[Feature]: Filter hosts by kernel version / CVE-affected version range
What is the installation method of your PatchMon server?
Docker
What is the version of your PatchMon server?
2.0.2
Briefly describe the feature
Filter the Hosts list by kernel version (exact match, "less than", or a version range), so we can quickly find hosts within an affected version range when a new kernel CVE drops, across multiple distros.
Detailed description
Is your feature request related to a problem? Please describe.
When a new Linux kernel CVE drops (e.g. CVE-2026-46331 "pedit COW"), I need to quickly identify which hosts in my fleet are running a kernel version within the affected range. Currently I have to manually scroll/search through the Hosts page and cross-reference the kernel column against the vendor advisory by eye, which doesn't scale across a larger fleet.
Describe the solution you'd like
A way to filter the Hosts list by kernel version, ideally supporting:
- A simple text/version filter (e.g. "kernel < 6.18.36" or a version range)
- Per-distro awareness, since the same upstream CVE is backported to different kernel version numbers depending on the distro (Ubuntu, Debian, RHEL, etc.)
- Possibly a saved/quick filter that can be shared as a URL, similar to the existing
/packages?filter=securityshortcut
Describe alternatives you've considered
Using the REST API to pull kernel versions for all hosts and compare them in an external script. This works but means building and maintaining custom tooling outside PatchMon for something that feels like a natural fit for the dashboard.
Additional context
This would be especially useful for fast-moving kernel LPE vulnerabilities, where the workflow is typically: advisory drops → identify affected kernel range → find affected hosts → patch/reboot → verify count drops to zero. A built-in kernel-version filter (and ideally a CVE-to-kernel-range lookup) would let PatchMon support that whole workflow directly instead of just the "verify" step.
Why is this useful?
When a kernel CVE is disclosed (e.g. CVE-2026-46331), the workflow is: identify the affected kernel range → find affected hosts → patch/reboot → verify. Right now finding affected hosts means manually scanning the Hosts table or pulling data via the API and comparing it externally, which doesn't scale across larger or mixed-distro fleets. A built-in kernel-version filter would let PatchMon support that "find affected hosts" step directly instead of just the final verification step.
Good idea to reduce the time to know the affected host from a new the security risk.
But, I prefer using centralized SBOM to manage a global software usage.