CVSS vector
Affected products
Loading…
None of the products Overseer tracks are linked to this CVE.
Overseer needs JavaScript to load its data. Turn JavaScript on to use the site.
Software Vulnerability Intel
Overseer follows the CVE List, the NVD and CISA's Known Exploited Vulnerabilities catalog around the clock, and links every CVE to the vendors and products it affects.
Create an account and pick the software you run to get alerted when a vulnerability affecting it is published or exploited.
Coming to iPhone
Overseer for iOS
Download the iOS app to get notifications from your stack straight to your phone.
Latest vulnerabilities
All vulnerabilities →
Vendors
Loading…
Software
Loading…
Vulnerabilities
Loading…
Overseer app
Follow the software you run, and hear about it when a vulnerability in it is being exploited.
The app isn't available yet. This page describes what it's being built to do.
What it does
- Your stack. Pick the products you run from the same catalog this site lists.
- Alerts. Get a notification when a CVE affecting your stack is added to CISA's KEV catalog, or meets the CVSS and EPSS thresholds you choose.
- On your schedule. Quiet hours and digests, so alerts arrive when you want them.
- No passwords. Sign in with Apple.
- Yours to delete. Delete your account in the app at any time, and everything tied to it goes with it.
Privacy
What the app stores, why, and how deletion works is set out in the privacy policy.
Privacy policy
Effective 18 October 2026
In short
Browsing Overseer needs no account. If you create one, Overseer keeps what it needs to sign you in and to send the alerts you ask for, and nothing else. It doesn't sell or share your data, and keeps no record of your IP address.
Your account
- Sign-in details: your email address, a salted hash of your password (never the password itself), and whether you've confirmed the address. If you set up an authenticator app, its secret key (encrypted) and your backup codes.
- Sessions: for each browser you're signed in on, when the session started and when it expires. Not your IP address or browser.
- Your stack: the products you follow.
- Your alert settings: whether alerts come by email, by push notification or both, whether to alert on KEV additions, your minimum CVSS and EPSS scores, daily-summary preference, time zone and quiet hours.
- Where alerts go: the push address your browser gives Overseer when you turn on notifications, for each browser, and when it was last used.
- Alerts sent: which CVE we alerted you about and when, so you aren't alerted twice.
How it's used
To sign you in, to send the emails that keep your account secure (confirming your address, sign-in codes, password resets and notices of changes), and to decide which alerts to send you, how and when. Alert emails go only to your account's address, only while email alerts are on, and each has a link that turns them off. Overseer doesn't send marketing email.
Security checks
- When you choose a password, its first five hash characters are checked against Have I Been Pwned's list of breached passwords. Neither the password nor your email leaves Overseer.
- To stop password guessing, sign-in attempts are counted per address and per IP address for a few minutes. The counters are stored as one-way codes, not as addresses, and are deleted when they expire.
- The sign-up, sign-in and password-reset forms are protected by Cloudflare Turnstile, which tells people from bots without asking you to solve a puzzle; you won't see it. When you submit one of those forms, Turnstile runs a check in your browser that collects technical signals from it, such as your IP address and details of the browser and device, and Cloudflare uses them only to make that check. It doesn't see what you type into the form. See Cloudflare's Turnstile privacy addendum for what it collects and how long it keeps it.
Cookies
Overseer sets cookies only to keep you signed in: a session cookie, a short-lived one while you enter a sign-in code, and, if you tick “don't ask for a code”, one that remembers this browser for 30 days. None are used for tracking or advertising.
Who handles it
- Cloudflare hosts Overseer and its database, sends its emails, and runs the Turnstile check on sign-in forms.
- Your browser's push service (Apple, Google or Mozilla, depending on the browser) delivers notifications, if you turn them on.
Deleting your account
Delete your account from the Account page at any time. This removes your account, sessions, stack, alert settings, notification addresses and alert history straight away. Database backups are kept for up to 30 days, after which no copy remains.
This website
Overseer keeps no logs of your requests. The site is served by Cloudflare, which handles your IP address to deliver it, to protect it from abuse and to enforce rate limits. The site also uses Cloudflare Web Analytics, which counts page views without cookies and without tracking you across sites.
Vendor and product pages load descriptions and logos through Overseer, which fetches them from Wikidata, Wikipedia, Wikimedia Commons, Simple Icons and Iconify, so your browser never contacts those sites directly.
Changes
If this policy changes, the new version will be posted here with a new effective date, and account holders will be told by email of any change to what's kept.
Support
Common questions, and where the data comes from.
Questions
What is Overseer?
A free catalogue of CVEs (publicly disclosed security vulnerabilities), linked to the vendors and products they affect, and flagged when CISA has seen them exploited.
How current is the data?
New and changed CVEs are picked up from the CVE List within minutes of being published, and so are additions to CISA's Known Exploited Vulnerabilities catalog. NVD scores are checked every two hours and EPSS scores once a day. The banner on the home page shows the latest change.
What do KEV, CVSS and EPSS mean?
KEV means CISA has evidence the vulnerability is being exploited. CVSS rates how severe it is, from 0 to 10; Overseer shows NVD's own score when there is one, otherwise the score in the CVE record. EPSS estimates the chance it will be exploited in the next 30 days.
Why isn't my software listed?
Overseer tracks a curated set of products, so that every link between a CVE and a product is reliable. Every CVE is still listed under Vulnerabilities.
Do I need an account?
No: everything on the site is open to browse. An account lets you follow the products you run in your stack and get alerts when a vulnerability affects one of them.
I didn't get the email
Check your spam folder, and that the address is right. Emails come from no-reply@overseercve.com. You can ask for a new link from the sign-in page, a few at a time.
How do I stop alert emails?
Use the link at the bottom of any alert email, or turn off email alerts on the Alerts page. The emails that keep your account secure, such as sign-in codes, still come.
How do I delete my account?
From the Account page, at the bottom. It takes effect straight away.
Is there an app?
An iOS app is being built, to alert you when a vulnerability affects the software you run.
Data sources
- CVE List: the CVE records. Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Used under the CVE Program's terms of use: MITRE grants a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™), provided MITRE's copyright designation and this license are reproduced in any such copy.
- CISA Known Exploited Vulnerabilities catalog: which CVEs are known to be exploited. Released under CC0 1.0. Overseer is not endorsed by CISA or DHS.
- National Vulnerability Database: NVD's CVSS scores and product names. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Exploit Prediction Scoring System (EPSS): exploitation probabilities, from FIRST's EPSS Special Interest Group, with scores generated by Empirical Security.
- Wikidata (CC0) and Wikipedia (CC BY-SA 4.0, credited wherever a summary is shown): vendor and product descriptions.
- Logos come from Simple Icons (CC0), Wikimedia Commons, and, through Iconify, CoreUI Brands (CC0), SVG Logos (CC0), Material Design Icons (Apache 2.0) and Devicon (MIT). They are trademarks of their owners, shown only to identify their products.
- Icons on this site are from Lucide (ISC licence).
Overseer is independent and not affiliated with or endorsed by any of these organisations.
Terms of use
Effective 18 October 2026
Using the site
Overseer's website is free to use, for any lawful purpose, with no account.
- Requests are rate-limited per address. Don't try to get around the limit, for example by spreading requests across many addresses.
- Don't scrape the site or the service behind it, or otherwise put a load on it that gets in the way of other people using it.
Your account
An account is optional and free. Keep your password, and your authenticator app and backup codes if you use them, to yourself. Overseer may suspend an account that's used to abuse the service. You can delete your account at any time from the Account page.
The data
The data comes from public sources, each under its own terms; see data sources. If you republish it, follow those terms, including the CVE Program's notice and NVD's.
The data is provided as is, without warranty of any kind. It may be incomplete, out of date or wrong, and it is not security advice: check vendor advisories before acting on it. Overseer isn't liable for any loss arising from its use.
Names and logos
Vendor and product names and logos are trademarks of their owners, shown only to identify their products. Their use doesn't imply any affiliation or endorsement.
Changes
These terms may change; the effective date above shows when they last did.
Create an account
Check your email
We've sent a link to . Open it to confirm your address, then sign in. The link works for an hour.
Already have an account? Sign in
Sign in
New to Overseer? Create an account
Reset your password
If has an account, we've sent it a link to choose a new password. The link works for an hour.
Choose a new password
My stack
Loading…
Alerts
Loading…
Notifications in this browser
This browser can't receive notifications. On iPhone and iPad, add Overseer to your Home Screen (Share, then Add to Home Screen), open it from there, and turn them on.
Notifications aren't available right now.
Notifications are blocked for this site. Allow them in your browser's site settings, then reload.
Alerts as notifications in this browser, even when Overseer is closed.
On in this browser.
Other browsers
Sent alerts
Account
Loading…
Your account
Change password
Change email
Two-step sign-in
Save these backup codes somewhere safe. Each one signs you in once if you lose your authenticator app. They won't be shown again.
Where you're signed in
Delete account
Alert emails
Done: you won't get alert emails any more. Turn them back on from the Alerts page whenever you like.
Page not found
There's nothing at this address. Try vulnerabilities, software or vendors.