Low Severity
Published: Nov 4, 2026
Lightweight CVE watcher: declare what you run in YAML, get alerts on Teams, Slack, webhooks or your own script. One Go binary, no database.
<h1 align="center">cve-tracker</h1>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/images/logo-dark.webp">
<img src="docs/images/logo-light.webp" alt="cve-tracker: small, self-contained CVE watcher" width="320">
</picture>
</p>
<p align="center">
<b>Watch public CVE feeds for what you run. Get alerts in Teams, Slack, webhooks or your own script.</b><br>
One Go binary, one state file. No database, no UI.
</p>
<p align="center">
<b>CVE.org (MITRE)</b> · <b>CISA KEV</b> · <b>CISA Vulnrichment</b> · <b>FIRST EPSS</b> · <b>CVSS v4.0 / v3.1</b> · <b>CWE</b> · NVD (planned)
</p>
<p align="center">
<a href="https://github.com/sihamouda/cve-tracker/actions/workflows/ci.yml"><img src="https://github.com/sihamouda/cve-tracker/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
<a href="https://github.com/sihamouda/cve-tracker/actions/workflows/tla.yml"><img src="https://github.com/sihamouda/cve-tracker/actions/workflows/tla.yml/badge.svg" alt="TLA+ model check"></a>
<a href="https://github.com/sihamouda/cve-tracker/releases"><img src="https://img.shields.io/github/v/release/sihamouda/cve-tracker?include_prereleases" alt="Release"></a>
<img src="https://img.shields.io/github/go-mod/go-version/sihamouda/cve-tracker" alt="Go version">
<a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="License: Apache-2.0"></a>
</p>
<p align="center">
<a href="docs/users/getting-started/README.md">Getting started</a> ·
<a href="docs/users/guide/configuration/README.md">Configuration</a> ·
<a href="docs/users/guide/writing-rules.md">Writing rules</a> ·
<a href="docs/README.md">Documentation</a>
</p>
---
A **small, self-contained CVE watcher** for DevOps teams. You describe what you run in
a YAML file (for example *"WordPress core 6.4.x, the WooCommerce plugin, nginx"*), the
minimum severity you care about, and how far back to look. `cve-tracker` periodically
checks the public vulner