Know when your software is vulnerable — before attackers do.
PatchRadar monitors CVE feeds in realtime and alerts you when a new vulnerability affects your software stack. No more manually checking NVD, MSRC, or Snyk — just add your software and let PatchRadar watch for you.
label=pypi)
- 🔍 Realtime CVE monitoring — scans NVD, MSRC and Debian Security Tracker for new vulnerabilities
- 📋 Personal watchlist — add any software you want to monitor
- 🎨 Beautiful web UI — dark theme dashboard with charts and filters
- 💻 CLI first — full command line interface for automation
- 📊 CVSS scoring — color-coded severity (Critical / High / Medium / Low)
- 🐧 Debian Security Tracker — monitors open CVEs for Debian/Ubuntu packages
- 💾 Local SQLite — all data stored locally, no cloud, no account needed
- 🐍 Python 3.11+ — modern async architecture with httpx and FastAPI
pip install patchradar# Add software to your watchlist
patchradar add proxmox
patchradar add bitwarden
patchradar add "windows 10"
# Show your watchlist
patchradar list
# Scan for CVEs (last 30 days)
patchradar scan --days 30
# Show latest CVEs in terminal
patchradar status
# Remove software
patchradar remove proxmoxpatchradar serve
# Open http://localhost:8000NVD limits clients without an API key to 5 requests per 30 seconds; a key raises
it to 50. A long scan needs several requests per keyword — NVD refuses any date
range wider than 120 days, so --days 730 is split into seven windows — and a
watchlist of any size will reach the keyless limit. PatchRadar paces its requests
to stay under whichever limit applies, which makes a keyless scan slower rather
than incomplete.
export NVD_API_KEY=your-key # https://nvd.nist.gov/developers/request-an-api-key
patchradar scan --days 365The key is sent as a request header, never in the URL. If a source fails for every entry in the watchlist, the scan says so after the total rather than leaving one warning per entry: a count of CVEs that came from one source out of two is not the same as a complete scan.
| Source | Type | Status |
|---|---|---|
| NVD | CVE Database | ✅ Active |
| MSRC | Microsoft Patch Tuesday | ✅ Active |
| Debian Security | Linux packages | 🔜 Coming soon |
| CISA KEV | Known Exploited Vulnerabilities | 🔜 Coming soon |
PatchRadar uses CalVer — YYYY.MM.PATCH.
Performance is tracked continuously with CodSpeed. The benchmarks live in benchmarks/ and cover the CVE collectors, the SQLite layer, the API endpoints and the CLI table rendering.
pip install --group dev -e .
pytest benchmarks/ # correctness check, no measurement
codspeed run --mode simulation -- pytest benchmarks/ --codspeedContributions are welcome! Feel free to open issues or pull requests.
MIT — see LICENSE for details.