Application security
Review software dependencies, match recorded package versions to known vulnerabilities, and give developers advisory context for the next upgrade.
Explore application security →APPLICATION & INFRASTRUCTURE SECURITY
Know what puts
your stack
at risk.
A vulnerability tracker for your applications, software dependencies, and infrastructure. Find known security vulnerabilities, prioritize risk, and coordinate fixes through alerts and Jira tickets.
Software packagesInfrastructureAdvisory context
Stack overview
Sample workspaceVulnerability overview
Your stack, in focus
Asset types
02Packages + infra
Potential findings
03To review
Findings to review
Example dataOpenSSL 3.0.7
Illustrative finding A
lodash 4.17.20
Illustrative finding B
nginx 1.24.0
Illustrative finding C
Potential matches. Review each advisory for applicability to your environment.
Application and infrastructure security, together.
Find known vulnerabilities in software dependencies and infrastructure versions, track CVEs, and prioritize remediation with the engineers responsible for each asset.
Infrastructure security
Record infrastructure products and service versions, review potential NVD matches, and investigate security risk alongside your application findings.
Explore infrastructure security →Vulnerability tracking
Bring vulnerability findings, CVE context, severity, and recorded assets into one workflow, then coordinate fixes through alerts and Jira tickets.
Explore vulnerability tracking →Prioritize by severity, then review affected versions, advisory details, and your environment’s exposure. Cevnitra checks recorded inventory against known advisories; it does not probe your systems or prove that a finding is exploitable.
Planned: scheduled monitoring. Today, your team starts scans. Configured alerts and Jira issues respond to newly detected scan findings; they do not continuously watch your systems.
From adding assets to coordinating fixes.
Know what you run, see what may be affected, and give your team a useful place to start.
STEP 01＋
Bring your stack together
Add applications, dependencies, and infrastructure products with the versions your team uses. Import supported dependency files or enter assets directly.
STEP 02⌕
Match versions to advisories
Cevnitra checks package versions against OSV data and infrastructure products against NVD data from its private advisory mirror.
STEP 03✓
Review what needs attention
See potential findings, severity, affected versions, and advisory details in one place, so your team can investigate and prioritize clearly.
STEP 04↗
Alert the right people
Choose notification events and severity levels. Newly detected scan findings can reach configured Slack, Teams, messaging, or webhook integrations.
STEP 05✓
Coordinate remediation
Create Jira issues through your configured integration. Track the work in Jira, update recorded versions after a fix, and scan again to review the findings.
Security findings with your stack in context.
A vulnerability list is hard to act on when it is disconnected from what you actually use. Cevnitra connects advisory data to your recorded packages and infrastructure versions, giving your team a more focused starting point.
Bring your inventory into focus01
Relevant context
Findings are matched to the versions in your inventory.
02
A broader view
See application dependencies and infrastructure together.
03
Clear next steps
Review advisory details and decide what to investigate.
Cevnitra matches your inventory against published advisories. Findings are potential matches and should be reviewed for applicability in your environment.
A little more clarity.
Understand what Cevnitra checks, where its findings come from, and how to use them.
What is Cevnitra?+
Cevnitra is a vulnerability tracker for application security and infrastructure security. It helps teams review known security vulnerabilities that may affect the software packages and infrastructure versions in their inventory.
How does Cevnitra find potential vulnerabilities?+
Cevnitra matches exact package versions against OSV advisory data and infrastructure products against NVD data in its private advisory mirror. The mirror is synchronized from those upstream sources.
Is Cevnitra a vulnerability scanner?+
Cevnitra provides inventory-based vulnerability scanning: it matches the package and infrastructure versions you record against OSV and NVD advisories. It does not probe your network, crawl a running website for exploits, or perform penetration tests.
Are findings always exploitable in my environment?+
No. A match indicates that an advisory may apply to a recorded package or infrastructure version. Your team should review the advisory and its applicability to your configuration.
When do alerts and tickets happen?+
With integrations configured, newly detected findings from completed scans can trigger alerts and Jira issues according to your selected events and severity levels. Delivery depends on the notification service and provider. Scheduled monitoring is planned; scans are currently started by your team.
Can I use Cevnitra for CVE tracking and security risk prioritization?+
Review CVE records and ecosystem advisories alongside the assets and versions they may affect. Use severity, affected versions, and your knowledge of exposure to prioritize security risk, then review a new scan after updating the recorded version.
Is Cevnitra a bug tracker?+
Cevnitra tracks known security vulnerabilities in recorded applications and infrastructure. Use your Jira bug tracker to assign and follow remediation work; the configured Cevnitra integration can create Jira issues for selected notification events.
Is Cevnitra an anti-hacker tool?+
Cevnitra helps teams identify known vulnerabilities and prioritize fixes. It does not block attacks, remove malware, or replace firewalls, endpoint protection, or incident response. Its role is vulnerability management and remediation coordination.
How much does Cevnitra cost?+
The first 100 customers can join completely free, with no charges forever. Future pricing will be introduced later.