MD Michał Durlak
PLEN
All projects

AlertIT — live CVE vulnerability feed

A real-time feed of newly published CVE vulnerabilities — no page reloads, no API rate limits, running in a hardened Docker container.

Visit live
  • Node.js
  • Express
  • Server-Sent Events
  • CVE JSON 5
  • Docker
  • nginx
  • Cloudflare
Main view — the daily feed with severity counters
Main view — the daily feed with severity counters
CVE cards with CVSS score, vendor and links to NVD / CVE.org
CVE cards with CVSS score, vendor and links to NVD / CVE.org
Vulnerability details with one-click Polish translation
Vulnerability details with one-click Polish translation
Advanced search: date range and CVSS score range
Advanced search: date range and CVSS score range
Mobile view
Mobile view

About the project

AlertIT tracks the official CVE repository (CVEProject/cvelistV5) and shows new vulnerabilities the moment they are published — in one clean view, with no manual refreshing. It grew out of an everyday need: instead of digging through RSS feeds and vendor bulletins, I wanted to see right away what had landed in the CVE database and how severe it was.

Key features

  • Live feed — new records are pushed to the browser via Server-Sent Events; a status bar shows the connection state and a countdown to the next check.
  • Day view — every CVE published on a given day (Europe/Warsaw time zone), with navigation up to 30 days back.
  • CVSS severity filters — critical, high, medium, low, unscored — plus sorting by severity.
  • Search — by CVE ID, vendor or product; advanced mode adds date ranges and CVSS score ranges.
  • Vulnerability details — affected products and versions, CNA, publication dates, links to NVD and CVE.org, and a one-click Polish translation.
  • Daily summary and browser notifications.

How it works

A Node.js backend regularly (every 90 s by default) fetches only the head of the deltaLog.json change log — using an HTTP Range request with If-None-Match, so when nothing has changed the answer is a lightweight 304. It picks newly published records from the new batches, downloads them, parses them according to the CVE JSON 5 schema and broadcasts them to every connected browser.

Days that aren't stored locally yet are backfilled and persisted server-side — the browser never talks to GitHub directly. The app doesn't use the GitHub API at all, so there are no rate limits and no token to manage.

Security

  • Upstream data is treated as untrusted: sanitised on the server and rendered in the browser via textContent only.
  • Outbound traffic is limited to hard-coded hosts; record URLs are built from a validated CVE ID rather than from links inside the fetched data (no SSRF).
  • Strict Content Security Policy and API rate limiting.
  • Non-root container with a read-only file system, cap_drop: ALL and no-new-privileges; public traffic goes through Cloudflare.