

Tell us your stack once. On mornings when something new affects it, you get a short summary, exploited in the wild first, with the full list attached as a spreadsheet.

Start two weeks free See all prices

$49 a month after two weeks free · no card · no login · cancel by replying. Or write to cves@worldsignals.net.

For IT and security teams, managed service providers and software companies that need to know what to patch first.

SourcesNVDCISA KEVGitHub advisoriespublic exploit archives

For businessesEU company, VAT invoicesCard or bank transferGDPRCancel by email

502new CVEs in 24 hours

47exploited in the wild, 30 days

Up to 100products and packages

1email a day, at most

How it works

Tell us your stack

Products, vendors and versions, or packages by registry: up to 100 entries, in plain words.

We read every new CVE

Each morning, new CVEs, ones confirmed exploited in the wild, reviewed advisories for packages and new public exploits.

A summary and the full list

What's exploited first, then by severity, with fixes and links; the full list as a CSV. Nothing on quiet days.

What arrives in your inbox

WorldSignals · 3 new for your stack · 1 exploited in the wild Example

1. CVE-2026-1022 · Microsoft Exchange Server Exploited in the wild (CISA; US agencies must fix it by 20 Nov) · critical 9.8 2. CVE-2026-0871 · nginx high 7.5 · you run 1.24: check the affected versions · advisory linked 3. GHSA-x2p4 · npm lodash 4.17.20 medium 5.3 · fixed in 4.17.21 Full list attached (CSV). Reply to change your stack, or “cancel”.

CVE alerts

$49 a month · £49 or €49 elsewhere

Matched to your products and vendors, and package versions
Exploited in the wild flagged first (CISA's known exploited list)
Severity and CVSS, fixes and advisories linked
The full list attached as a CSV for your tracker
Nothing on days without anything new
Your stack kept confidential, deleted when you cancel

Start two weeks free

Or write to cves@worldsignals.net: we answer with examples like your work, and the two weeks start when you say yes.

For businesses. No card to start; then a monthly invoice by card or bank transfer, plus VAT where it applies.

Questions

Where does it come from?

The US National Vulnerability Database, CISA's Known Exploited Vulnerabilities catalogue, GitHub's reviewed security advisories and public exploit archives, read each morning.

How do you match our stack?

A product matches when every word you gave is in the affected vendor and product names. A package matches by registry and name, and by version when you gave one and the advisory has its range. It's deterministic: no guessing.

What happens to our stack list?

It's confidential: used only to match vulnerabilities for you, never shared, and deleted when you cancel.

What does it cost?

$49 a month for up to 100 entries, plus VAT where it applies. The first two weeks are free.

We'd rather use an API.

Vulnerability events are free on our developer platform, worldsignals.dev, as an API, a live stream and an MCP server.

Also by email

Public procurement