# CVE Tracker

> CVE Tracker is a free, open-source website that tracks every public CVE (Common Vulnerabilities and Exposures record). It shows how many CVEs are published over time, lists the newest first, and has a page for every CVE with its CVSS scores, CISA known-exploited status, EPSS exploit probability, affected products and links to the primary sources. No account, no ads, no tracking.

## When to use this
- **Look up one CVE.** Open https://trackcve.app/cve/CVE-2021-44228 with any CVE id: description, scores from the assigner, CISA and NVD, KEV entry, EPSS, CWE, affected versions, references. Send `Accept: text/markdown` (or add `.md`) for a Markdown version.
- **See what was published recently.** https://trackcve.app/ with a period (`?range=24h`, `7d`, `30d`, `month`, `year`…), severity (`?severity=CRITICAL,HIGH`), known exploited only (`?kev=true`), a vendor or product (`?vendor=Microsoft&product=Windows 11`), a package ecosystem (`?ecosystem=npm`) or a search (`?q=openssl`).
- **Follow new CVEs.** Every filter has an Atom feed: https://trackcve.app/feed.xml with the same parameters (`/feed.xml?severity=CRITICAL&kev=true`).
- **Use the data in code.** A public read-only JSON API at https://api.trackcve.app/v1 (`/v1/cves`, `/v1/cves/{id}`, `/v1/cves/{id}/epss`, `/v1/timeline`, `/v1/summary`, `/v1/vendors`, `/v1/products`, `/v1/ecosystems`), and any filter as CSV or JSON from `/v1/export`, rate limited to 120 requests a minute per address.

Do not use CVE Tracker for: vulnerability scanning of your own systems, patch management, or legal advice. It shows public data as published, without warranty; always check the primary source.

## Data
- CVE List (CVE Program), refreshed every 10 minutes: https://github.com/CVEProject/cvelistV5
- NVD API 2.0 (NIST), for CVSS and CWE where the record has none: https://nvd.nist.gov/developers/vulnerabilities
- CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST EPSS: https://www.first.org/epss/
- GitHub Advisory Database (affected packages, CC-BY 4.0): https://github.com/github/advisory-database

## About
Built and maintained by Jan Szotkowski as an independent open-source project (MIT license): https://github.com/janszotkowski/cve-tracker. Not affiliated with MITRE, NIST, CISA, FIRST or GitHub. English only.

## Pages
- [Home: timeline and newest CVEs](https://trackcve.app/)
- [About](https://trackcve.app/about)
- [Data sources](https://trackcve.app/sources)
- [Sitemap](https://trackcve.app/sitemap.xml)