cve.now

A free, public vulnerability feed. cve.now merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA's European Vulnerability Database (EUVD), CISA's Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.

This repository is cve.now's home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by Sazabi; its source code is not public.

Feeds

One endpoint, https://cve.now/feed, narrowed with filters that combine freely. RSS by default; add format=atom or format=json.

Feed	URL
Critical: in CISA KEV, CVSS 9+ in a listed technology, or CVSS 7+ with an EPSS score of 0.1 or more	https://cve.now/feed?filter=critical
New CISA Known Exploited Vulnerabilities	https://cve.now/feed?filter=kev
Every entry	https://cve.now/feed
One technology	https://cve.now/feed?tech=nextjs
One package ecosystem	https://cve.now/feed?ecosystem=npm
Combined	https://cve.now/feed?filter=critical&tech=nextjs&format=json
Several values	https://cve.now/feed?tech=nextjs,react&ecosystem=npm,pypi

filter, tech and ecosystem each take one value or several, as a comma list or repeated. An entry must match any listed value of a field and every field given. A feed combines at most 16 combinations of values (for example 4 technologies x 4 ecosystems). list_feed in the MCP server takes the same three fields as lists.

Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget.

Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel. Missing one? Request it.

In Slack, run /feed subscribe https://cve.now/feed?filter=critical in any channel.

Check your stack

Upload a lockfile at cve.now to get a shareable report and an RSS feed of only the entries that affect your exact package versions. Supported: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, composer.lock, Pipfile.lock, packages.lock.json (NuGet), gradle.lockfile, flake.lock (checked by the git commit each input pins, through OSV; nixpkgs package CVEs are not checked).

For a short package list, build the feed URL yourself:

https://cve.now/stack?p=npm:[email protected],pypi:[email protected]

MCP server

A remote Streamable HTTP MCP server at https://mcp.cve.now/mcp, no authentication. Tools: search, get_vulnerability, list_feed and check_stack. search takes a query (q) and structured parameters (severity, kev, exploited, tech, ecosystem, vendor, package, published, type), says why each result matched, and suggests broader queries when nothing matches.

Claude Code

claude mcp add --transport http cve-now https://mcp.cve.now/mcp

Codex

codex mcp add cve-now --url https://mcp.cve.now/mcp

OpenCode (opencode.json)

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cve-now": {
      "type": "remote",
      "url": "https://mcp.cve.now/mcp",
      "enabled": true
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "cve-now": { "url": "https://mcp.cve.now/mcp" }
  }
}

Then ask your agent to run check_stack on your project's lockfile.

To have your agent check dependencies on its own, add this to your project's AGENTS.md or CLAUDE.md:

## Dependency vulnerabilities

Use the cve.now MCP server (https://mcp.cve.now/mcp, no API key) for vulnerability checks:

- Before adding or upgrading a dependency, and when asked whether this project is affected by a CVE, call `check_stack` with the lockfile's contents (or the packages and exact versions).
- For any CVE, GHSA or OSV id, call `get_vulnerability` to see whether it is in CISA KEV, whether its EPSS score has reached 10% (and when), and the fixed versions.
- No matches means cve.now found none, not that the packages are safe.

API

Endpoint	Returns
https://cve.now/<id>	Page for a CVE, GHSA or OSV id
https://cve.now/api/v1/entries/<id>	The same entry as JSON; a recently synced entry can redirect to a static copy, so follow redirects (curl -L)
https://cve.now/api/v1/entries	All published entries, newest first, paginated with nextCursor
https://cve.now/api/v1/search	Search by q and the MCP search parameters, with match reasons, facet counts and broader queries (llms.txt)
https://cve.now/api/v1/status	Source polling health and catalog coverage
https://cve.now/llms.txt	A plain-text guide for LLMs and agents

/feed and /api/v1/* send Access-Control-Allow-Origin: *.

Issues

Open an issue to report:

• a wrong or missing entry
• two entries that should be merged, or one that merged things it shouldn't
• a technology or package ecosystem you want covered
• a disclosure source we should watch
• a bug in a feed, page, the API or the MCP server

For an error in an upstream record (for example a wrong CVE description), we'll point you to the CNA or advisory database that owns it.

Don't post unpatched vulnerabilities here. Issues are public. Report a vulnerability in someone else's product to its vendor. Report a vulnerability in cve.now itself to [email protected] (see SECURITY.md).

This repository doesn't accept pull requests: its files are synced from Sazabi's private monorepo, so a direct change would be overwritten. Open an issue instead.

Sources and licensing

Data: the CVE List, the GitHub Advisory Database, OSV, the NVD, ENISA EUVD, the CISA KEV catalog, FIRST EPSS and Exploit-DB. Each entry links to its sources.

Entry summaries are written by a model and labeled as such; they're published under CC-BY 4.0. Upstream data keeps its own license and attribution.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

The text in this repository is licensed under Apache 2.0.

---

Want to know which of these affect your systems? Sazabi can tell you.