Gaviero alerts you to the CVEs that affect your software, and tells you why.

You send us the list of software you run, or your product's SBOM. Every time a CVE is published, Gaviero matches it against that list, and if it affects you, you get an alert with the affected version and the rule that decided it. We alert you to what affects you, with the reason. If in doubt, it arrives marked “to review”, never hidden.

Try it free
Your software list3 programs
ProgramVersionStatus
OpenSSL3.0.2Exploited
nginx1.24.0To review
PostgreSQL16.2No alerts
OpenSSL 3.0.2
  • EXPLOITEDCVE-2026-00010
  • AFFECTEDCVE-2026-00011
  • REVIEWCVE-2026-00012
  • NOT AFFECTEDCVE-2026-00013

Update to 3.0.15fixes 2 CVEs

Panel example, with made-up data

How it works

Gaviero reads new CVEs from the official registry every 10 minutes. For each one it checks whether it names something on your list and whether your version is in the affected range. Several sources, not one. Once a day it checks against several public reference sources, because many CVEs change after they are published. You see it all in your panel, and alerts reach you however you prefer:

Your private panel

See your software list, which CVEs affect you based on the exact version you run, which ones need review and, when the CVE record gives the fix, which version to update to.

Private API

Reachable only over VPN with your company's key. From the Internet it doesn't exist.

Signed webhook

Each new alert is sent, signed, to the address you give us, so your ticketing system or SIEM can pick it up.

Telegram and daily summary

If you don't want to integrate anything, each alert reaches your phone and every morning you get a summary with the most serious ones.

We'll connect it to Slack, Teams or Jira if you need it.

It runs without AI. The rules are fixed: the same list and the same CVEs always give the same result, and every alert says which rule produced it. Not sure what you have installed? .

What an alert can say

EXPLOITED

It affects you and is already used in attacks. Look at this first.

AFFECTS

The vendor confirms your version is affected.

REVIEW

There are signs, but the vendor doesn't confirm it. Gaviero tells you which.

NOT AFFECTED

Your version is out of range. No alert; the report only counts how many.

When something is unclear, it goes to "review". Gaviero never assumes it is fine.

How many slip through?

alerts on at least99.9%

In a test with 9,358 real cases that were affected, compared with NVD as the reference, 2 went unreported: two old CVEs (from 2010 and 2013) whose record names neither the vendor nor the product. With 99% confidence, it alerts on at least 99.9%.

TestAffected casesAlertedMissedMinimum, 99% confidence
General9,3589,356299.9%
2026 CVEs9,0659,065099.95%
Exploited (CISA KEV)2,5052,505099.8%

Deterministic results. Because the service runs without AI, the same list and the same CVEs always give the same result, and every alert can be explained step by step. The automatic part of the test can be repeated with the same outcome; the reviewed samples are the ones picked at random.

How many false alarms?

correct alerts, at least97%

In a test with 135 programs and the full CVE history, we compared 43,131 "affected" alerts with NVD and a random sample of 80 of the 1,842 that did not match was reviewed against the vendor's own record: at least 97% of the alerts were correct.

And the doubtful ones?

"review" cases that really affect you≈ 4 in 10

When there are signs but the vendor doesn't confirm it, Gaviero doesn't dismiss it: it shows it to you as "review" and you decide. In the 135-program test, about 43% of those that could be checked did turn out to be affected. That's why we don't hide them.

Who it is for

For anyone with software to keep up to date: companies running their own servers, applications and network gear; software and device makers, using their product's SBOM (if you sell in the EU, the Cyber Resilience Act has required reporting exploited flaws since 11 September 2026); and IT service providers with many clients, one list per client.

Early access, at no cost

Start with about 20 programs: upload them with their version from the panel or the API and see which published CVEs affect them and why. If you like it, add the rest. We are opening it to 5 companies in exchange for their feedback.

Request access Places: 5 of 5 open. vardiansec.contact@gmail.com No form: this site keeps no data about you.

Results: how many CVEs slip through

An alerting service is only useful if it doesn't miss the ones that matter. This is what we measured, failures included.

2 missed out of 9,358

In a test with 9,358 real cases that were affected, compared with NVD as the reference, 2 went unreported: two old CVEs (from 2010 and 2013) whose record names neither the vendor nor the product. With 99% confidence, it alerts on at least 99.9%.

9,358 squares, one per case; 2 in red
Alerted (9,356)Missed (2)Each square is one test case.

By group

GroupAffected casesAlertedMissedAt least, 99% confidence
General test9,3589,356299.9%
CVEs published in 20269,0659,065099.95%
Exploited (CISA KEV catalogue)2,5052,505099.8%

The last column is the minimum that can be claimed with 99% confidence from those cases, a more cautious measure than the plain hit rate.

False alarms

The other half of the question: how often Gaviero alerts on something that does not affect you.

TestAlerts checked against NVDConfirmed by NVDDid not matchCorrect, at least
135 programs, full history43,13141,2891,84297%

Of the 1,842 that did not match, a random sample of 80 was reviewed against the vendor's own record: in 27 the version was in fact affected (NVD had missed the branch), 33 were false alarms and 20 were versions the vendor no longer supports and says nothing about. With 95% confidence, at least 97.8% of alerts are correct; even counting those 20 doubtful cases as errors, it stays around 97%.

The two misses

Both are old CVEs with a poorly filled-in record: vendor and product say "n/a", and the program is only named in the description. Recent CVEs almost always include that data, and none of the 9,065 from 2026 slipped through.

CVE-2013-2220

Affects "Radius", a PHP PECL extension. The name gets confused with GNU Radius and others, and it produced no alert.

CVE-2010-0349

Affects WebCalenderC3. No alert for this CVE was sent, so it counts as a miss, but it didn't go unnoticed: the history check left the program as "unidentified", pending your review, so you knew it wasn't being watched.

How it was measured

  • We started from real cases where NVD says a product and version are affected by a CVE.
  • We registered those products the way a customer would and checked whether Gaviero alerted, as "affected" or as "review". Both count as alerted; in this test, a little over 4 in 10 cases were "review".
  • We tested the full service, which also checks NVD every day. So this test does not measure what Gaviero would find without NVD: it measures that what NVD says is affected ends up reaching you as an alert.
  • It does not measure whether the alert arrives on the day the CVE is published. If the vendor's data is wrong or does not name your product, the alert may wait until NVD has analysed the CVE, which can take days or weeks.
  • The minimum is computed at 99% confidence.

"Review" cases: how many really affect you

The false alarms above are about "affected" alerts. "Review" cases are the part we hand you to check by hand, because they're doubtful: there are signs, but the vendor doesn't confirm them. So that none slips past you, we show them to you and you decide. In the same 135-program test, of the "review" cases that can be checked, roughly 4 in 10 (≈ 43%) do affect you, a little under half (≈ 48%) don't, and the rest (≈ 10%) are versions the vendor no longer supports and says nothing about.

Measured against NVD; a random sample of 60 of those NVD didn't confirm was reviewed. The ones that don't affect you are almost all old CVEs where the version only appears in the description. We'll repeat the test, also checking against OSV.dev.

How to get your software list

You don't have to write it by hand. Pick what you have, copy the command and in a few minutes you'll have a file. No command sends anything: the file stays on your machine, you review it, delete anything you don't want to share, and upload it yourself.

Windows

Open PowerShell (it doesn't need to be as administrator) and paste this. It reads the list of installed programs Windows uses for "Add or remove programs" and saves it to programas.csv in your current folder.

$rutas = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
         'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $rutas |
  Where-Object DisplayName |
  Select-Object @{n='software';e={$_.DisplayName}}, @{n='version';e={$_.DisplayVersion}} |
  Sort-Object software -Unique |
  Export-Csv programas.csv -NoTypeInformation -Encoding UTF8
You get each program's name, vendor and version.

Linux

Debian, Ubuntu

dpkg-query -W -f='${db:Status-Abbrev}\t${source:Package}\t${source:Version}\n' |
  awk -F'\t' '$1 ~ /^ii/ { v = $3; sub(/^[0-9]+:/, "", v); print $2 "\t" v "\t" "pkg:deb/linux/" $2 "@" v }' |
  sort -u > programas.tsv

Red Hat, Rocky, Alma, Fedora, SUSE

rpm -qa --qf '%{SOURCERPM}\n' | grep '\.src\.rpm$' | sed 's/\.src\.rpm$//' | sort -u |
  awk '{ n = split($0, p, "-"); v = p[n-1]; nom = p[1]; for (i = 2; i <= n - 2; i++) nom = nom "-" p[i]; print nom "\t" v "\t" "pkg:rpm/linux/" nom "@" v }' > programas.tsv

You get each source package ("openssh", not "openssh-client"), which is the name CVEs are published under. A normal server lists hundreds. Upload them all: the ones without CVEs make no noise.

Docker

The images you have running, with their version:

docker ps --format '{{.Image}}' | sort -u | sed -E 's/:([^:/]+)$/,\1/' > imagenes.csv
If an image says latest instead of a number, tell us which version it is or generate its SBOM (below).

Your product's SBOM

If you make software or firmware, this is the best option: an SBOM also lists the libraries inside, which is where CVEs usually are. The CRA will require one from 11 December 2027. Syft is free and generates it in one command.

Install Syft (Linux or macOS)

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
On Windows, download the executable from Syft's releases page on GitHub.

From a container image

syft mi-producto:2.3.1 -o cyclonedx-json > sbom.cdx.json

From the source folder or unpacked firmware

syft dir:./mi-producto -o cyclonedx-json > sbom.cdx.json

Routers, firewalls and NAS

These have no command: the version is in their admin panel, usually under "System" or "Firmware". Write them in a text file in this format, one per line:

nombre,version
Fortinet FortiGate 60F,7.2.8
Synology DSM,7.2.1
MikroTik RouterOS,7.14
Made-up examples. Save it as equipos.csv.

And then

  1. Open the file and delete anything you don't want to share.
  2. Upload it from your panel or through the API, both only over your VPN. Please don't email it: the list of what you have installed is sensitive and shouldn't travel as an attachment.
  3. If Gaviero can't identify a name, it shows it in your panel with the closest products so you can pick the right one.

Stuck? Write to us and we'll do it together in a half-hour screen-sharing call.