About
This site mirrors the CVE Program's official list of CVE Records from github.com/CVEProject/cvelistV5 (CVE JSON 5 format) and makes it searchable. It pulls new commits every 30 minutes and indexes the records that changed.
The Upcoming page adds vulnerabilities that other sources know about before their CVE record is published: GitHub advisories, OSV.dev records and Zero Day Initiative cases. See data sources and licenses.
Where the fields come from
- Description, title, affected products, references: the CNA (the organisation that assigned the CVE), plus references and products added by ADPs such as CISA and the CVE Program.
- Severity: the CNA's newest CVSS version (4.0, then 3.1, 3.0, 2.0). If the CNA gave none, the first ADP score, usually CISA's Vulnrichment. "Unscored" means no score anywhere in the record.
- KEV: CISA's Known Exploited Vulnerabilities entry, as recorded by CISA-ADP in the record.
Data sources and licenses
Everything shown here comes from the sources below. We extract and reformat fields, choose or compute a severity from the CVSS data, and match records to each other by CVE ID; we don't change what the sources say. Every item links to its original record. The data is provided as is, without warranty; check the original source before relying on it.
| Source | Used for | Copyright and license |
|---|---|---|
| CVE Program, cvelistV5 | Every CVE record: search, detail pages, recent changes, the API | © The MITRE Corporation. Used under the CVE Program Terms of Use. CVE® is a registered trademark of The MITRE Corporation. |
| GitHub Advisory Database (github/advisory-database) | Upcoming CVEs; "seen in other sources" | © GitHub, Inc. Licensed under CC BY 4.0. Reviewed advisories only. |
| OSV.dev (data exports) | Upcoming CVEs; "seen in other sources" | OSV.dev aggregates other databases, each under its own license:
|
| Zero Day Initiative (RSS feeds) | Cases reported to vendors; upcoming CVEs | © TrendAI Zero Day Initiative. We show the case ID, vendor, CVSS score, dates and CVE IDs from ZDI's public upcoming and published advisory feeds, and link to ZDI for everything else. |
API
JSON endpoints are listed at /docs: /api/search, /api/cves/<id>, /api/recent, /api/status. There is also an RSS feed of recent changes at /recent.rss.