About

This site mirrors the CVE Program's official list of CVE Records from github.com/CVEProject/cvelistV5 (CVE JSON 5 format) and makes it searchable. It pulls new commits every 30 minutes and indexes the records that changed.

Where the fields come from

• Description, title, affected products, references: the CNA (the organisation that assigned the CVE), plus references and products added by ADPs such as CISA and the CVE Program.
• Severity: the CNA's newest CVSS version (4.0, then 3.1, 3.0, 2.0). If the CNA gave none, the first ADP score, usually CISA's Vulnrichment. "Unscored" means no score anywhere in the record.
• KEV: CISA's Known Exploited Vulnerabilities entry, as recorded by CISA-ADP in the record.

API

JSON endpoints are listed at /docs: /api/search, /api/cves/<id>, /api/recent, /api/status. There is also an RSS feed of recent changes at /recent.rss.