Watchlists and alerts

Follow a vendor, a product, a weakness, a search or a single CVE, and get alerts in your inbox, by RSS or by webhook.

A watchlist follows something you care about and raises an alert when it moves: a new CVE about a vendor you use, a CVE added to a known-exploited catalogue, a score that changes. Watchlists live at vuln.mlab.sh/me; the Watch buttons on CVE, vendor and search pages create them in one click.

What you can watch

Kind	Matches
`vendor`, `product`, `search`	New CVEs whose id, description or affected products contain the text (case-insensitive)
`cwe`	New CVEs with that weakness, for example `CWE-79`
`cve`	Changes to one CVE

A watch can carry filters on new CVEs: a severity (exact, or this severity or worse), a minimum CVSS, or known-exploited only.

Triggers

Trigger	Fires when	Plans
`new`	A new CVE matches (vendor, product, search and cwe watches)	All
`kev`	A matching CVE enters the CISA KEV or the EU KEV (ENISA)	All
`cvss`	A watched CVE's score changes	Pro and up
`poc`	A public exploit reference appears for a watched CVE	Pro and up
`kev_due`	A watched CVE's CISA remediation deadline is 7 days away or less	Pro and up
`epss`	A watched CVE's EPSS rises by 10 points or more	Team and up

Matching runs every 3 minutes. Each (watch, CVE, reason) alerts once.

Where alerts go

Inbox, on /me, for every plan.
RSS: each watch has a private feed URL, https://vuln.mlab.sh/watch/<id>/rss?token=<token>, with its last 50 alerts. Add it to any reader.
Webhook (Pro and up), one POST per alert. Slack, Discord and Microsoft Teams URLs get their native message format; any other URL gets JSON:

{
  "source": "vuln.mlab.sh",
  "cve": "CVE-2021-44228",
  "reason": "kev",
  "severity": "critical",
  "detail": "Added to CISA KEV (actively exploited)",
  "url": "https://vuln.mlab.sh/cve/CVE-2021-44228"
}

Webhook URLs must be https and publicly reachable. A failed delivery is retried after about 4, 16, 64 and 256 minutes, then dropped; a 4xx answer (other than 408 and 429) is not retried. Use Test next to the field to send a sample alert.

Limits

Plan	Watchlists
Free	3
Pro	25
Team	100
Enterprise	Unlimited

Without an account

Any search can be followed as an RSS feed, no account needed:

https://vuln.mlab.sh/rss?q=fortinet&kevOnly=1
https://vuln.mlab.sh/rss?q=openssl&severity=CRITICAL

See Getting Started. To watch the dependencies of a project rather than names, see Monitor an SBOM.