Skip to content

The CVE, the stack it hits, the patch ready. In one message.

Describe or collect every stack you run, for yourself or your clients. CVE Patrol watches the feeds, tells you what is really affected and exploitable, and hands your AI assistant a patch ready to review.

Start free See how it works

Built by a team that answers its own clients' security alerts with it, every week.

Alert CVE-2026-98432 Linux kernel, local privilege escalation
  • CVSS 9.8
  • KEV
  • public exploit
StackFoundVerdictFix
broker-prod kernel 6.1.188 affected 6.1.190
crm-legacy kernel ? to verify 6.1.190
shop-api kernel 6.12.113 fixed 6.12.113
docs-site no kernel in scope not affected ·
Patch prompt for Claude Code 
Stack broker-prod runs Debian 12 with linux-image-amd64 6.1.188-1. CVE-2026-98432 is fixed in 6.1.190-1 (DSA). Upgrade the package with apt, confirm the new kernel is first in grub.cfg, then plan a reboot outside business hours. Do not change the Debian release.
48,244
CVEs published in 2025, a record
195/day
new CVEs in 2026, and rising
24 h
to report an exploited flaw (EU CRA)
Product tour

From the alert to the patch, in under a minute

Describe a stack, get the verdict, hand the patch to your AI assistant.

Video coming soon
The problem

Your client's CERT already sent the alert. Then the clock starts.

Answering "are we affected?" takes hours today. It should take minutes.

Today
  • An alert per CVE, for every product on earth
  • A scanner per server, a bot per repository
  • Hours of SSH to answer one email
  • No trace of what was checked and fixed
With CVE Patrol
  • One message per stack really affected
  • No agent, no key, no access to your code
  • Verdict, fixed version and patch prompt in minutes
  • A dated log you can forward as is
What you get

Answers about your stacks, not a vulnerability feed

  • What the service includes

    For each stack, a status: affected, to verify, not exploitable or fixed. With the version found, the version that fixes it and a link to the security advisory.

  • The full inventory, not just the code

    Kernel, OS packages, Docker images, nginx, databases, WordPress plugins, npm, Composer and Python dependencies.

  • Exploited flaws first

    CVEs in the CISA KEV catalog, with a public exploit or a high EPSS score trigger a notification. The others are listed in the report, without an alert.

  • A patch prompt for every affected line

    Ready for Claude Code, Cursor or Codex: target version on the same LTS branch, update command, check after deployment. You review before applying.

  • One workspace per client

    Stacks are grouped by client. Alerts, reports and the log are kept separate per client, managed from a single account.

  • A timestamped, exportable log

    Every alert, status and fix is dated. CSV export, PDF report per client, usable for DORA, NIS2 and the Cyber Resilience Act.

Stop reading vulnerability feeds. Start getting answers about your own stacks, with the patch already written.

How it works

Three steps, no agent to install

  1. 01

    Describe your stacks

    Paste the structured output of a prompt we give you, or run a read only script on a server and paste what it prints. No agent, no SSH key, no access to your code.

  2. 02

    We match, then we filter

    Every new CVE is compared with the exact versions in your inventory, Debian backports included. Then it is ranked by exploitation, not by CVSS alone.

  3. 03

    You get the verdict, the patch, the record

    Email, Slack or webhook: one message per stack really affected, with the fixed version and a patch prompt. The log keeps the trace.

Who it is for

One service, three ways to use it

  • Agencies and studios

    You maintain dozens of client sites and applications on different hosts. CVE Patrol keeps the inventory per client and tells you which ones are affected when an alert comes out.

    Agency plan

  • IT managers

    With or without a dedicated security team, DORA and NIS2 ask you for regular checks and a treatment log. CVE Patrol gives your team both.

    Team plan

  • Developers

    You run an application in production on one or two servers. Dependabot covers the repository, CVE Patrol covers the rest: system, services, images.

    Solo plan
Pricing

Simple plans, priced per stack

  • Free

    For one stack you care about.

    0 € / month

    • 1 stack
    • Weekly email digest
    • KEV and EPSS filters
    Start free

  • Solo

    For a developer or a freelancer.

    19 € / month

    • 3 stacks
    • Daily alerts by email
    • Patch prompt for your AI assistant
    • Exploitation filters
    Choose Solo
  • Most useful

    Team

    For an IT team or a small company.

    49 € / month

    • 10 stacks
    • Slack and webhook
    • 3 users
    • History and CSV export
    • MCP connection
    Choose Team

  • Agency

    For agencies with many clients.

    149 € / month

    • 50 stacks
    • PDF report per client, white label
    • SBOM import
    • Dated treatment log
    • Unlimited users
    Choose Agency

A stack is one application and the hosts, containers and services it runs on.

Extra stacks: 4 € per stack per month on any paid plan.

Monthly, excl. VAT. No card for the free plan. Cancel anytime.

Where it comes from

Built by the team that runs it on its own clients

Born as the internal tool of a team that maintains dozens of client applications and servers, and answers their security alerts every week.

  • Reads what is really deployed, not what the repository says
  • Verdicts carry their proof: advisory, version found, version fixed
  • Patches stay on the LTS branch, no major version jump without a decision
FAQ

Questions before you start

Do you need access to my servers or my code?

No. You describe a stack by pasting the structured output of a prompt we provide, or by running a small read only script on a host and pasting what it prints. Nothing is installed, no key is shared, no code leaves your machines.

Which vulnerability sources do you use?

Public, auditable sources: the CVE records themselves, OSV, the GitHub Advisory Database, CISA KEV, EPSS scores, the Debian, Ubuntu and Red Hat security trackers, and the European EUVD. No proprietary database you cannot check.

How is this different from Dependabot or Snyk?

They read repositories and lockfiles. CVE Patrol reads stacks: kernel, OS packages, web servers, databases, Docker images, CMS plugins and SaaS, across many clients, with no access to the repository. It also ranks by real exploitation instead of CVSS alone.

What counts as a stack?

One environment you describe: an application and the hosts, containers and services it runs on. A client's production site with its server is one stack. Its staging environment is another.

How do you avoid false positives?

Versions are compared per ecosystem: semver, PEP 440, dpkg, apk. Debian and Ubuntu backports are judged by the distribution advisories, never by the upstream version. An unknown version is marked to verify, never fixed. A false positive button feeds the filters.

Can my AI assistant apply the patch?

Yes. Each affected line comes with a patch prompt pinned to the real fixed version, for Claude Code, Cursor or Codex. Team and Agency plans add an MCP connection so your agent reads the report directly. Nothing is applied without your review.

Is this a compliance tool?

It is not an assessment and does not replace your auditor. It produces what DORA, NIS2 and the Cyber Resilience Act expect you to have: an inventory, alerts on exploited vulnerabilities, and a dated log of what was checked and fixed.

Where is my data hosted?

In the European Union. Your inventory contains component names and versions, not your code and not your secrets.

How do I start?

Create an account, describe a first stack, and get your first report within minutes. The free plan needs no card. Upgrade when you need more stacks, cancel anytime.

Describe your first stack before the next alert lands

Free plan, no card, first report in minutes.

Start free