Send your package list with one command. Get back decisions: what to patch now, what has no fix yet, and what the vendor says, ranked by real-world exploitation.
Email only. No credit card. Key in 30 seconds.
$ { cat /etc/os-release; uname -r; dpkg-query -W -f='${Package} ${Version} ${Architecture} ${source:Package}\n'; } \
| curl -sS https://api.cvefocus.com/v1/check \
-H "Authorization: Bearer $CVEFOCUS_KEY" \
-H "Content-Type: text/plain" --data-binary @-Running 7.0.0-1012-aws, 7.0.0-1014-aws is installed. Fixes on disk are not active until a reboot.
sudo rebootFixes CVE-2024-6387 (regreSSHion). Known exploited (CISA KEV). EPSS 0.93.
sudo apt-get install --only-upgrade openssh-server openssh-client63 open CVEs, none fixed in the standard archive. Highest exploit likelihood: CVE-2024-27983.
Reviewed by Ubuntu and accepted as low risk. Record as accepted risk.
Thousands of new CVEs a month. Most don't apply to you, many have no fix, and a few are being exploited today. CVEfocus tells you which is which.
One clear action per problem: reboot once, upgrade one package, accept one risk. Not 3,000 rows of CVE IDs.
Uses Ubuntu's and Debian's own fix data, so backported patches count. No false alarms from upstream version numbers.
Fixed, not affected (and why), under investigation, or will not fix: straight from the vendor's own VEX statements.
CISA's Known Exploited list and EPSS exploit likelihood decide what is urgent, not just a CVSS number.
When we can't be sure, we say so and tell you exactly what would settle it. We never guess 'not affected'.
No inventories, no results, no IP addresses, no request logs. Your package list is used for the answer and dropped.
Click the link we send. That's the whole sign-up: no password, no card, no sales call.
One click in your dashboard. The key is shown once; we keep only a fingerprint of it.
Paste it into a terminal, a cron job or CI. Code samples for curl, Python, Node, PHP, Ruby, C#, Go, Java and PowerShell.
Metered by distinct products checked per day. Re-checking the same server, every hour if you like, costs nothing extra.
About 10–20 servers
About 50–100 servers
A fleet
No inventories, no results, no IP addresses, no request logs. We store your email and a fingerprint of your key, nothing else. Read exactly what we store.