About cve.now
A free CVE feed that merges the public vulnerability sources into one entry per vulnerability.
Sources and methods
Who runs cve.now?
cve.now is a free, public vulnerability feed run by Sazabi. Its GitHub home, for docs and issues, is github.com/sazabi/cve.now, and new critical and exploited vulnerabilities are posted on X as @cvedotnow.
Where does the data come from?
The CVE List, the GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, FIRST EPSS and Exploit-DB. Records that describe the same vulnerability are merged into one entry, and each entry links back to every source it was built from. Historical CVEs come from a complete official CVE List snapshot, and new records and edits are layered on top of it.
How often is it updated?
The CVE List, GitHub advisories, OSV and KEV are checked every few minutes. NVD and EUVD are read every ten minutes, and existing entries are re-checked for EPSS changes a few times a day. Early warnings and breaches are checked every few minutes from security newsrooms, vendor notices and regulators.
Who writes the summaries?
A model writes each plain-English summary from the entry's source records, and the entry names the model that wrote it. Severity, exploitation status, affected versions and fixes come from the source data, not from the model, and the original description is always shown on the entry page. Summaries are licensed CC-BY 4.0.
How are early warnings and breaches checked?
An incident shows once an established security newsroom reports it, and is marked confirmed when the vendor, a regulator or a CVE does. Every count, data type and attacker on a breach page is quoted from a linked source. Leak-site claims alone never show, and a denial is shown rather than deleted.
How do I report a mistake?
Open an issue at github.com/sazabi/cve.now. There are templates for wrong entries, merge problems, technology requests and source suggestions. Corrections are applied to the catalog, so the entry page, its feeds and its Markdown copy change together.