v1.4.1

What's Changed

• Licensed under PolyForm Noncommercial 1.0.0 (personal and noncommercial use).

Full Changelog: v1.4.0...v1.4.1

v1.4.0

What's Changed

• New Sync now button in the header: pulls fresh CVE, KEV, EPSS and NVD data immediately instead of waiting for the next scheduled poll.
• Sync health shows a SYNCING badge while a source is running, and hides the previous error until that run finishes.
• Update check failures now say what actually went wrong instead of a generic message, and are recorded in the server log.

No database changes, so upgrading is a straight replacement.

Full Changelog: v1.3.2...v1.4.0

v1.3.2

What's Changed

• Aligned the dashboard header with the shared JDE-Projects layout.
• Made systemd upgrades replace application code cleanly while preserving data and rolling back failed installs.

Full Changelog: v1.3.1...v1.3.2

v1.3.1

What's Changed

• Hits page: the bulk status control is now clearly labelled "Set selected to" and stays disabled until you select something, so it can't be mistaken for the per-row dropdown.
• Hits page: status messages now name the CVE instead of an internal record id, and read "1 hit" rather than "1 hits".
• Hits page: fixed the Save button wrapping onto a second line, and disabled buttons now look disabled.
• First-run setup: retrying a failed setup no longer stacks background polling loops, and the page now shows the app icon in the browser tab.
• Interrupted delta syncs no longer strand large temporary files in the data directory.
• The footer now shows just the version number.

Full Changelog: v1.3.0...v1.3.1

v1.3.0

What's Changed

• Docker images now report container health, so docker ps shows healthy or unhealthy rather than just running.
• /api/health always returns JSON now, including during the first-run backfill. External monitors previously got an HTML page during that window.
• Smaller download: removed two bundled font files that were never used.
• Removed the undocumented watch and hits command-line subcommands. The web dashboard is the supported interface. serve, init, backfill, sync, run, and status remain for setup and troubleshooting.

Full Changelog: v1.2.1...v1.3.0

v1.2.1

What's Changed

• Update check messages now use the standard wording shared across the Simple X Tools.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• Watch by product code (CPE): watchlist entries can now match NVD vendor:product codes, with optional version matching, alongside keywords.
• CVE pages now list affected products (CPE) with a one-click Watch button, plus named weakness (CWE) links.
• Bulk hit status editing: select multiple hits and set them all to one status at once.
• App favicon and header glyph in the browser tab and page header.

Upgrade note: the first NVD sync after upgrading does a one-time re-walk of recent history (a few minutes) to backfill product (CPE) and weakness (CWE) data on the CVEs you already have. It runs automatically; no action needed.

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's Changed

• Fixed catalog pruning deleting recently updated CVEs: prune now keeps anything published or updated inside the retention window, matching backfill. CVEs it wrongly removed return as syncs touch them again; re-running a backfill restores the full window immediately.
• Fixed log spam when email alerts are disabled (a scheduler line every 5 seconds).
• New connection status indicator in the footer: green "live" dot while the page can reach the server, red with an "unreachable since" time when it can't.
• Dashboard auto-refresh failures are now visible (red status dot) instead of silently keeping stale content.
• Centered the footer update-check notice.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

First release. Simple CVE Tracker is a self-hosted CVE monitor for small IT teams and homelabs: build a watchlist of the products you run and it tells you when new or known-exploited CVEs match.

• Keyword watchlists matched against the full CVE List v5 catalog
• CISA KEV flagging plus NVD and EPSS score enrichment
• Web dashboard with a hit review workflow, filters, and coalesced email alerts
• One-command install on Linux/Raspberry Pi (systemd service), or run with Docker Compose
• Every release ships with a SHA-256 checksum and a signed build provenance attestation (see the README for how to verify)

Full Changelog: https://github.com/JDE-Projects/Simple-CVE-Tracker/commits/v1.0.0