- New Connector catalog grows to 152 integrations across the same 16 categories. Native API connectors go from 27 to 73, so most of what used to arrive as a dropped export now pulls on a schedule with full asset identity attached. The catalog now reads 130 inbound (73 native API, 43 file imports, 14 push endpoints), 15 outbound destinations for ticketing, patch and chat, and 7 built-in engines and feeds. Depth landed mainly in AppSec and code, cloud, and mitigating-controls coverage.
Changelog & roadmap
Seven releases in nine months.
The CVEasy version history from v0.1 to v1.3, every entry as it shipped, and the public roadmap for what comes next.
Spacing proportional to ship date · v1.0 and v1.1 both shipped in April 2026
01 · Release history
v0.1 to v1.3, every entry as shipped.
Version numbers and dates are the release record. Badges mark what each line changed: New for capability, Improved for behavior, Fix for defects. Newest first.
v1.8.1
October 2026
Latest
- New Risk Register approvals: a reviewer can approve or reject a filed acceptance from the Risk Register, and only approved acceptances count as accepted risk
- Improved Every workspace keeps its own risk acceptances, triage, SLA clocks, watchlist, runbooks, patch and SBOM data, report schedules, webhooks and indicator matches; counts, exports and resets no longer mix workspaces, and Reset Data clears only the workspace you are in
- Improved Analytics, compliance reports, the executive dashboard and patch impact simulation now measure your workspace's own findings instead of the shared CVE catalog
- Improved The app starts in about 3 seconds on large databases (was about 17) and stays responsive while it warms its scoring cache and rebuilds correlation groups
- Fixed Importing a scan file from the Assets page failed; it now imports and re importing the same file updates the findings
- Fixed Two clients with the same private address could have one asset merged into the other's workspace during maintenance
- Fixed Jira status sync, SBOM VEX status and threat update history read data that was never stored; they now work
- Fixed Webhooks only deliver a workspace's events to that workspace's endpoints
- Fixed Saving settings no longer restarts the trial, and expiry dates no longer show a day early
v1.8.0
October 2026
- New Exposure briefs built to a new standard: eight figures, including where the scan went blind, reputation against outcome and an evidence gated correlation, plus a six link kill chain where every link carries its evidence and the cheapest cut comes first
- New CVEasy Blog in the Threat Intel page: new research posts arrive with the weekly update, fetched as a diff so only what is new is downloaded, with a badge for unread posts
- New Data sources and notices in Settings: every third party source the app uses, with its licence, terms and required attribution
- Improved Threat intel bundles import by declared type, so new kinds of data arrive without an app change; the exploit availability index is now imported, and a full bundle imports in about half the time and a third of the memory
- Improved Findings accuracy: findings a scan no longer observes are retired per machine, each finding is counted once, and machines that had been merged on a shared hardware address are separated again (a backup is taken first)
- Improved Public exploit flags are re derived from evidence (an NVD exploit tag, an exploit archive, a proof of concept repository or the signed exploit index) instead of any matching link
- Improved Threat actor links from the built in curated list are labelled as unsourced and no longer count as attribution in briefs or scoring
- Improved The CVE page leads with your workspace's TRIS score (catalog scores are labelled as such), shows rejected CVEs as rejected, and takes exploit maturity from the exploit index instead of counting links
- Fixed Red: Test if Exploitable checked authorizations from the default workspace instead of yours; it now checks each host against your workspace's authorizations, names any host that is not covered and links to authorize it, and an authorization ending today stays valid until the end of the day
- Fixed Fix First no longer tells you to upgrade a product to the version it already runs, and duplicate cards for the same package are merged
- Fixed Pages that had no data no longer report a clean result: SLA compliance with nothing tracked, indicator matches with no indicators loaded and Fix First before any import now say so
- Fixed The Security and Audit page showed AI ledger anchoring as degraded after a successful anchor
- Fixed Importing the signed feed bundle or a large scanner export failed above 10 MB
v1.7.4
October 2026
- New Briefs that write themselves: turn on automatic briefs per workspace and one is written after each successful pull, at most every 7, 14 or 30 days
- New Address reputation from openly licensed lists (Tor exits, VPN, datacenter and cloud ranges, network owners), matched on your own machine so no address leaves it; available offline as a signed bundle
- New Exposure briefs show machines that lost scan coverage as lost visibility, not fixes, with a per machine chart, and a protocol hygiene section for SMB signing, TLS 1.0 and 1.1 and SMBv1
- Improved Briefs flag remote access software running on the machine that carries its own known exploited flaw, and sign ins from rented hosting networks
- Fixed The dashboard's open findings, band counts and Top Remediations counted remediated and suppressed findings; they now count only open ones and show how many were not seen in the latest assessment
v1.7.3
October 2026
- New Security & Audit page: a tamper-evident, cryptographically signed audit log you can verify yourself, with a live integrity badge and your controls mapped to SOC2, ISO 27001 and NIST CSF
- New Every security-relevant action is now recorded in the signed ledger: report generation, connector pulls, key rotation, and tenant and licence changes. Secret and configuration controls are administrator-only
- New App-native address reputation (CVEasy TRIX by default, or bring your own rotatable key) and selectable report depth: Quick Look, Standard and Deep Dive
v1.7.1
October 2026
- New Every section of the exposure and threat brief now carries a Sources line naming where its numbers came from, so provenance is always on the page
- Fix The engine's internal quality-assurance notes no longer appear in the client report; they move to a per-report build log for the operator, with fixes you can apply with the app and local model alone
- Fix External address reputation is presented consistently from AbuseIPDB and the local intel store across every brief
v1.7.0
October 2026
- Fix Licence checks now fail closed when the token is missing or tampered, so a build never opens paid features without a valid licence
- Fix Assets from two workspaces can no longer merge into one record when they share an address
- Fix A result the engine could not verify now reads as inconclusive, never as safe
- Fix Signed threat-intel feed verification strengthened to cover the whole manifest
- New Sharper local AI exposure brief: clearer prioritization, honest IP reputation and dropped-host handling
v1.6.1
October 2026
- Fix Exploit validation marks a finding CONFIRMED only when the probe recorded evidence of it
- Fix A security control is credited only when BASzy verified it worked
- Fix Risk scoring reads only the active workspace's assets
- Fix With the local-only AI policy switched on, nothing is sent to an outside AI service
- Fix One sign-in system for every API route, with stored secrets encrypted and session tokens hashed
- Fix The local API refuses cross-site writes and unauthenticated network listeners
- Fix The data folder is owner-only, and backups are encrypted and verified
- New New editions: CVEasy MSSP and CVEasy Red MSSP, for managed service providers running many client workspaces
- New Unified connector catalog: 121 integrations across 16 categories. 27 native API connectors with one-click setup and scheduled auto-sync (15 minutes to daily), led by Rapid7 InsightVM, Tenable.io, Qualys VMDR, CrowdStrike, SentinelOne, and Microsoft Defender TVM, plus 57 file imports and 14 push endpoints. AES-GCM-encrypted credentials and full asset identity on every finding, with mitigating-controls telemetry feeding TRIS.
- New Identity-based cross-tool deduplication. Findings match on IP, hostname, MAC, and agent UUID, so the same exposure reported by three tools becomes one work item. Teams see around a 75% reduction in ticket volume.
- New Webhook ingest API. Push any scanner output (Nessus, Nuclei, Burp, ZAP, Trivy, OpenVAS, SARIF, Wiz, Prowler, Nmap, CSV, and more) with automatic format detection and per-tenant API keys for MSSP workspace isolation.
- New Fix First remediation board. Findings grouped by the fix that closes them, ranked by TRIS, stamped with SLA timers. Push Now, Schedule, or Ticket from the same card, with every action audit-logged.
- New Ticketing and notifications. One-click tickets to Jira, ServiceNow, GitHub Issues, Linear, and Monday.com with mapped fields, plus event delivery to Slack, Microsoft Teams, Discord, and PagerDuty with incident auto-resolve on verified fixes.
- New Claude MCP server. Native Model Context Protocol server connecting Claude Desktop and Claude Code to your live local instance: posture queries, findings search, TRIS scoring, report rendering, and work orders as typed agent tools.
- New Signed threat-intel bundles. ED25519-verified exploit and IOC bundles with scheduled pulls or manual import for air-gapped environments.
- New Cloud Scan Engine. Proprietary Cloud Security Posture (CSPM) and cloud identity attack-path (CIEM) engine covering AWS, Azure, and GCP. 204 CIS-tagged checks (AWS 88, Azure 61, GCP 55) with a per-framework compliance coverage rollup. Scans the customer's own cloud accounts. Results stay local.
- New AI Patch Orchestration. CVEasy generates the fix, then orchestrates deployment through existing patch and MDM consoles: Microsoft Intune, Automox, Tanium, Jamf Pro, PDQ Connect, plus a universal webhook fallback. Fail-closed dispatch, AES-GCM-encrypted credentials, and closed-loop verification via re-scan. Closes the CTEM Mobilize loop.
- New TRIS v2 12-Layer Scoring Engine (Patent Pending). Adds five novel dimensions no competitor has: attack-path blast radius, supply-chain propagation, MITRE ATT&CK defense efficacy, predictive threat trajectory, and FAIR-based financial impact quantification.
- New TRIS v2 priority bands: ACT (90-100), ATTEND (75-89), TRACK (50-74), MONITOR (25-49), INFORMATIONAL (0-24). Better score separation, fewer false priorities.
- New Graph-based attack path analysis across internal network topology with blast radius quantification.
- New SBOM-aware transitive risk propagation. Ingests software bill of materials to model dependency-tree vulnerability impact.
- New FAIR-based financial impact quantification translates technical severity into expected dollar loss.
- New Read the TRIS v2 white paper →
- New Complete CTEM platform: all 5 stages (Scope, Discover, Prioritize, Validate, Mobilize)
- New BASzy integrated: 150 attack modules, 158,271 payloads, AutoFuzz zero-day discovery
- New Scanner imports at launch: Nessus, Qualys, Rapid7, OpenVAS, Nuclei, Burp Suite, OWASP ZAP, Trivy, CSV
- New Agentless discovery: local TCP service discovery, imported multi-scanner exports, and fingerprinting consolidated into one deduplicated asset and attack-path graph
- New TRIS v1 7-Layer Scoring engine (0-95 scale) with EPSS, KEV, threat actor correlation
- New AI Agent Task Board: autonomous job execution with streaming output
- New CVE Triage Queue: kanban workflow (New → Triaged → Assigned → Resolved)
- New Policy Compliance tracker: 86 controls across 9 frameworks (HIPAA, PCI-DSS, SOC 2, NIST)
- New Live Attack Surface Canvas: interactive network visualization
- New Executive reporting: board-ready risk summaries with SLA tracking
- New AI Agent Task Board: autonomous job execution with streaming output
- New CVE Triage Queue: kanban workflow (New → Triaged → Assigned → Resolved)
- New Policy Compliance tracker with clickable metric bubbles
- Improved Streaming remediation with live EPSS + KEV enrichment
- Fix Chain-of-thought stripping, clean output in all modes
- New Multi-provider AI: cloud and local models supported
- New AES-256-GCM API key encryption at rest
- New Remediation script generation with per-CVE caching
- Improved TRIS score with industry multipliers + compliance weighting
- New AI Security Chat with model picker and streaming
- New EPSS + KEV enrichment on every CVE ingest
- New Watchlist with Slack/Teams webhook alerts
- Improved SQLite WAL mode + 32MB cache for scan performance
- Fix Streaming timeout fixed: idle timeout removed from server
- New Initial release: NVD ingestion, CVE search, AI remediation
- New Bun + Hono backend, React 19 + Vite frontend
- New SQLite local cache, Docker + Railway deploy targets
02 · Roadmap
What ships next.
Q3 2026 work is in progress now, Q4 2026 is planned, and Later items are committed without a quarter attached. When something ships, it moves into the release history above with its version and date.
Q3 2026 · In progress
Multi-user deployment
In Progress
Team roles (Analyst, Manager, Read-Only), assignment workflows, and audit log. Enterprise license feature.
Windows, Linux, and Docker
Planned
Multi-platform builds and a Docker deployment option alongside the native macOS app.
Q4 2026 · Planned
Bi-directional ITSM sync
Planned
Two-way status sync with Jira and ServiceNow. Ticket resolved means the CVE is automatically re-scanned, with SLA reporting across ticketing systems.
Later
Container image scanning
Planned
Docker and OCI image vulnerability scanning across build and registry layers. Cloud posture (CSPM) and cloud identity attack-path (CIEM) for AWS, Azure, and GCP have already shipped in the Cloud Scan Engine.
SSO / SAML
Planned
Enterprise identity provider integration for organizations with centralized authentication requirements.
Have a feature request? We're building this in close collaboration with early adopters.
Request a Feature →