Open app
Docs/Core Features

Vulnerability tracking

Demerzel correlates published advisories against the packages actually installed on each server, so you see vulnerabilities that really apply to you — not a generic feed.

How correlation works

  • The agent reports the exact package versions installed on each host.
  • Demerzel matches them against known CVEs, using distribution-aware version comparison (it understands Debian epochs and revisions, so 3.0.15-1~deb12u1 is compared correctly).
  • A finding records the package, installed version, CVE, severity and the fixed version.

On the server page

Each server’s Vulnerabilities tab lists its findings, most severe first, with the version that fixes each one. Critical and high findings roll up into dashboard Actions.

Where advisories come from. The advisory catalog is synced from OSV.dev for the exact packages and versions your fleet runs, and correlation happens against that local copy — never a live lookup — so a finding is reproducible. Keeping the catalog fresh is the platform's job, not yours: there is nothing to sync on your side.

Software from a vendor’s repository

Debian’s advisories only describe Debian’s own builds. Server software installed from its vendor’s apt repository is matched against the upstream project instead, on the upstream version it carries:

SoftwareRecognised byChecked against
MySQL (Oracle repository)mysql-community-server, -1debian12 buildsend of life, NVD CVEs
PostgreSQL (postgresql.org, PGDG)postgresql-NN, .pgdg buildsend of life, NVD CVEs
Redis (redis.io)redis-server, rl1~ buildsend of life, NVD CVEs
MariaDB (mariadb.org)mariadb-server, +maria~ buildsend of life, NVD CVEs
Elasticsearch, MongoDBelasticsearch, mongodb-org-serverend of life, NVD CVEs
Docker Enginedocker-ceend of life
nginx (nginx.org)nginx, -1~bookworm buildsend of life, NVD CVEs
PHP (Ondřej Surý), Node.js (NodeSource)their build suffixesphp.net / nodejs.org security releases, end of life

End-of-life dates come from endoflife.date. CVEs come from NVD, whose per-CVE version ranges say which upstream releases are affected; NVD’s analysis can lag a vendor’s announcement by days or weeks.

A package from a third-party repository Demerzel has no source for is listed under Not checked in the server’s Vulnerabilities tab: no finding there is not a clean bill. Third-party builds are recognised by their version suffix (~bookworm, ~debian.13, .gbp…), so a repository that uses none can go unnoticed.