Merged public feeds from CVE List, OSV, GitHub Advisories, NVD and more. Model-written summaries are labeled.
latest read 49 critical in the past 7 days
CVEs, early warnings and breaches as the feed lists them, newest change first.
The vendors named by the most CVEs and advisories, with how many each has.
Catalog numbers since launch (Oct 22, 2026); usage since Oct 31, 2026. Updated every few minutes; aggregates only.
Upload a lockfile to find known CVEs in your project's dependencies. Get a report you can share, with affected packages, severity scores, and links to the details.
Your report and RSS feed stay up to date as the catalog syncs.
package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock, composer.lock, Pipfile.lock, packages.lock.json, gradle.lockfile
Add the cve.now MCP server to Claude Code, Cursor, Codex or another agent so it can look up CVEs and the versions they affect.
Set up the cve.now MCP server for me. cve.now is a free, public CVE feed: no login, no API key. - Server name: cve-now - Transport: Streamable HTTP - URL: https://mcp.cve.now/mcp Add it the way you normally add MCP servers (your CLI command or your MCP config file), then confirm it connects and lists its two tools, search and execute. To finish, use them to run the cve.get operation on one recent CVE and summarize it for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
Get new CVEs in a feed reader or Slack, filtered by type, severity, technology or ecosystem.
https://cve.now/feed
Copy into your feed reader, or use /feed subscribe in Slack.
https://cve.now/feed?format=atom
Copy this URL into a reader that supports ATOM.
https://cve.now/feed?format=json
Copy this URL into a reader that supports JSON Feed.
Up to 200 recent matching entries. The unfiltered feed includes corroborated and confirmed early warnings. The full catalog browser is uncapped, and the daily recaps list every CVE by the day it was published.
Anything missing? Read the reference or open an issue on GitHub.
A free, public CVE feed. It merges the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB into one entry per CVE, with a short plain-English summary. You can read it as RSS, Atom or JSON Feed, query it as a JSON API, or connect a coding agent to it over MCP.
It is free, with no login and no API key. Sazabi already merges this data for its own product, so publishing it costs little. Summaries are licensed CC-BY 4.0.
No. cve.now has no token or coin. Sazabi did not create one, is not affiliated with any, and does not collect fees from any. Anything claiming otherwise is unrelated to this site.
The CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, FIRST EPSS and Exploit-DB. The CVE List, GitHub advisories, OSV and KEV are checked every few minutes; NVD and EUVD are read every ten minutes, and existing entries are re-checked for EPSS changes a few times a day. The time at the top of this page is the latest polling run, not a fresh read of every source. Historical CVEs come from a complete official CVE List snapshot, and new records and edits are layered on top of it.
A CVE is critical when it is on CISA's Known Exploited Vulnerabilities (KEV) list; its CVSS score is 9.0 or higher and it affects a technology cve.now tracks; or its EPSS exploitation probability has reached 10% and its CVSS score is 7.0 or higher. An early warning is critical when its assessed severity is critical. The critical feed is deliberately short.
A 0 to 100 score for how bad a CVE is in practice: exploitation counts for 40 points, exposure 25, reach 20, severity 10 and a missing patch 5. Rankings lists the worst CVEs published or escalated this week, month and year, plus an all-time hall of fame, and the methodology shows every weight.
A model writes them, and each summary names the model that wrote it. Severity, exploitation status and affected versions come from the source data, not from the model, and the original description is always available on the entry page.
It is uploaded to private storage, parsed, and deleted as soon as it has been read. Only the list of package names and versions is kept, to build your report and your stack feed. Anyone with your /stack?stack_id= link can see the CVE matches. For a flake.lock, the git commit hashes of its inputs are sent to OSV to look them up.
No. A report covers known advisories that list affected versions in a supported package ecosystem. It does not cover CVEs without version data, unsupported ecosystems, or anything not yet disclosed. A flake.lock pins source trees, not packages: its commits are matched through OSV, which only knows the projects it tracks, and nixpkgs package CVEs are not checked.
Open cve.now/<id> with a CVE, GHSA or OSV id, for example cve.now/CVE-2026-96951. The same entry is available as JSON at /api/v1/entries/<id>.
Yes. /api/v1/entries lists published entries newest first with cursor pagination, /api/v1/entries/<id> returns one entry (it can redirect to a static copy of the same JSON, so follow redirects), and /api/v1/status reports polling and historical coverage. Any feed URL also accepts format=json, and filter, tech and ecosystem each take several values, such as /feed?tech=nextjs,react&ecosystem=npm. The full reference is at /llms.txt.
Install Slack's RSS app, then run /feed subscribe followed by any feed URL from the subscribe section in the channel where you want updates.
Add the MCP server at https://mcp.cve.now/mcp, or paste the setup prompt from the agents page into your agent. It has two tools: search finds an operation and execute runs it, such as cve.get, feed.read or stack.check.
Each of those is one source. cve.now merges all of them into one entry per CVE, adds exploitation data from KEV, EPSS and Exploit-DB, keeps a short critical list, and offers feeds for your exact stack plus access for agents.
Open an issue at github.com/sazabi/cve.now. There are templates for wrong entries, merge problems, technology requests and source suggestions.
CVSS. The Common Vulnerability Scoring System score, 0 to 10, from the source named under it (the CVE publisher, CISA, NVD or GitHub). It scores the worst case: 9.0 and up is Critical, 7.0 High, 4.0 Medium and below that Low. It does not account for how rare the affected setup is, which is why the vendor's own rating can differ.Status. Published records are live. Rejected records were withdrawn by their publisher (often a duplicate or not a vulnerability). Superseded records were replaced by another id, linked from the page.Known exploitation. Listed in CISA KEV means the US Cybersecurity and Infrastructure Security Agency has evidence of attacks in the wild. Not listed means only that CISA has not added it: attacks may still be happening or reported elsewhere, and it is not a sign that it is safe.EPSS score. The Exploit Prediction Scoring System from FIRST.org: a daily 0 to 100% estimate of the chance a CVE is exploited in the next 30 days, with its percentile among all scored CVEs. It predicts attacks; CISA KEV records ones already seen.Exposure. Actively exploited: CISA lists it as exploited. Default setups: reachable over the network with no login, no user action and no special configuration. Specific setups only: it needs a non-default feature or setting, a login, a user to do something, or local access. Unclear: the sources do not say enough to tell.Vendor severity. The vendor's own rating (Low, Medium, High or Critical), taken from its machine-readable advisory. Vendors know how their software is used, so a vendor rating well below the CVSS level usually means the affected setup is rare.Public exploit. Public exploit code from Exploit-DB, a Metasploit module, a Nuclei template or a proof of concept on GitHub. It means attacks need less skill; it is not proof of attacks.CISA SSVC. Stakeholder-Specific Vulnerability Categorization from CISA's Vulnrichment. Exploitation is none, poc (proof of concept) or active; Automatable says whether an attacker can script it end to end; Technical impact is partial or total control. CISA's SSVC documentation.Attention. Needs attention: CISA added it to KEV in the last 30 days or its KEV due date is still ahead, EPSS crossed 10% in the last 14 days, the first public exploit appeared in the last 14 days, or it scores 80 or more on the cve.now Index and was published in the last 30 days. Reference: none of these, so it is a record to look things up in. The rules are versioned and never set by hand.