Merged from the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB. Summaries are written by a model and labeled as such.
The latest Critical and High vulnerabilities, newest first.
Upload a lockfile to find known vulnerabilities in your project's dependencies. Get a report you can share, with affected packages, severity scores, and links to the details.
Your report and RSS feed stay up to date as the catalog syncs.
package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock
Connect Claude Code, Cursor, Codex, or other agents to look up CVEs, check affected versions, and review newly disclosed vulnerabilities alongside your code.
Set up the cve.now MCP server for me. cve.now is a free, public vulnerability feed: no login, no API key. - Server name: cve-now - Transport: Streamable HTTP - URL: https://mcp.cve.now/mcp Add it the way you normally add MCP servers (your CLI command or your MCP config file), then confirm it connects and lists its tools: get_vulnerability, list_feed and check_stack. To finish, use get_vulnerability to look up one recent CVE and summarize it for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
Pick the vulnerability set, technology, and ecosystem you care about, then copy a format into your feed reader or Slack's RSS app to receive updates where you work. The list above follows the same selection.
Subscriptions use up to 200 recent matching entries. The full catalog browser is uncapped.
In Slack, use /feed subscribe followed by the RSS URL.
A free, public vulnerability feed. It merges the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB into one entry per vulnerability, with a short plain-English summary. You can read it as RSS, Atom or JSON Feed, query it as a JSON API, or connect a coding agent to it over MCP.
It is free, with no login and no API key. Sazabi already merges this data for its own product, so publishing it costs little. Summaries are licensed CC-BY 4.0.
No. cve.now has no token or coin. Sazabi did not create one, is not affiliated with any, and does not collect fees from any. Anything claiming otherwise is unrelated to this site.
The CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, FIRST EPSS and Exploit-DB. The CVE List, GitHub advisories, OSV and KEV are checked every few minutes; NVD and EUVD are read every ten minutes, and existing entries are re-checked for EPSS changes a few times a day. The time at the top of this page is the latest polling run, not a fresh read of every source. Historical CVEs come from a complete official CVE List snapshot, and new records and edits are layered on top of it.
A vulnerability is critical when it is listed in CISA KEV, when it scores CVSS 9 or higher and affects one of the listed technologies, or when it scores CVSS 7 or higher and its EPSS probability has reached 0.1. The critical feed is deliberately short.
A model writes them, and each summary names the model that wrote it. Severity, exploitation status and affected versions come from the source data, not from the model, and the original description is always available on the entry page.
It is uploaded to private storage and parsed there to build your report and your stack feed. Uploads are retained for analytics and feed generation. Anyone with your /stack?s= link can see the vulnerability matches; the file itself is never served.
No. A report covers known advisories that list affected versions in a supported package ecosystem. It does not cover vulnerabilities without version data, unsupported ecosystems, or anything not yet disclosed.
Open cve.now/<id> with a CVE, GHSA or OSV id, for example cve.now/CVE-2026-96951. The same entry is available as JSON at /api/v1/entries/<id>.
Yes. /api/v1/entries lists published entries newest first with cursor pagination, /api/v1/entries/<id> returns one entry, and /api/v1/status reports polling and historical coverage. Any feed URL also accepts format=json. The full reference is at /llms.txt.
Install Slack's RSS app, then run /feed subscribe followed by any feed URL from the subscribe section in the channel where you want updates.
Add the MCP server at https://mcp.cve.now/mcp, or paste the setup prompt from the agent section into your agent. Its tools are get_vulnerability, list_feed and check_stack.
Each of those is one source. cve.now merges all of them into one entry per vulnerability, adds exploitation data from KEV, EPSS and Exploit-DB, keeps a short critical list, and offers feeds for your exact stack plus access for agents.
Open an issue at github.com/sazabi/cve.now. There are templates for wrong entries, merge problems, technology requests and source suggestions.