CVE Alerts for Plugin Vendors?

[Lawrence]

Does anyone know a method to automatically monitor CVEs from Plugin vendors? Right now we just manually perform searches for the app/vendor and version, but as we grow this is becoming more and more of tedious task.

Anyone have any suggestions?

Thanks in advance!

[Mirek · Accepted solution]

Hi @Lawrence 

Unfortunately there is no an easy way to get this automatically. Every vendor has his own way to track security issues and mostly including this information on their site or documentation. So it is a matter of how this is stored.

I think thank maybe using a script and scanning in description by plugin name on portals that gather information about CVE might be the way but not always it is clear enough to be sure that we are getting all. 

I would start by listing all plugins that you use and adding information where those security announcements are showing then try to figure out how to gather this automatically. Maybe all are using Confluence or any other system that allows getting information using REST API so a script that would get this directly from their sites might also work. 

[Lawrence]

This is what we started to think would be the best course of action.

Thanks so much!