Forum
app.dagsec.net/forum lists every new critical or high vulnerability as it's published, and lets people discuss them or ask their own questions. Anyone can read it; writing needs a dagsec account. The same forum is on dagsec.net/forum for reading; commenting and voting happen in the app.
On the home page
When a critical vulnerability lands in a runtime almost everyone runs (PHP, Node.js, Python, Go, Java or Ruby), or CISA lists one as exploited, it appears above the headline on dagsec.net for 14 days, next to the latest update.
Where the advisories come from
Every three hours dagsec reads the newest changes in OSV.dev for npm, PyPI, crates.io, Go, Maven, NuGet and Composer, and for the PHP, Node.js, Python, Go, Java and Ruby runtimes. Each critical or high advisory published in the last 30 days gets its own topic.
dagsec also reads CISA's Known Exploited Vulnerabilities catalog. When an advisory lands on it, the topic moves to the top and says under active attack; the Under attack tab lists only those.
The forum shows public data only. dagsec doesn't test anyone's systems to find out whether they're affected.
What each advisory topic tells you
| Affected versions | The ranges from OSV, one per release series |
| Fixed in | The first fixed release of each series. On PHP 8.4, look for 8.4's fix, not 8.2's. |
| What to do | The upgrade command for the package's ecosystem, or the release to move a runtime to |
| This package's record | How many advisories OSV.dev has for the package in all |
| Used in dagsec scans | How many scanned repositories use an affected version. The number appears from 3 repositories up, so it can't point at anyone. |
| Your repositories | When you're signed in: which of the repositories you scanned use an affected version |
Posting
- Questions and Discussions are for anything about keeping dependencies, runtimes and AI-written code safe.
- Write in plain text. Don't paste secrets, keys or private code: the forum is public.
- You can open 5 topics and write 60 comments a day.
- Vote for a topic with ▲ to show it matters to you.
dagsec hides posts that break these rules or the terms, and can close a topic for comments.
In your weekly email
The weekly summary says how many new critical or high advisories reached the forum that week and how many are under attack, with a link to the forum.