CVE Agent Support

Documents

• Troubleshooting and FAQWhat to check before filing a report and which details help with diagnosis.
• Privacy policyWhich information the app processes locally, which public sources it contacts and who is responsible.
• Privacy choicesManage local reports, background checks, login items, notifications and support data.
• Legal noticeDisclosure, terms of use, trademarks and liability notice.

Report a problem and get help

Public support reports use the separate feichti01/cveagent-support repository. It contains no product source code or confidential operational data.

• View public reportsSearch existing bugs and feature requests.
• Create a bug reportStructured form on GitHub; a GitHub account is required.
• Create a feature requestSuggest an improvement that can be discussed publicly.
• Private request by emailFor questions involving personal or confidential information.
• Report a vulnerability privatelyPlease do not submit security reports as public issues.

CVE Agent is maintained by one person in their spare time. You will normally hear back within seven days.

What to include in a report

• macOS version and Mac model or chip.
• CVE Agent version and build number shown in the app.
• The selected time range, report scope and steps leading to the problem.
• The visible error message without confidential reports or credentials.

Never publish tokens, API keys, tenant or customer identifiers, internal infrastructure details, or confidential CVE reports.

Availability

CVE Agent requires macOS 13 Ventura or later and is available on the Mac App Store. This support site does not distribute the app or an installer.

Resolved background check issues

As of: October 2, 2026. Version 1.17.2 resolves all known issues of the hourly background check. Please update via the Mac App Store.

• Service did not start after an earlier TestFlight build (1.15.2–1.16.2, fixed in 1.17.0): macOS had kept the service’s launch constraint from its first registration. Since 1.17.0 the service is registered under a new identifier, since 1.17.1 separately per distribution channel (App Store, TestFlight, direct install), and it repairs its registration itself when needed. Installations made only from the App Store were never affected.
• No check for up to an hour after sleep (up to 1.17.1, fixed in 1.17.2): A run that fell due during sleep was skipped, and the menu wrongly reported “background service not starting”. Since 1.17.2 macOS catches up on the run right after wake, and the app checks itself if the service does not run.

Diagnosis in Terminal: launchctl print gui/$(id -u)/at.feichtinger.cveagent.monitor | grep -E "state =|runs =|last exit" – a healthy service shows last exit code = 0. If it still does not start on a Mac with earlier TestFlight builds, run sudo sfltool resetbtm once and restart. History: report #1.

Release notes

1.19.0 (build 45) – October 2026

• Early warning from more sources: ENISA EUVD (exploitation and vendors), CERT.at warnings, vendor advisories (CISA ICS, Siemens, ABB, SICK, Phoenix Contact) and Metasploit and Nuclei indicators raise the priority of affected CVEs.
• CISA SSVC rating: exploitation, automatability and impact right in the report row.
• Settings › Sources: every source can be switched off individually, with status and attributions; optionally, exploitation signals are shown without changing the priority.
• Clearer report: metrics aligned in one column, older CVEs marked “updated · published YYYY”, better vendor attribution (e.g. HPE iLO).

1.18.0 (build 44) – October 2026

• Complete short ranges: the last 6, 12, 24 and 72 hours no longer miss entries in very busy weeks.
• Since last visit: new range that shows everything new since you last looked when you open the report.
• Type of change: new filter for newly published, newly in KEV or modified.
• Report currency: the report shows the time it covers up to and warns when the data is out of date.

1.17.2 (build 43) – September 2026

• Background check after sleep: resumes right after your Mac wakes instead of pausing for up to an hour; no more false “background service not starting” warning after a night in sleep.

1.17.1 (build 42) – September 2026

• Notifications with app icon: background service notifications show the CVE Agent icon in Notification Center.
• Report reloads itself: if macOS terminated the web content in the background, the report reappears without “report could not be displayed”.
• Self-healing background service: after registration the app verifies that macOS actually loaded the service and re-registers it if needed; App Store, TestFlight and direct installs register the service separately.

1.17.0 (build 41) – September 2026

• Dynamic vendor watchlist: On every run, vendors that appear in CISA KEV or CERT-Bund advisories within the last 365 days, or that have at least ten CVEs with EPSS ≥ 0.1, are added to the 270 curated vendors automatically. They are marked with ⟳ in the report, remain for 90 days after their last signal, the data-state section shows their count per source, and exports carry the origin. Can be disabled under Settings › Sources.
• Hourly check inside the app: While the app is open it checks on its own when the background service is not running; the menu shows which component performed the last check and warns when the service does not start. The service is re-registered cleanly on update.
• Help: justified text, more spacing between sections, new section on dynamic vendors.

1.16.2 (build 38) – September 2026

• Favorites: star CVEs (up to 16). Favorites stay in the catalog permanently, appear in every report regardless of the time range and can be exported as Markdown and CSV; the background check notifies you about changes to favorites (CVSS, KEV, EPSS, CERT-Bund).
• Vendor filter with multiple selection: a searchable list replaces the single choice and the selection is kept. Mark up to 16 vendors as “My vendors”; the background check reports new critical CVEs at these vendors separately.
• Menu action “Show new critical CVEs”: shows exactly those CVEs; time range and scope adjust automatically – also when clicking the notification.
• New source CERT-Bund (BSI): public CSAF advisories enrich matching CVEs with the German federal rating, affected products, remediations and references – shown as CERT-Bund values next to NVD, EPSS and KEV; rolling sync of the last 30 days, no historic import. Can be switched off at any time under Settings › Sources; CERT-Bund links open the advisory’s portal page.
• Interface for macOS 26/27 (Liquid Glass): the menu bar item is a system menu with keyboard shortcuts, help opens in its own window, toolbar and settings use system controls. macOS 13–15 keep the previous appearance.
• Report: wider and smoother; when more findings exist than the report limit, a notice explains the deliberate selection by risk; the English view shows status values, reasons and actions in English; text contrast raised to WCAG AA; CERT-Bund is retried on brief network hiccups.

Earlier versions: 1.15.2 (risk selection for large reports, first-sync view, copy function), 1.15.1 (first Store release).

In-app help

The app includes local help for search, time range, report scope, refresh, priorities, risk selection, filters, favorites, vendor selection, dynamic vendors (automatic inclusion from CISA KEV, CERT-Bund and EPSS, ⟳ marker, switch in Settings), CVE details, CERT-Bund data and background checks.