Where the data comes from
Everything here is public and free. The site keeps its own copy of the sources, refreshed automatically, so it stays fast and never depends on a paid API. Severity is the assigner's CVSS score when it gave one, then CISA's, then NVD's; a CVE nobody has scored yet is shown as “Not scored”.
Each source is read on its own schedule, so a slow one never holds up the others. A read that fails is tried again at the next interval, and records that could not be fetched are kept and fetched again: nothing a source published is skipped.
- CVE List (CVE Program, cvelistV5)
The official records: every CVE id, its description, affected products, references and the CNA’s own score. Also carries CISA’s Vulnrichment (CVSS, CWE and SSVC for records the CNA did not score).
- How it is read
- The whole repository as one archive on the first run (about 200 MB); after that only the records the CVE Program’s delta log lists as new or changed.
- How often
- Every 10 minutes
- Last read
- 9 min ago ()
- NVD API 2.0 (NIST)
CVSS scores and CWE where the record has none of its own, and NVD’s analysis status. This product uses the NVD API but is not endorsed or certified by the NVD.
- How it is read
- Every CVE once, then only what NVD changed since the last read (its last-modified window).
- How often
- Every hour
- Last read
- 50 min ago ()
- CISA Known Exploited Vulnerabilities
Which CVEs are exploited in the wild, since when, the remediation deadline for US federal agencies and known ransomware use.
- How it is read
- The whole catalog as one JSON file from cisa.gov; when cisa.gov refuses the request, the same file from CISA’s own copy on GitHub (cisagov/kev-data).
- How often
- Every 6 hours
- Last read
- 59 min ago ()
- FIRST EPSS
The probability of exploitation in the next 30 days, recomputed daily for every CVE. Jacobs, Romanosky et al., Exploit Prediction Scoring System, first.org/epss.
- How it is read
- One compressed CSV with today’s score of every CVE; a CVE’s history of the last month from FIRST’s API when its page asks for it (cached).
- How often
- Every 6 hours (FIRST publishes once a day)
- Last read
- 59 min ago ()
- GitHub Advisory Database
The packages a CVE affects and their ecosystems (npm, PyPI, Maven, Go…), from the advisories GitHub has reviewed. Licensed under CC-BY 4.0.
- How it is read
- The reviewed advisories (OSV format) from the repository’s archive (about 150 MB).
- How often
- Every 12 hours
- Last read
- 59 min ago ()
CVE® is a registered trademark of The MITRE Corporation. The information is provided as is, without warranty of any kind; always check the primary source before acting on it.