Observed arrival · 2026-10-26
VulnSub makes vulnerability alerts earn their place
VulnSub offers free email alerts matched to selected technology stacks or package versions, using exploitation evidence and fix availability to filter what gets sent.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Developers tracking vulnerabilities in their dependencies
- Worth noticing
- The worked example holds a CVSS 7.4 lodash advisory at 5.2% EPSS, while a KEV-listed jQuery issue is sent.
Field notes
The page compares six advisories against its published criteria, including several lodash examples that are held below the stated thresholds. For dependency matching, it says lockfiles are parsed in the browser and only ecosystem, package name, and version are sent to OSV.dev. The homepage reports coverage of 52 platforms and frameworks; it also says CISA KEV is re-mirrored hourly and EPSS scores are refreshed daily.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue