Why CVE Tracker exists

The problem

Everything about a vulnerability is public, but it is spread across several places. The CVE List has the official record; NVD adds scores, often weeks later; CISA lists the vulnerabilities attackers already use; FIRST estimates how likely the rest are to be exploited. Each has its own site, format and search.

The tools that put it all together are mostly commercial: an overview of what was published this week, and how much of it matters, sits behind an account or a price. That leaves out the people who need it most and can afford it least: small teams, open-source maintainers, students, anyone curious.

What it does

CVE Tracker brings those sources into one place, free and open to anyone. You can see how many CVEs are published over time and how severe they are, browse the newest ones as they arrive, narrow them down to what you care about, and open any of them for its scores, exploitation signals, affected products and links to the primary sources. Every view has its own address, so it can be bookmarked or sent to a colleague.

Principles

Free for everyone

No account, no paywall, no "pro" tier. Every feature is there for every visitor.

No ads, no tracking

No analytics, no cookies. The only things stored are in your own browser: the theme you chose and the last list you looked at.

Open source

The whole site and its data pipeline are on GitHub under the MIT license. Read it, run your own copy, improve it.

Sources first

Nothing here is invented or re-scored. Every number comes from a public source, and every CVE links back to the primary records.

Cheap to run

One small server and its own copy of the data, refreshed every few minutes. No paid APIs, so keeping it online costs a few euros a month.

Who builds it, and why

I'm Jan Szotkowski. Security is a big interest of mine, and CVEs are part of my days: I work with them at my job and keep following them in my free time. CVE Tracker is the overview I wanted to have myself.

I like building free things that can help someone, and I simply enjoy making them. With AI as a collaborator, a project like this is now something one person can build and keep running in their spare time, so there is no reason for it to cost anyone anything.

CVE Tracker is an independent open-source project. It is not affiliated with MITRE, NIST, CISA or FIRST; it only shows what they publish. See where the data comes from.

How you can help

• Found a CVE that is missing or differs from its source? Report a data issue.
• Have an idea or found a bug? Open an issue.
• Want to build something, like a new chart view or a new source? Read the contributing guide.
• And if it is useful to you, tell someone who could use it too.