Merged public feeds from CVE List, OSV, GitHub Advisories, NVD and more. Model-written summaries are labeled.
Security incidents reported before a CVE exists. An incident shows here once an established security newsroom reports it, and is marked confirmed when the vendor, a regulator or a CVE does. A post from a trusted security reporter counts as a newsroom report. Claims that only other social posts make are unverified and shown only when you choose them; leak-site claims alone never show here.
Since launch, Oct 22, 2026. Updated every few minutes; aggregates only.
Upload a lockfile to find known vulnerabilities in your project's dependencies. Get a report you can share, with affected packages, severity scores, and links to the details.
Your report and RSS feed stay up to date as the catalog syncs.
package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock
Connect Claude Code, Cursor, Codex, or other agents to look up CVEs, check affected versions, and review newly disclosed vulnerabilities alongside your code.
Set up the cve.now MCP server for me. cve.now is a free, public vulnerability feed: no login, no API key. - Server name: cve-now - Transport: Streamable HTTP - URL: https://mcp.cve.now/mcp Add it the way you normally add MCP servers (your CLI command or your MCP config file), then confirm it connects and lists its tools: get_vulnerability, list_feed and check_stack. To finish, use get_vulnerability to look up one recent CVE and summarize it for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
Choose what matters to your stack. Get new vulnerabilities in your feed reader or Slack, in the format you prefer.
https://cve.now/feed?type=early_warning
Copy into your feed reader, or use /feed subscribe in Slack.
https://cve.now/feed?type=early_warning&format=atom
Copy this URL into a reader that supports ATOM.
https://cve.now/feed?type=early_warning&format=json
Copy this URL into a reader that supports JSON Feed.
Up to 200 recent matching entries. Corroborated and confirmed warnings only. The full catalog browser is uncapped.
A free, public vulnerability feed. It merges the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB into one entry per vulnerability, with a short plain-English summary. You can read it as RSS, Atom or JSON Feed, query it as a JSON API, or connect a coding agent to it over MCP.
It is free, with no login and no API key. Sazabi already merges this data for its own product, so publishing it costs little. Summaries are licensed CC-BY 4.0.
No. cve.now has no token or coin. Sazabi did not create one, is not affiliated with any, and does not collect fees from any. Anything claiming otherwise is unrelated to this site.
The CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, FIRST EPSS and Exploit-DB. The CVE List, GitHub advisories, OSV and KEV are checked every few minutes; NVD and EUVD are read every ten minutes, and existing entries are re-checked for EPSS changes a few times a day. The time at the top of this page is the latest polling run, not a fresh read of every source. Historical CVEs come from a complete official CVE List snapshot, and new records and edits are layered on top of it.
A vulnerability is critical when it is listed in CISA KEV, when it scores CVSS 9 or higher and affects one of the listed technologies, or when it scores CVSS 7 or higher and its EPSS probability has reached 0.1. The critical feed is deliberately short.
A model writes them, and each summary names the model that wrote it. Severity, exploitation status and affected versions come from the source data, not from the model, and the original description is always available on the entry page.
It is uploaded to private storage, parsed, and deleted as soon as it has been read. Only the list of package names and versions is kept, to build your report and your stack feed. Anyone with your /stack?s= link can see the vulnerability matches. For a flake.lock, the git commit hashes of its inputs are sent to OSV to look them up.
No. A report covers known advisories that list affected versions in a supported package ecosystem. It does not cover vulnerabilities without version data, unsupported ecosystems, or anything not yet disclosed. A flake.lock pins source trees, not packages: its commits are matched through OSV, which only knows the projects it tracks, and nixpkgs package CVEs are not checked.
Open cve.now/<id> with a CVE, GHSA or OSV id, for example cve.now/CVE-2026-96951. The same entry is available as JSON at /api/v1/entries/<id>.
Yes. /api/v1/entries lists published entries newest first with cursor pagination, /api/v1/entries/<id> returns one entry (it can redirect to a static copy of the same JSON, so follow redirects), and /api/v1/status reports polling and historical coverage. Any feed URL also accepts format=json, and filter, tech and ecosystem each take several values, such as /feed?tech=nextjs,react&ecosystem=npm. The full reference is at /llms.txt.
Install Slack's RSS app, then run /feed subscribe followed by any feed URL from the subscribe section in the channel where you want updates.
Add the MCP server at https://mcp.cve.now/mcp, or paste the setup prompt from the agent section into your agent. Its tools are get_vulnerability, list_feed and check_stack.
Each of those is one source. cve.now merges all of them into one entry per vulnerability, adds exploitation data from KEV, EPSS and Exploit-DB, keeps a short critical list, and offers feeds for your exact stack plus access for agents.
Open an issue at github.com/sazabi/cve.now. There are templates for wrong entries, merge problems, technology requests and source suggestions.
CVSS. The Common Vulnerability Scoring System score, 0 to 10, from the source named under it (the CVE publisher, CISA, NVD or GitHub). It scores the worst case: 9.0 and up is Critical, 7.0 High, 4.0 Medium and below that Low. It does not account for how rare the affected setup is, which is why the vendor's own rating can differ.Status. Published records are live. Rejected records were withdrawn by their publisher (often a duplicate or not a vulnerability). Superseded records were replaced by another id, linked from the page.Known exploitation. Listed in CISA KEV means the US Cybersecurity and Infrastructure Security Agency has evidence of attacks in the wild. Not listed means only that CISA has not added it: attacks may still be happening or reported elsewhere, and it is not a sign that it is safe.Exposure. Actively exploited: CISA lists it as exploited. Default setups: reachable over the network with no login, no user action and no special configuration. Specific setups only: it needs a non-default feature or setting, a login, a user to do something, or local access. Unclear: the sources do not say enough to tell.Vendor severity. The vendor's own rating (Low, Medium, High or Critical), taken from its machine-readable advisory. Vendors know how their software is used, so a vendor rating well below the CVSS level usually means the affected setup is rare.Public exploit. Public exploit code from Exploit-DB, a Metasploit module, a Nuclei template or a proof of concept on GitHub. It means attacks need less skill; it is not proof of attacks.CISA SSVC. Stakeholder-Specific Vulnerability Categorization from CISA's Vulnrichment. Exploitation is none, poc (proof of concept) or active; Automatable says whether an attacker can script it end to end; Technical impact is partial or total control. CISA's SSVC documentation.