High profile cybersecurity vulnerabilities are hard to miss. They quickly appear in news articles and on social media, and customers ask about them.
The challenge is everything else.
Thousands of CVEs are published every year. Many of which never make the headlines. Even if you're actively following developments, it's difficult to know whether a newly published vulnerability affects relevant products and vendors without repeatedly checking multiple sources.
We wanted a better way to answer a simple question: "Has anything new been published that I ought to know about?"
That's why we built MyCVEFilter
The idea is straightforward: monitor newly published vulnerabilities and notify you when they match the products or vendors you're interested in. Rather than searching multiple sources every day, you define your watched terms once and let the service do the monitoring for you.
Of course, building it has turned out to be much more interesting than we expected.
One of the biggest challenges is matching. On the surface, it sounds easy, if a CVE mentions a product, alert the user. In practice, product names change, descriptions vary, vendor names are inconsistent. And there isn't always a single authoritative way to identify affected software. Finding the right balance between missing relevant vulnerabilities and generating unnecessary noise is an ongoing challenge.
Another challenge is deciding what constitutes a meaningful update. New CVEs are easy, they should be reported. But existing CVEs are updated frequently, and many of those changes are purely administrative. A typo fix probably doesn't deserve an alert, but what if an updated description now means the CVE matches one of your watched products when it didn't before? That's the kind of problem we're thinking about as the system evolves.
You can use MyCVEFilter for yourself free at https://cementarius.com/mycvefilter