Data
Data sources
Where every record comes from, how often it is refreshed and when it was last updated. Status is live.
22 of 22 sources are up to date. Times are UTC; feeds are polled between hourly and daily depending on how often the source publishes.
-
Up to date
Vulnerability records
CVE List (cvelistV5)
The CVE program's official list (cvelistV5): descriptions, affected products, CVSS scores from the CNA and ADPs (e.g. CISA Vulnrichment), references.
- Records
- 420,681 CVEs
- Updated
- 30 min ago
- Checked
- hourly
github.com License / terms: CVE Terms of Use
-
Up to date
Exploitation
CISA Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed as exploited in the wild, with ransomware use and remediation due dates.
- Records
- 1,769 CVEs
- Updated
- 21 h ago
- Checked
- daily
cisa.gov License / terms: Public domain
-
Up to date
Exploit prediction
FIRST EPSS
Daily probability (0–100%) that a CVE will be exploited in the next 30 days, with its percentile.
- Records
- 401,682 CVEs
- Updated
- 4 h ago
- Checked
- daily
first.org License / terms: Free use with attribution
-
Up to date
EU database
ENISA EU Vulnerability Database
ENISA's EU Vulnerability Database: EUVD identifiers, EU-relevant scoring and the EU exploited list.
- Records
- 416,171 CVEs
- Updated
- 59 min ago
- Checked
- hourly
euvd.enisa.europa.eu License / terms: ENISA
-
Up to date
National CERT
BSI CERT-Bund (WID)
Germany's federal CERT (CERT-Bund) Warn- und Informationsdienst, CSAF 2.0 documents, TLP:WHITE only. Advisories are in German.
- Records
- 14,545 advisories
- Updated
- 15 min ago
- Checked
- hourly
wid.cert-bund.de License / terms: BSI (TLP:WHITE)
-
Up to date
Open-source packages
OSV.dev (GitHub Advisories, PyPA, Go, RustSec…)
GitHub Security Advisories, PyPA, Go, RustSec and other databases via OSV.dev: affected package version ranges for 13 ecosystems.
- Records
- 38,431 CVEs
- Updated
- 45 min ago
- Checked
- hourly
osv.dev License / terms: CC-BY 4.0 (per database)
-
Up to date
Distribution
Debian Security (DSA / DLA)
Debian security advisories (DSA / DLA) and the security tracker's fixed versions per release.
- Records
- 11,133 advisories
- Updated
- 35 min ago
- Checked
- hourly
security-tracker.debian.org License / terms: Debian (via OSV)
-
Up to date
Distribution
Ubuntu Security Notices (USN)
Ubuntu Security Notices (USN) and fixed versions for every LTS and Pro release.
- Records
- 8,371 advisories
- Updated
- 35 min ago
- Checked
- hourly
ubuntu.com License / terms: Canonical (via OSV)
-
Up to date
Distribution
Alpine secdb
Alpine secdb: fixed package versions per Alpine branch.
- Records
- 10,633 CVEs
- Updated
- 35 min ago
- Checked
- hourly
secdb.alpinelinux.org License / terms: Alpine (via OSV)
-
Up to date
Distribution
Red Hat Security Advisories (RHSA)
Red Hat Security Advisories (RHSA) for RHEL and Red Hat products, with fixed RPM versions.
- Records
- 23,995 advisories
- Updated
- 35 min ago
- Checked
- hourly
access.redhat.com License / terms: Red Hat (via OSV)
-
Up to date
Distribution
SUSE / openSUSE Security Updates
SUSE and openSUSE security updates (SLES, SLE modules, Leap, Tumbleweed, Micro).
- Records
- 35,440 advisories
- Updated
- 35 min ago
- Checked
- hourly
suse.com License / terms: SUSE (via OSV)
-
Up to date
Distribution
Rocky Linux Security Advisories
Rocky Linux security advisories (RLSA).
- Records
- 4,721 advisories
- Updated
- 35 min ago
- Checked
- hourly
errata.rockylinux.org License / terms: Rocky (via OSV)
-
Up to date
Distribution
AlmaLinux Security Advisories
AlmaLinux security advisories (ALSA).
- Records
- 6,398 advisories
- Updated
- 35 min ago
- Checked
- hourly
errata.almalinux.org License / terms: AlmaLinux (via OSV)
-
Up to date
Public exploits
Public exploits (PoC-in-GitHub, Metasploit, Exploit-DB)
Links to public exploit code: Metasploit modules, Exploit-DB entries and proof-of-concept repositories on GitHub (via PoC-in-GitHub). Only links are stored.
- Records
- 0 CVEs
- Updated
- 4 h ago
- Checked
- daily
github.com License / terms: links only — PoC-in-GitHub, Metasploit (BSD-3), Exploit-DB (GPLv2)
-
Up to date
Vendor PSIRT
SICK PSIRT
SICK security advisories (SCA) in CSAF 2.0 — sensors, safety scanners and industrial software.
- Records
- 75 advisories
- Updated
- 25 min ago
- Checked
- daily
sick.com License / terms: SICK (TLP:WHITE)
-
Up to date
National CERT
CISA ICS & IT advisories
CISA's advisories in CSAF 2.0: industrial control systems (ICSA, ICSMA for medical devices) and IT. Often the only English advisory for OT products.
- Records
- 4,097 advisories
- Updated
- 25 min ago
- Checked
- daily
cisa.gov License / terms: Public domain (CISA, TLP:CLEAR)
-
Up to date
National CERT
NCSC-NL (Netherlands)
The Dutch National Cyber Security Centre: advisories in CSAF 2.0 with its own likelihood and impact rating. Advisories are in Dutch.
- Records
- 1,157 advisories
- Updated
- 25 min ago
- Checked
- daily
advisories.ncsc.nl License / terms: NCSC-NL (TLP:CLEAR)
-
Up to date
Vendor PSIRT
Siemens ProductCERT
Siemens ProductCERT security advisories (SSA) in CSAF 2.0, published on Siemens' monthly patch day.
- Records
- 865 advisories
- Updated
- 25 min ago
- Checked
- daily
cert-portal.siemens.com License / terms: Siemens (TLP:WHITE)
-
Up to date
Vendor PSIRT
Schneider Electric CPCERT
Schneider Electric security notifications (SEVD) in CSAF 2.0, including Pro-face, APC and AVEVA products.
- Records
- 293 advisories
- Updated
- 25 min ago
- Checked
- daily
se.com License / terms: Schneider Electric (TLP:WHITE)
-
Up to date
Vendor PSIRT
ABB PSIRT
ABB cyber security advisories in CSAF 2.0.
- Records
- 83 advisories
- Updated
- 25 min ago
- Checked
- daily
global.abb License / terms: ABB (TLP:WHITE)
-
Up to date
Distribution
Debian security tracker
The Debian security tracker itself, every two hours: status, urgency and no-DSA triage per package, CVE and release — used by server scans to drop not-affected CVEs and separate low-priority ones.
- Records
- 0 CVEs
- Updated
- just now
- Checked
- daily
security-tracker.debian.org License / terms: public data
-
Up to date
Supply chain
OpenSSF Malicious Packages
Reports of intentionally malicious packages (typosquats, dependency confusion, account takeovers) from the OpenSSF project, via OSV.dev.
- Records
- 240,349 reports
- Updated
- 45 min ago
- Checked
- hourly
github.com License / terms: Apache-2.0
Attribution
CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Terms of Use. EPSS scores © FIRST, used with attribution. OSV data is available under CC-BY 4.0 or the license of each upstream database. BSI advisories are published under TLP:WHITE. All trademarks belong to their owners. This site is not affiliated with or endorsed by any of these organisations.
Missing a source you rely on? Let us know.