CVE alerts by webhook

How it works

1. Build your list: catalog products (FortiOS, Node.js, Windows Server…) or code and OS packages (npm, PyPI, Debian…), each with free-form tags such as client-acme.
2. Every 15 minutes, Vexday matches new and changed CVEs against your list.
3. Critical ones go out right away. The rest goes into a daily digest, at each destination's time and time zone.
4. History doesn't fire: when you add a technology, the CVEs that already affected it become the baseline, with nothing sent.

When an alert fires

Right away or in the digest

Default policy: right away, KEV, public PoC, an official Brazilian alert, CVSS ≥ 9 or EPSS ≥ 50%; in the daily digest, CVSS ≥ 4; the rest is logged, not sent.

The policy is yours. For high-volume vendors (Microsoft, Oracle, Cisco), the “active exploitation only” template alerts right away only on an exploitation signal. Each technology can also always go right away or always to the digest. And each destination has a daily cap on immediate alerts: past it, the most severe go out right away and the rest goes to the digest.

Destinations

The dashboard's test button sends a verification message. Slack and Discord URLs are stored encrypted.

What reaches your endpoint

One POST per round with up to 100 immediate alerts (type cve.alerts), and one a day with the digest (type cve.digest). Each CVE's fields are the API's, and attribution carries the credits the sources' licenses require.

{
  "id": "4bf933c7-c07a-4a45-a1b0-8729d2eebc8e",
  "type": "cve.alerts",
  "api_version": "2026-11-01",
  "created_at": "2026-11-03T14:05:00+00:00",
  "events": [{
    "id": "0b6d9a51-8c2e-4f7a-9d3b-2e5c1a7f4b60",
    "level": "immediate",
    "reason": "kev",
    "created_at": "2026-11-03T14:00:12+00:00",
    "severity": 9.8, "severity_source": "cvss",
    "cve": {
      "id": "CVE-2026-12345",
      "title": "…",
      "cvss": 9.8, "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "epss": 0.71, "epss_percentile": 0.99,
      "in_kev": true, "kev_ransomware": false,
      "kev_due_date": "2026-11-24",
      "kev_required_action": "Apply mitigations per vendor instructions…",
      "ssvc_exploitation": "active",
      "has_public_poc": true, "has_nuclei": true, "has_metasploit": false,
      "vulncheck_kev": true, "vulncheck_reported_exploit": true,
      "published": "2026-11-01T10:00:00+00:00",
      "url": "https://vexday.io/pt/cve/CVE-2026-12345",
      "gov_br_alerts": []
    },
    "matched": [{
      "kind": "product", "slug": "fortinet-fortios", "name": "FortiOS",
      "vendor": "Fortinet", "ecosystem": null, "tags": ["cliente-acme"]
    }]
  }],
  "attribution": [
    "CVE® records © The MITRE Corporation, used under the CVE Terms of Use (https://www.cve.org/Legal/TermsOfUse).",
    "This product uses data from the NVD API but is not endorsed or certified by the NVD."
  ]
}

Headers and signature

Content-Type: application/json
User-Agent: Vexday-Webhooks/1
X-Vexday-Event: cve.alerts
X-Vexday-Delivery: 4bf933c7-c07a-4a45-a1b0-8729d2eebc8e
X-Vexday-Signature: t=1762178700,v1=<HMAC-SHA256 hex>

X-Vexday-Delivery is the same on every attempt: skip a delivery you already processed. To verify the signature, recompute the HMAC-SHA256 of "t.body" with the endpoint's secret (in the dashboard) over the raw body bytes, and reject a t more than 5 minutes off:

# Python
import hashlib, hmac, time

def verify_signature(secret: str, body: bytes, header: str, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = parts.get("t", "0"), parts.get("v1", "")
    if abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(v1, expected)

// Node.js
const crypto = require("crypto");

// body: the raw body (Buffer), before JSON.parse
function verifySignature(secret, body, header, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = parts.t || "0";
  if (Math.abs(Date.now() / 1000 - Number(t)) > tolerance) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(t + "."), body]))
    .digest("hex");
  const got = Buffer.from(parts.v1 || "");
  return got.length === expected.length &&
    crypto.timingSafeEqual(got, Buffer.from(expected));
}

Plans

The plan changes volume, never content: all three have the same alerts, digest, tags and three destinations. 14 free days to start, with a card; cancel anytime.

On the free account, the dashboard can email you when a CVE in your stack enters the KEV.