The software watchlist

The inventory watches what your scans observed. The watchlist watches what you tell it to. Both are one list now, on the Software page: the CMS a scan cannot see the version of, the browser and operating system on your staff's laptops, the VPN appliance at the office.

Where

Web: Software in the rail, Your software. Add software to watch opens the catalog search; Watch everything we found watches, in one tap, every application a scan found that you do not watch yet; the Watched filter shows only what you track. Open an application for Watch for advisories, Pause watching or Stop watching, where it runs, its open advisories and its published advisory history.
iOS: Monitoring, Software (below the domain list), the + button to add; an application's page has the same Watch for advisories, Pause watching and Stop watching. The older watchlist ledger is under More, Advisories, hosts and network targets, Watchlist. "Monitor" on any advisory page adds its product.
API/MCP: GET /api/vulnapps/software (watched and detected together, tool get_software_overview), GET/POST /api/vulnapps/apps, PATCH/DELETE /api/vulnapps/apps/:id, GET /api/vulnapps/apps/search, /catalog, /catalog/categories; tools list_tracked_software, search_software_catalog, get_software_catalog, get_software_catalog_categories, track_software, update_tracked_software, untrack_software.

Watch everything we found

A scan finds more than anyone remembers to watch. Watch everything we found (web: the Software page bar; app: Monitoring, Software) adds a watch for each application a scan detected and you do not watch, under the catalog's name for it when the catalog has one. Each new watch is baselined at once like any other, so advisories published before today stay in its history instead of arriving as alerts. Tapping it again adds nothing. (POST /api/vulnapps/software/watch-all.)

Adding a product

Search the catalog by name, or type any product name (Add software to watch on the web, + in the app). Each tracked product has:

Setting	Values	Default
Sources	`kev`, `cve`, or both	both
Severity filter	all, or a minimum severity	all
Active	On or paused	on

Sources, severity filter and active can be changed through the API or MCP (update_tracked_software); pausing from an application's page turns Active off. Adding from an advisory page adds the product, not the one CVE, because the next one is the one you want to hear about. The watch is baselined at creation, so only advisories published after it alert (see watch-forward).

Site software and device software

A watchlist that follows Chrome, Windows and Office puts advisories for them beside findings about your own servers. The app's watchlist ledger (More, Advisories, hosts and network targets, Watchlist) separates them: Watching for your sites (products a scan could see, with whether one has) and Watching for your devices (products no scan of a domain could ever observe, where the advice is "update them"). Each product is a row you can open for its advisories, the newest date and a KEV marker. Nothing is hidden by default; you chose to watch it.

What alerts

A tracked product raises an alert when a new KEV or CVE entry names it and passes its sources and severity filter. The alert lands in Alerts when the feed ingest finds it; there is no digest or delay to choose. The alert's verdict is derived the same way as for observed software: confirmed if a scan saw a vulnerable version, possible if a scan saw the product but not its version, unconfirmed if no scan has ever observed it. Confirmed and possible alerts are also pushed to the app: in the morning summary while One summary each morning is on (the default), right away when it is off. An unconfirmed, watchlist-only alert is a feed row without a push, because nothing shows your sites run it. Device software is always unconfirmed by construction, and the row says so rather than apologising. Every Monday, while any confirmed or possible advisory stays open, the feed gets one "still vulnerable" row naming the oldest, pushed when the list changed since last week.

Common questions

Where did Security, Watchlist go? On 2026-09-23 the watchlist and the scan inventory became one list: Software in the web rail, Monitoring, Software in the app. Old links redirect.

Why track something the scan already found? The scan may stop seeing it (a version string removed, a host retired) and the inventory reconciles. A watch persists until you remove it.

Can I track a product that is not in the catalog? track_software accepts a free-text app_name and vendor; matching then relies on the name, so use the vendor's exact product name.