cve.now

A free, public vulnerability feed. cve.now merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA's European Vulnerability Database (EUVD), CISA's Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.

This repository is cve.now's home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by Sazabi; its source code is not public.

Feeds

One endpoint, https://cve.now/feed, narrowed with filters that combine freely. RSS by default; add format=atom or format=json.

filter, tech and ecosystem each take one value or several, as a comma list or repeated. An entry must match any listed value of a field and every field given. A feed combines at most 16 combinations of values (for example 4 technologies x 4 ecosystems). list_feed in the MCP server takes the same three fields as lists.

Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget.

Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel. Missing one? Request it.

In Slack, run /feed subscribe https://cve.now/feed?filter=critical in any channel.

Check your stack

Upload a lockfile at cve.now to get a shareable report and an RSS feed of only the entries that affect your exact package versions. Supported: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock (checked by the git commit each input pins, through OSV; nixpkgs package CVEs are not checked).

For a short package list, build the feed URL yourself:

https://cve.now/stack?p=npm:[email protected],pypi:[email protected]

MCP server

A remote Streamable HTTP MCP server at https://mcp.cve.now/mcp, no authentication. Tools: get_vulnerability, list_feed and check_stack.

Claude Code

claude mcp add --transport http cve-now https://mcp.cve.now/mcp

Codex

codex mcp add cve-now --url https://mcp.cve.now/mcp

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "cve-now": { "url": "https://mcp.cve.now/mcp" }
  }
}

Then ask your agent to run check_stack on your project's lockfile.

API

/feed and /api/v1/* send Access-Control-Allow-Origin: *.

Issues

Open an issue to report:

• a wrong or missing entry
• two entries that should be merged, or one that merged things it shouldn't
• a technology or package ecosystem you want covered
• a disclosure source we should watch
• a bug in a feed, page, the API or the MCP server

For an error in an upstream record (for example a wrong CVE description), we'll point you to the CNA or advisory database that owns it.

Don't post unpatched vulnerabilities here. Issues are public. Report a vulnerability in someone else's product to its vendor. Report a vulnerability in cve.now itself to [email protected] (see SECURITY.md).

This repository doesn't accept pull requests: its files are synced from Sazabi's private monorepo, so a direct change would be overwritten. Open an issue instead.

Sources and licensing

Data: the CVE List, the GitHub Advisory Database, OSV, the NVD, ENISA EUVD, the CISA KEV catalog, FIRST EPSS and Exploit-DB. Each entry links to its sources.

Entry summaries are written by a model and labeled as such; they're published under CC-BY 4.0. Upstream data keeps its own license and attribution.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

The text in this repository is licensed under Apache 2.0.

Want to know which of these affect your systems? Sazabi can tell you.