VulnSynk

Security teams I've worked with spend real time every week manually checking vendor portals and NVD feeds for new CVEs. Cisco, Palo Alto, VMware, Microsoft: each has its own advisory page, its own format, its own release cadence. By the time someone spots a critical vulnerability and routes it to the right person, hours have already gone. Sometimes days.

I built VulnSynk to fix this. It's a web platform that pulls vulnerability data from the NVD API automatically, normalises it across four major enterprise vendors, and gives teams one place to see, search, track, and get alerted on CVEs that actually affect their environment.

The noise problem

The NVD publishes thousands of CVEs every month. Most of them don't apply to your environment. The problem isn't a lack of information: it's that the information isn't filtered, it isn't in one place, and there's no easy way to act on it.

VulnSynk runs a sync every hour. On the first run it pulls a 28-day rolling window to build up history. After that, it fetches only what's changed or appeared in the past 24 hours. Only new and modified CVEs are written to Firestore, with a full change history maintained. The result is a live, deduplicated dataset for Cisco, Palo Alto Networks, VMware, and Microsoft, always current.

The dashboard gives you the picture fast

The dashboard opens with a vendor card for each of the four supported vendors. Each card shows the total vulnerability count and how many new CVEs appeared in the past 24 hours. Click through to a detailed list with severity colour-coding: red for Critical, orange for High, yellow for Medium, green for Low.

Below the vendor cards sits a Trends chart built with Chart.js, showing daily CVE counts, severity breakdown, and vendor distribution over the past 30 days. A sync status indicator tells you when the last sync ran and when the next one is scheduled. No guessing, no stale data.

Tracking CVEs through to resolution

Monitoring is passive. VulnSynk's tracking features are what make it useful for actually closing out vulnerabilities.

You can bookmark any CVE to a personal watchlist from the dashboard or search results. Each tracked CVE gets its own detail page: full description, publish and last-modified dates, affected configurations parsed from CPE data (shown for Critical CVEs), and a visual Change History Timeline that shows every NVD modification, including severity upgrades, description changes, and reference additions. Teams can add notes and log remediation actions against each CVE, creating an audit trail. Status moves from Active to Resolved or False Positive as the work progresses.

AI explainer and alerts

One thing that consistently slows down remediation is having to translate CVE technical descriptions for managers and developers who aren't reading security advisories daily. VulnSynk has a one-click AI explainer on each CVE detail page. It generates a plain-language summary and saves it to the database, so it's available to everyone on the team without regenerating it every time.

The notification system is configurable per user. You choose the vendor, the minimum severity threshold, and the delivery frequency: immediate, daily digest, or weekly digest. Email delivery runs through Microsoft Graph API via Azure AD OAuth 2.0, which keeps it reliable in enterprise environments. You can set multiple rules, toggle them on or off, and delete them whenever the scope changes.

VulnSynk is deployed on Railway and used as an internal tool. The next planned additions are personalised AI risk scoring based on a team's tracked environment, and a patch advisor that gives specific remediation recommendations. The core capability, knowing what's vulnerable, in what vendor, at what severity, and tracking it to resolution, is fully working now.