Blast Radius

Every weekday, 06:30 UTC

Only the CVEs that touch your stack.

Paste your dependency manifest once. You get the vulnerabilities affecting the versions you actually run, and nothing else.

Free. One click to unsubscribe. Your address is never shared or sold.

No issue has been sent yetsample appears here after the first run

This newsletter has not run yet, so there is nothing real to show. Rather than mock up a sample, the panel stays empty until the first issue exists. Subscribe and the first one you get will be the first one written.

In every issue

Matched, not dumped
Version ranges are compared against your manifest. A CVE for a version you don't run never reaches you.
Exploitation status first
KEV listing, public proof-of-concept, and whether a patch exists, before the CVSS number.
Silence is the default
No matches means no email. Most days there is no email.

Where it comes from

  • services.nvd.nist.gov/rest/json/cves/2.0
  • cisa.gov/known-exploited-vulnerabilities
  • github.com/advisories (GHSA)
  • osv.dev/v1/query
  • distro security trackers: Debian, RHEL, Alpine

Other titles

Job Queue infrastructure jobs, without the job boards Redline what changed in tech law, shown as a diff Import the libraries that got interesting this week Toolchain the tools people actually started using Sunset deprecations, before they break you Root Cause other people's outages, summarised Rate Card when your vendors change their prices