Know the moment it matters.
GrapeBeaver watches FDA, CISA, NVD, IMDRF, and manufacturer advisories continuously, and tells you exactly what's relevant to the devices you actually ship.
$20 a month. 14-day trial, no card required.
Every item, scored and sourced
Reverse-chronological, filtered to the device categories you track. Severity is the only thing on the page allowed to be loud — so when something is red, it means something.
CISA published ICS Medical Advisory ICSMA-26-181-01 (dated June 30, 2026) covering five vulnerabilities in the OFFIS DCMTK Toolkit, an open-source DICOM library used in healthcare imaging software worldwide. …
CISA published an ICS Medical Advisory (ICSMA-25-128-01, originally released May 8, 2025) describing three vulnerabilities in Pixmeo's OsiriX MD medical imaging software, affecting version 14.0.1 (Build 2024-02-28) and …
CISA published an ICS Medical Advisory (ICSMA-25-224-01) covering five vulnerabilities in Santesoft Sante PACS Server versions prior to 4.2.3: a path traversal flaw (CVE-2025-0572) allowing arbitrary file creation …
CISA published an ICS Medical Advisory (ICSMA-25-301-01) for Vertikal Systems' Hospital Manager Backend Services, describing two vulnerabilities present in versions dated September 19, 2025 and prior: an unauthenticated …
Gathered, assessed, reviewed, sent
Every source, one feed
FDA recalls and MAUDE reports, CISA ICS-CERT, NVD/CVE, IMDRF, EU MDR/IVDR, and manufacturer PSIRT bulletins — normalized and deduplicated as they publish, so a cross-posted advisory reaches you once.
A score you can argue with
Each item gets one summary and a 0–100 impact score weighing exploitability against clinical consequence — with the reasoning shown, so you can disagree on the evidence rather than take it on trust.
A person signs off
Nothing reaches your inbox until someone has read the assessment against the source and approved it. That gate is not optional, and it is why a summary here means something.
Digests that respect your inbox
Daily or weekly, at a time you choose. It leads with a one-line count, groups by severity with the most serious first, and links each item back to the full assessment.
- Nothing new means nothing sent — an empty digest is just noise.
- Set a severity floor and never see below it.
- Every digest is archived and searchable, so "that thing from three weeks ago" is findable without digging through mail.
- No hero images. A compliance inbox is not the place for one.
One plan. No tiers to decode.
For a practitioner, consultant or engineer who needs to know what actually affects the devices they work with.
- Every source — FDA recalls and MAUDE, CISA ICS-CERT, NVD/CVE, IMDRF, EU MDR/IVDR, manufacturer PSIRT
- Human-reviewed summary and severity score on every item
- Up to 7 tracked device categories
- Daily or weekly digest, your choice of time
- Searchable history of everything you were sent
For a manufacturer or health delivery organization that needs advisories matched against the devices it actually ships or runs.
- Everything in Individual, across your whole team
- Device portfolio matched by CPE, purl, vendor and category — no tracked-category cap
- SBOM upload (CycloneDX or CSV) with component-level matching
- An assessment written against your devices, not the general advisory
- Your policies and SOPs assessed for impact, with the section to review
- Priority alerts outside the digest when something critical matches
New accounts are closed while this deployment is being tested. If you were invited, use the link you were sent.
Running a fleet across multiple sites, or need API access, SSO and your own risk framework? Talk to us about Enterprise.
Assessments are AI-assisted and human-reviewed
Every summary and severity score is produced by an analysis agent and then read, corrected where needed, and approved by a person before it is published. GrapeBeaver surfaces intelligence for you to act on — it does not replace your own regulatory judgment, and it makes no compliance guarantee.