Version-Specific Vulnerability Alerting Guide | CVE Alerts by Product Version

Q: Can I get CVE alerts filtered by a specific software version?

Yes. OpenCVE lets you subscribe to alerts using CPE strings that include vendor, product, and version (e.g., cpe:2.3:a:moodle:moodle:4.3.0). Vulners also supports version-specific software inventory tracking with its free tier. For a DIY approach, the NVD API allows CPE-based queries filtered to exact version ranges.

By FixTheVuln Team Peer-reviewed security content Sources: NVD, CISA, OWASP

Key Takeaways

OpenCVE (free, self-hosted or SaaS) lets you subscribe to CVE alerts by vendor, product, and version using CPE strings
Vulners free tier tracks a software inventory with version-specific vulnerability matching
Traditional scanners (InsightVM, Nessus) miss web apps installed outside package managers — use Nuclei, WPScan, or Droopescan to fill the gap
The NVD API supports CPE-based queries if you want a DIY alerting pipeline
Combine version-aware alerting plus application-layer scanning for full coverage

The Problem: Why Traditional Scanners Miss Unpackaged Web Apps

The Gap: Vulnerability scanners like Rapid7 InsightVM, Nessus, and Qualys detect software by querying the OS package manager (apt, yum, rpm, Windows registry). Web applications installed from tarballs, git clones, or manual uploads — Moodle, Nextcloud, WordPress, Joomla, GitLab — are invisible to these agents.

If you deploy WordPress by extracting a zip into /var/www/html, or install Moodle from a tarball, your scanner's host agent won't see it. You'll get zero CVE hits for software that may have critical vulnerabilities.

What Scanners See vs. What They Miss

Detected (package manager)	Missed (unpackaged)
Apache httpd (apt/yum)	WordPress (zip extract)
PHP runtime (apt/yum)	Moodle (tarball)
OpenSSL (apt/yum)	Nextcloud (manual install)
PostgreSQL (apt/yum)	Joomla, Drupal, GitLab Omnibus

You need two things to close this gap: version-specific CVE alerting (to know when a vulnerability drops) and application-layer scanning (to detect what's actually running).

Version-Specific Alerting Tools

1. OpenCVE — CPE-Based CVE Subscriptions (Free)

Best for: Teams that want email/webhook alerts filtered by exact vendor + product + version. Self-hosted option available.

OpenCVE is an open-source CVE alerting platform. You subscribe to CPE strings and get notified only when new CVEs match your products and versions.

How to Set Up Version-Specific Alerts

                    # 1. Find your CPE at https://nvd.nist.gov/products/cpe/search
#    Example CPEs:
#    WordPress 6.4.2  → cpe:2.3:a:wordpress:wordpress:6.4.2:*:*:*:*:*:*:*
#    Moodle 4.3.0     → cpe:2.3:a:moodle:moodle:4.3.0:*:*:*:*:*:*:*
#    Nextcloud 28.0.0 → cpe:2.3:a:nextcloud:nextcloud_server:28.0.0:*:*:*:*:*:*:*

# 2. In OpenCVE, add the CPE as a subscription
#    Dashboard → Subscriptions → Add Vendor/Product
#    Select vendor: "moodle", product: "moodle"

# 3. For self-hosted OpenCVE (Docker):
git clone https://github.com/opencve/opencve-docker.git
cd opencve-docker
docker compose up -d

# 4. Configure email or webhook notifications
#    Settings → Notifications → Add email/Slack/webhook
                

OpenCVE Features

Feature	Free SaaS	Self-Hosted
CVE alerts by vendor/product	Yes	Yes
Email notifications	Yes	Yes
Webhook integrations	Paid	Yes
CVSS filtering	Yes	Yes
API access	Paid	Yes
Custom deployment	No	Yes

2. Vulners — Software Inventory with Version Tracking (Free Tier)

Best for: Building a software inventory and getting matched against known vulnerabilities, including version-specific results.

Vulners maintains a massive vulnerability database and offers a free tier that lets you define a software inventory with specific versions. It continuously matches your inventory against new CVEs.

Using the Vulners API

                    # Search for vulnerabilities by software + version
curl "https://vulners.com/api/v3/burp/software/" \
  -H "Content-Type: application/json" \
  -d '{
    "software": "wordpress",
    "version": "6.4.2",
    "type": "software"
  }'

# Or use the Python library
pip install vulners

import vulners
api = vulners.VulnersApi(api_key="YOUR_FREE_API_KEY")
results = api.software_audit(
    os="debian",
    os_version="12",
    package=["wordpress 6.4.2"]
)
                

Vulners also aggregates advisories from multiple sources (NVD, vendor advisories, exploit databases) so you get a unified view.

3. NVD API + CPE Matching (DIY Approach)

Best for: Teams that want full control and already have scripting/automation capabilities. Build your own alerting pipeline.

The NVD (National Vulnerability Database) API is free and lets you query CVEs filtered by CPE name, including version ranges. You can build a cron job that checks for new CVEs matching your software stack.

NVD API Query Examples

                    # Query CVEs for a specific CPE (WordPress 6.4.2)
# API docs: https://nvd.nist.gov/developers/vulnerabilities
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?\
cpeName=cpe:2.3:a:wordpress:wordpress:6.4.2:*:*:*:*:*:*:*"

# Query CVEs modified in the last 7 days for Moodle
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?\
cpeName=cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*&\
lastModStartDate=2026-02-14T00:00:00.000&\
lastModEndDate=2026-02-21T00:00:00.000"

# Python script for automated checking
import requests, json, smtplib
from datetime import datetime, timedelta

API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
MY_CPES = [
    "cpe:2.3:a:wordpress:wordpress:6.4.2:*:*:*:*:*:*:*",
    "cpe:2.3:a:moodle:moodle:4.3.0:*:*:*:*:*:*:*",
    "cpe:2.3:a:nextcloud:nextcloud_server:28.0.0:*:*:*:*:*:*:*",
]

for cpe in MY_CPES:
    end = datetime.utcnow()
    start = end - timedelta(days=1)
    params = {
        "cpeName": cpe,
        "lastModStartDate": start.strftime("%Y-%m-%dT%H:%M:%S.000"),
        "lastModEndDate": end.strftime("%Y-%m-%dT%H:%M:%S.000"),
    }
    resp = requests.get(API_URL, params=params)
    data = resp.json()
    if data.get("totalResults", 0) > 0:
        print(f"NEW CVEs for {cpe}:")
        for vuln in data["vulnerabilities"]:
            cve = vuln["cve"]
            print(f"  {cve['id']}: {cve['descriptions'][0]['value']}")
                

NVD API Rate Limits: Without an API key, you're limited to 5 requests per 30 seconds. Request a free API key at https://nvd.nist.gov/developers/request-an-api-key to get 50 requests per 30 seconds.

4. CISA KEV — Actively Exploited Vulnerabilities

Best for: Prioritizing patching. The CISA Known Exploited Vulnerabilities catalog tracks CVEs that are confirmed to be exploited in the wild.

While not version-specific, the CISA KEV catalog is essential for prioritization. If a CVE for your software appears here, it's being actively exploited and patching is urgent.

                    # CISA KEV JSON feed (full catalog)
curl https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

# RSS feed for new additions
# https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

# Filter KEV entries for your products with jq
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
  jq '.vulnerabilities[] | select(.product | test("wordpress|moodle|nextcloud"; "i"))'
                

Filling the Scanner Gap: Detecting Unpackaged Web Apps

5. Nuclei — Version Fingerprinting + CVE Detection

Best for: Scanning web applications to detect versions and match them against known CVEs. Works across thousands of technologies.

Nuclei by ProjectDiscovery uses YAML-based templates to fingerprint application versions via HTTP responses and check for known vulnerabilities. It has 8,000+ community templates covering CVE detection, version fingerprinting, and misconfigurations.

                    # Install Nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# or
brew install nuclei

# Scan a web app for known CVEs
nuclei -u https://moodle.example.com -t cves/

# Scan for version detection + CVEs
nuclei -u https://wordpress.example.com -t technologies/ -t cves/

# Scan multiple targets from a file
nuclei -l targets.txt -t cves/ -severity critical,high

# WordPress-specific CVE checks
nuclei -u https://example.com -t cves/ -tags wordpress

# Output as JSON for integration with alerting
nuclei -u https://example.com -t cves/ -json -o results.json
                

Example: Nuclei Detecting a Moodle Version

                    # Nuclei template (simplified) for Moodle version detection
id: moodle-version
info:
  name: Moodle Version Detection
  severity: info
  tags: tech,moodle

http:
  - method: GET
    path:
      - "{{BaseURL}}/lib/upgrade.txt"
    extractors:
      - type: regex
        group: 1
        regex:
          - 'Moodle ([0-9]+\.[0-9]+(?:\.[0-9]+)?)'
                

6. WPScan — WordPress-Specific Scanning

Best for: WordPress sites. Detects core version, plugin versions, and theme versions with CVE matching.

WPScan is the gold standard for WordPress vulnerability scanning. It fingerprints core, plugin, and theme versions and matches them against the WPScan Vulnerability Database.

                    # Install WPScan
gem install wpscan
# or
docker pull wpscanteam/wpscan

# Basic scan with version detection
wpscan --url https://wordpress.example.com

# Enumerate plugins and themes with version detection
wpscan --url https://wordpress.example.com \
  --enumerate vp,vt \
  --api-token YOUR_WPSCAN_TOKEN

# Output as JSON
wpscan --url https://wordpress.example.com \
  --format json \
  --output results.json

# Scan with aggressive plugin detection
wpscan --url https://wordpress.example.com \
  --enumerate ap --plugins-detection aggressive
                

WPScan API: The free tier gives you 25 API requests/day, enough for scanning a handful of WordPress sites daily. This provides CVE data for detected plugin/theme versions.

7. Droopescan — Moodle, Drupal, SilverStripe

Droopescan is a plugin-based scanner that fingerprints CMS applications that other tools often miss.

                    # Install Droopescan
pip install droopescan

# Scan a Moodle instance
droopescan scan moodle -u https://moodle.example.com

# Scan Drupal
droopescan scan drupal -u https://drupal.example.com

# Scan SilverStripe
droopescan scan silverstripe -u https://silverstripe.example.com

# Scan multiple URLs from a file
droopescan scan moodle -U targets.txt
                

Putting It Together: Recommended Workflow

No single tool solves the full problem. Here's a practical workflow that combines version-specific alerting with application-layer scanning:

Step 1: Build Your Software Inventory

                    # Create a software inventory with exact versions
# inventory.csv
product,version,cpe,url
WordPress,6.4.2,cpe:2.3:a:wordpress:wordpress:6.4.2:*:*:*:*:*:*:*,https://blog.example.com
Moodle,4.3.0,cpe:2.3:a:moodle:moodle:4.3.0:*:*:*:*:*:*:*,https://lms.example.com
Nextcloud,28.0.0,cpe:2.3:a:nextcloud:nextcloud_server:28.0.0:*:*:*:*:*:*:*,https://cloud.example.com
                

Step 2: Set Up Alerting

Subscribe to your CPEs in OpenCVE (or build a script against the NVD API). This gives you reactive notification when a new CVE is published.

Step 3: Schedule Scanning

                    # Weekly scan with Nuclei for all web apps
# Add to cron: 0 6 * * 1 /usr/local/bin/scan-webapps.sh
#!/bin/bash

# Scan all targets for CVEs
nuclei -l /opt/scans/targets.txt \
  -t cves/ \
  -severity critical,high \
  -json -o /opt/scans/results-$(date +%F).json

# WordPress-specific scans
wpscan --url https://blog.example.com \
  --api-token $WPSCAN_TOKEN \
  --format json \
  --output /opt/scans/wp-$(date +%F).json

# Moodle scan
droopescan scan moodle -u https://lms.example.com
                

Step 4: Cross-Reference with CISA KEV

When you get an alert from OpenCVE or a scan finding from Nuclei, check if the CVE appears in the CISA KEV catalog. If it does, treat it as a drop-everything priority.

Summary: Tool Coverage Map

Need	Tool	Cost
CVE alerts by product + version	OpenCVE	Free (self-hosted or SaaS)
Software inventory + vuln matching	Vulners	Free tier available
DIY CVE alerting pipeline	NVD API	Free
Actively exploited CVE tracking	CISA KEV	Free
Web app fingerprinting + CVEs	Nuclei	Free (open source)
WordPress scanning	WPScan	Free (25 API req/day)
Moodle / Drupal scanning	Droopescan	Free (open source)

Frequently Asked Questions

Can I get CVE alerts filtered by a specific software version?

Yes. OpenCVE lets you subscribe to alerts using CPE strings that include vendor, product, and version (e.g., cpe:2.3:a:moodle:moodle:4.3.0). Vulners also supports version-specific software inventory tracking with its free tier. For a DIY approach, the NVD API allows CPE-based queries filtered to exact version ranges.

Why does my vulnerability scanner miss web apps like Moodle, Nextcloud, or WordPress?

Traditional vulnerability scanners like Rapid7 InsightVM and Nessus rely on package manager inventories (apt, yum, rpm). Web applications installed from tarballs, git clones, or manual uploads don't appear in those inventories. You need application-layer scanners like Nuclei, WPScan, or Droopescan that fingerprint the running application via HTTP to detect versions.

What is a CPE string and how do I find the right one for my software?

CPE (Common Platform Enumeration) is a standardized naming scheme for software. A CPE string looks like cpe:2.3:a:vendor:product:version. You can search for CPE strings at nvd.nist.gov/products/cpe. For example, WordPress 6.4.2 is cpe:2.3:a:wordpress:wordpress:6.4.2:*:*:*:*:*:*:* and Nextcloud Server 28.0.0 is cpe:2.3:a:nextcloud:nextcloud_server:28.0.0:*:*:*:*:*:*:*.

Related Resources

WordPress Security Container Security Linux Hardening

← Back to Guides

FixTheVuln Store

Patch Tuesday Sprint Kit

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

Try Free Templates

5 fillable templates for vulnerability management — $4.99/mo