CVE alerts for the software you run
List the software you run once. Q-Feeds checks every new CVE against that list and sends one daily or weekly digest with the matches, plus any of your CVEs that CISA adds to its Known Exploited Vulnerabilities catalogue.
- 7Public data sources, from NVD to CISA KEV
- 50CVEs per digest at most, KEV additions first
- PlusIncluded from the Plus package
- 100%Made in Europe
CVE monitoring for your own software list
Thousands of CVEs are published every month, and only a handful affect what you run. Q-Feeds keeps a CVE catalogue with CVSS scores, EPSS, CISA KEV status and public exploit references, and matches it every day against the products on your watchlist.
You decide what is worth an email: a minimum CVSS score, whether CVEs without a score yet count, and whether a CVE that lands on CISA KEV should alert you whatever its age or score. Everything that matches arrives in one digest.
The CVE catalogue itself is part of every package, the free Community package included. Anyone on the portal can search CVEs and filter on CVSS, EPSS, KEV or a public exploit.
What every digest gives you
KEV additions first
CVEs that CISA confirms are exploited in the wild open the email. The rest follow, sorted by CVSS.
EPSS and exploit context
Each row shows the CVSS score, the EPSS probability of exploitation in the next 30 days and whether a public exploit exists.
Sent once
A CVE reaches you once. It only comes back if CISA later adds it to KEV, because that changes how urgent it is.
Quiet when nothing is new
No matches means no email. A digest holds at most 50 CVEs and counts the rest, so it stays readable.
Preview before it sends
See what the next digest would contain right now, and how many CVEs your thresholds held back.
The full CVE catalogue
Search every CVE in the portal and filter on CVSS, EPSS, KEV, known ransomware use or a public exploit.
Set up CVE alerts in 3 steps
List your software
Search the catalogue by vendor or product and tick everything you run in one go, or watch a keyword such as a vendor name to cover all of its products.
Choose what is worth an email
Pick a minimum CVSS score, decide whether CVEs without a score count, and turn on alerts for CVEs that CISA adds to KEV.
Pick when and who
Daily or weekly, at the hour and in the time zone you choose, to the colleagues you select. The preview shows what the next digest would hold.
What to patch first
CVSS tells you how bad a flaw could be, not how likely it is to be used. Start with the CVEs on the CISA KEV list, because attackers already use them. Then take the ones with a high EPSS score, the probability of exploitation in the next 30 days. Use CVSS to order the rest.
More from the Threat Intelligence Portal
Vulnerability Scanner
Scan your infrastructure and web applications.
External Attack Surface
Check your external-facing assets exposed on the internet.
Threat Lookup
Investigate any IOC with MITRE ATT&CK context, and follow active malware and threat actors.
Dark Web Monitoring
Monitor the dark web for your most important assets.
Frequently asked questions about CVE alerts
What is a CVE alert?
A CVE alert tells you that a newly published vulnerability affects software you use. Q-Feeds checks every new CVE against the products you keep in the portal and emails you a digest of the ones that match.
How is a CVE matched to my software?
On vendor and product name, as NVD and CISA name them. Add an exact product such as Fortinet FortiOS, or a keyword that matches every product name containing it. Versions are not checked, so confirm your installed version against the advisory before you act.
How often do CVE alerts arrive?
Daily or weekly, at the hour and in the time zone you choose. New CVEs reach the catalogue once a day, so a daily digest misses nothing. When nothing new matches, no email is sent.
Which packages include CVE alerts?
CVE alerts are included in Plus and Premium. The CVE catalogue with CVSS, EPSS, CISA KEV and exploit references is in every package, including the free Community package.
How is this different from the vulnerability scanner?
The vulnerability scanner tests your own internet-facing assets for weaknesses. CVE alerts need no scan: they track newly published CVEs for the software you list, including software that is not exposed to the internet.
Where does the data come from?
CVE records come from the CVE Program and NVD, exploitation probability from FIRST EPSS, confirmed exploitation from the CISA KEV catalogue, and public exploit references from Exploit-DB, Metasploit and Nuclei. This product uses the NVD API but is not endorsed or certified by the NVD.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free