Trust and transparency
How VulniPulse works, measured
VulniPulse reads official vendor security advisories and alerts you when one matches your rules. This page shows where the data comes from, how fresh each source is and how quickly new advisories reach an alert, computed from what the service records. It also lists how accounts and payments are protected.
Freshness and speed, last 90 days
Sources checked in the last hour
34 of 34
Vendor sources whose latest successful check was under an hour ago.
Picked up after publication
2 h 36 min
Median over 9196 timed advisories; 90% within 2 d 12 h.
Ready to alert
3 h 18 min
Median from publication to alert-ready; 90% within 2 d 12 h.
First alert email sent
16 min
Median from publication to the first alert email, all vendors, 4381 advisories.
Times run from the vendor's published timestamp. Only advisories whose vendor timestamp includes a time of day are measured: many vendors publish a date only, which would read as midnight and overstate the delay, and a vendor that publishes midnight in its own time zone can still overstate it. Records first seen more than 7 days after publication come from adding a source later and are left out. A median needs at least 5 records. “Ready to alert” includes the wait for a vendor's full detail when a feed lists an advisory before its detail page is complete. Email time is shown for all vendors together only, so the page never reveals which vendors any account watches. These are measurements, not a delivery guarantee. Updated 2026-11-01 13:07 UTC; refreshed every 10 minutes.
Sources by vendor
34 vendors, each read from its own official source. CVE.org, CISA KEV and NVD add identifiers, exploitation status and scores; they never override the vendor's statement.
| Vendor and official source | Last successful check | Advisories (90 d) | Picked up after publication | Ready to alert |
|---|---|---|---|---|
| Apache Software FoundationASF Security ([email protected] CNA) via NVD | 3 min agoOK | 712 | 11 min median · 712 records | 11 min median · 712 records |
| AtlassianAtlassian ([email protected] CNA) via NVD | 2 min agoOK | 7 | 3 min median · 7 records | 3 min median · 7 records |
| Check PointCheck Point ([email protected] CNA) via NVD | 3 min agoOK | 4 | Too few timed records | Too few timed records |
| CiscoCisco Security Advisories | Less than a minute agoOK | 102 | 3 min median · 102 records | 10 min median · 102 records |
| CommvaultCommvault Cloud Security Advisories | Less than a minute agoOK | 26 | 3 h 31 min median · 26 records | 3 h 31 min median · 26 records |
| DockerDocker Security ([email protected] CNA) + NVD | Less than a minute agoOK | 23 | 9 min median · 23 records | 9 min median · 23 records |
| F5F5 SIRT ([email protected] CNA) via NVD | 2 min agoOK | 20 | 11 min median · 20 records | 11 min median · 20 records |
| FortinetFortiGuard PSIRT Advisories | Less than a minute agoOK | 55 | 5 h 31 min median · 55 records | 5 h 31 min median · 55 records |
| GitLabGitLab ([email protected] CNA) via NVD | 1 min agoOK | 91 | 11 min median · 91 records | 11 min median · 91 records |
| HPE Aruba NetworkingHPE Aruba Networking Security Advisories (PSIRT) via NVD | Less than a minute agoOK | 258 | 11 min median · 258 records | 11 min median · 258 records |
| IvantiIvanti Security Advisories | Less than a minute agoOK | 24 | 10 min median · 24 records | 10 min median · 24 records |
| Juniper NetworksJuniper SIRT (JSA) via NVD | Less than a minute agoOK | 171 | 11 min median · 171 records | 11 min median · 171 records |
| Microsoft ServerMicrosoft Security Update Guide (MSRC) | Less than a minute agoOK | 2210 | 20 min median · 2205 records | 20 min median · 2205 records |
| MikroTikMikroTik Security Announcements + NVD | 2 min agoOK | 8 | 5 min median · 8 records | Too few timed records |
| N-ableN-able security advisories and CVE records | 1 min agoOK | 3 | Too few timed records | Too few timed records |
| NetAppNetApp Product Security Advisories (PSIRT) | Less than a minute agoOK | 416415 dated without a time | Too few timed records | Too few timed records |
| Netgate pfSenseNetgate Security Advisories + NVD | 3 min agoOK | 30 | 9 min median · 30 records | 9 min median · 30 records |
| NETGEARNETGEAR Security Advisories (kb.netgear.com) via NVD | 2 min agoOK | 18 | 15 min median · 18 records | 15 min median · 18 records |
| NetScaler (Citrix)NetScaler / Cloud Software Group Security Bulletins | Less than a minute agoOK | 15 | 10 min median · 14 records | 10 min median · 14 records |
| Omnissa (ex-VMware EUC)Omnissa Security Advisories (OMSA) | Less than a minute agoOK | 0 | Too few timed records | Too few timed records |
| Palo Alto NetworksPalo Alto Networks Security Advisories | Less than a minute agoOK | 37 | 0 min median · 37 records | 8 min median · 37 records |
| ProxmoxProxmox Security Advisories + NVD | 3 min agoOK | 4 | Too few timed records | Too few timed records |
| QNAPQNAP PSIRT ([email protected] CNA) via NVD | 1 min agoOK | 39 | 10 min median · 39 records | 10 min median · 39 records |
| Red Hat LinuxRed Hat Security Data API | Less than a minute agoOK | 92073139 dated without a time | 16 h 54 min median · 4974 records | 19 h 22 min median · 4945 records |
| SentinelOneSentinelOne product CVE records | 2 min agoOK | 0 | Too few timed records | Too few timed records |
| SonicWallSonicWall PSIRT ([email protected] CNA) via NVD | Less than a minute agoOK | 30 | 9 min median · 30 records | 9 min median · 30 records |
| SophosSophos ([email protected] CNA) via NVD | Less than a minute agoOK | 2 | Too few timed records | Too few timed records |
| SplunkSplunk ([email protected] CNA) via NVD | 2 min agoOK | 162 | 5 min median · 162 records | 5 min median · 162 records |
| SynologySynology PSIRT ([email protected] CNA) via NVD | 2 min agoOK | 6 | 16 min median · 6 records | 16 min median · 6 records |
| UbiquitiUbiquiti Security Advisory Bulletins + NVD | 3 min agoOK | 42 | 10 min median · 42 records | 10 min median · 42 records |
| VeeamVeeam Knowledge Base — Security Advisories | Less than a minute agoOK | 1717 dated without a time | Too few timed records | Too few timed records |
| VMware (Broadcom)VMware Security Advisories (VMSA) via NVD | Less than a minute agoOK | 51 | 53 min median · 51 records | 53 min median · 51 records |
| WatchGuardWatchGuard PSIRT Advisories via NVD | 3 min agoOK | 72 | 16 min median · 72 records | 16 min median · 72 records |
| ZyxelZyxel Security Advisories via NVD | 2 min agoOK | 8 | 21 min median · 8 records | 21 min median · 8 records |
How matching works
- A whole-vendor rule matches every advisory from that vendor's official feed that passes your alert priority (for example High and Critical; known-exploited advisories are always included).
- A platform rule matches only when the advisory names that platform or one of its recorded aliases, never the vendor umbrella alone. Ambiguous product evidence is not promoted to a match.
- An advisory alerts only once its detail is complete. Corrections and newly published fixes are re-processed, and a fix release or a new CISA KEV listing sends a follow-up.
- The same rules decide what your weekly digest, your dashboard and your real-time alerts show; there is no model or score that decides on your behalf.
The full description is in the methodology.
Security practices
Passwords
Passwords are stored only as salted scrypt hashes. Optional two-factor sign-in uses an authenticator app; its secret is stored encrypted with AES-256-GCM (an older secret is re-encrypted the next time it is used).
Sessions and links
Session cookies are HttpOnly and SameSite=Lax, and only their SHA-256 hash is stored. Verification, password-reset and team-invite links are single use and stored as hashes too.
Browser protections
Every page sends a Content Security Policy with a per-request nonce, refuses to be framed (frame-ancestors 'none' and X-Frame-Options: DENY) and sends nosniff, a strict referrer policy and HSTS over HTTPS. State-changing requests from other sites are refused.
Webhooks
Webhook addresses must use HTTPS. Private, loopback and cloud-metadata addresses are refused when you save a webhook and again at delivery, and each delivery is signed with HMAC-SHA256 so you can verify it.
Payments
Card payments on the website are taken by Stripe Checkout and on Android by Google Play. VulniPulse never receives your card number; it keeps the provider's customer and subscription identifiers, and only a keyed hash of a card fingerprint to enforce one free month per person.
Abuse limits
Sign-up, sign-in, test alerts and other sensitive actions are rate limited. Network and device signals used against repeat free months are stored as salted one-way hashes, never as raw addresses.
Your data
Alert rules and inventories are private to your account. You can delete your account at any time from your account page; deletion removes your rules, devices, sessions and alert delivery history.
No AI
VulniPulse does not use an AI model to match advisories, rate them or write alerts. Matching is deterministic and every alert links to the vendor's own advisory.
Contact, security reports and cancelling
Questions, data corrections and security reports go to [email protected]. Please do not include credentials or private inventory in a first message. How personal data is handled is described in the privacy policy.
You can cancel a website subscription in your account, or without signing in on Verträge hier kündigen. Consumers in the EU can withdraw within the withdrawal period on Vertrag widerrufen. See how VulniPulse compares with other CVE alert services.