Peregrinet
How it worksTry itToolboxSelf-host
Sign inCreate account

Stop finding CVEs on Twitter.

Peregrinet ranks every advisory against the packages you actually run.

Create accountSign in

Free to run. Your lockfile is read, never stored.

130 vulnerabilities picked up so far

Affecting your projects

19 known vulnerabilities across 1 project.

  • High
    CVE-2026-44494axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution…axios 1.12.1 1.16.0
  • High
    CVE-2026-39364Vite: `server.fs.deny` bypassed with queriesvite 7.1.2 7.3.2
  • High
    CVE-2026-44488Allocation of Resources Without Limits or Throttling in Axiosaxios 1.12.1 1.16.0
  • High
    CVE-2026-45623PostCSS: Arbitrary file read and information disclosure via…postcss 8.5.6 8.5.12

From lockfile to alert.

  1. Drop a lockfile.

    Or go.mod, pom.xml, an SBOM. Read, never stored.

  2. Matched to exact versions.

    Axios 1.12.1 is hit. Axios 1.16.0 is not.

  3. Ranked by what gets exploited.

    CVSS, EPSS and CISA’s exploited list set the order.

  4. Pinged where you already are.

    Push, ntfy, email or webhook. Never twice.

Drop your dependency files here

  • package.json
  • pnpm-lock.yaml
  • go.mod

Test, 40 dependencies

  • axios1.12.1 1.16.02 advisories
  • vite7.1.2 7.3.21 advisory
  • postcss8.5.6 8.5.182 advisories
  • 9.9Elo Ruby backend has Remote Cod…CVE-2026-44266Critical
  • 9.9Elo JavaScript emitter has sandbox…CVE-2026-44267Critical
  • 8.2`ant-releases`: extracting a rele…RUSTSEC-2026-0434High
  • 8.1Keycloak has authentication bypas…CVE-2026-11800High
  • Web PushHigh: axios 1.12.1 in Test. Upgrade to 1.16.0.
  • ntfyCritical: CVE-2026-44266 in your stack.
  • EmailDaily digest: 19 advisories for Test.
  • WebhookPOST sent with CVE-2026-44494.

Take it for a spin.

A sample file, three real advisories. Your own files are one account away.

Check your own

package.json

  • axios^1.12.1
  • postcss8.5.6
  • react^19.0.0
  • vite~7.1.2

The rest of the toolbox.

Every advisory, one table.

IDTitleSeverityCVSS
CVE-2026-105769kaniko can send the build’s Azure…Critical9.3
CVE-2026-12411lxd allows Cross-guest volume hijackHigh8.4

Know when npm is down.

GitHub, npm, PyPI, Cloudflare, Docker.

  • npmView package and auth outage
  • DockerDegraded performance on Docker Hub

Follow what you run.

  • Criticalkaniko can send the build’s Azure…CVE-2026-105769
  • Highaxios Vulnerable to Full…CVE-2026-44494

Run it yourself.

No paid services.

cp .env.production.example .envchmod 600 .envdocker compose -f docker-compose.prod.yml up -d --build

Find out what is in your lockfile.

Create accountSign in

Advisories from OSV.dev, CISA KEV and FIRST EPSS. Incidents from public status pages. Sign in or create an account.

Peregrinet
How it worksTry itToolboxSelf-host
Sign inCreate account

Stop finding CVEs on Twitter.

Peregrinet ranks every advisory against the packages you actually run.

Create accountSign in

Free to run. Your lockfile is read, never stored.

130 vulnerabilities picked up so far

Affecting your projects

19 known vulnerabilities across 1 project.

  • High
    CVE-2026-44494axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution…axios 1.12.1 1.16.0
  • High
    CVE-2026-39364Vite: `server.fs.deny` bypassed with queriesvite 7.1.2 7.3.2
  • High
    CVE-2026-44488Allocation of Resources Without Limits or Throttling in Axiosaxios 1.12.1 1.16.0
  • High
    CVE-2026-45623PostCSS: Arbitrary file read and information disclosure via…postcss 8.5.6 8.5.12

From lockfile to alert.

  1. Drop a lockfile.

    Or go.mod, pom.xml, an SBOM. Read, never stored.

  2. Matched to exact versions.

    Axios 1.12.1 is hit. Axios 1.16.0 is not.

  3. Ranked by what gets exploited.

    CVSS, EPSS and CISA’s exploited list set the order.

  4. Pinged where you already are.

    Push, ntfy, email or webhook. Never twice.

Drop your dependency files here

  • package.json
  • pnpm-lock.yaml
  • go.mod

Test, 40 dependencies

  • axios1.12.1 1.16.02 advisories
  • vite7.1.2 7.3.21 advisory
  • postcss8.5.6 8.5.182 advisories
  • 9.9Elo Ruby backend has Remote Cod…CVE-2026-44266Critical
  • 9.9Elo JavaScript emitter has sandbox…CVE-2026-44267Critical
  • 8.2`ant-releases`: extracting a rele…RUSTSEC-2026-0434High
  • 8.1Keycloak has authentication bypas…CVE-2026-11800High
  • Web PushHigh: axios 1.12.1 in Test. Upgrade to 1.16.0.
  • ntfyCritical: CVE-2026-44266 in your stack.
  • EmailDaily digest: 19 advisories for Test.
  • WebhookPOST sent with CVE-2026-44494.

Take it for a spin.

A sample file, three real advisories. Your own files are one account away.

Check your own

package.json

  • axios^1.12.1
  • postcss8.5.6
  • react^19.0.0
  • vite~7.1.2

The rest of the toolbox.

Every advisory, one table.

IDTitleSeverityCVSS
CVE-2026-105769kaniko can send the build’s Azure…Critical9.3
CVE-2026-12411lxd allows Cross-guest volume hijackHigh8.4

Know when npm is down.

GitHub, npm, PyPI, Cloudflare, Docker.

  • npmView package and auth outage
  • DockerDegraded performance on Docker Hub

Follow what you run.

  • Criticalkaniko can send the build’s Azure…CVE-2026-105769
  • Highaxios Vulnerable to Full…CVE-2026-44494

Run it yourself.

No paid services.

cp .env.production.example .envchmod 600 .envdocker compose -f docker-compose.prod.yml up -d --build

Find out what is in your lockfile.

Create accountSign in

Advisories from OSV.dev, CISA KEV and FIRST EPSS. Incidents from public status pages. Sign in or create an account.