CVE Ledger

Every public CVE in one place, free and open source. See how many vulnerabilities are published over time, browse the newest ones first, filter them down to what matters to you, and open any CVE for its scores, exploitation signals, affected products and links to the primary sources.

Live at cveledger.app, with its public API at api.cveledger.app.

CVE Ledger keeps its own copy of the public sources (the CVE List, NVD, CISA KEV, FIRST EPSS, the GitHub Advisory Database, the public exploits of Metasploit, Nuclei and Exploit-DB, ENISA's EU Vulnerability Database and CIRCL's Vulnerability-Lookup sightings) and refreshes it every few minutes. It needs no paid API and no account, and runs on a single small server.

For terminal-first CVE tracking, try CVE Tracker CLI.

✨ Features

• Every published CVE (400,000+), refreshed every 10 minutes, with a timeline of how many are published per day, week, month or year, by severity.
• One filter for the chart and the table: search, period, severity, known exploited, vendor and product, package ecosystem, weakness (CWE) and CNA, all kept in a shareable URL.
• A full page for every CVE: every CVSS score, EPSS and its history, CISA KEV and EU KEV, public exploits (Metasploit, Nuclei, Exploit-DB), CIRCL sightings, affected products and packages.
• Take it with you: CSV and JSON exports, an Atom feed for any filter, a watchlist kept in the browser, and badges for a README or a ticket.
• For programs and agents: a public JSON API, an MCP server, and every CVE as Markdown, all with no key.
• Accessible: WCAG 2.2 AA, keyboard and screen reader friendly, light and dark themes.

The complete list is in docs/FEATURES.md.

🚀 Quick start

You need Node 24.22.1 and pnpm 12.

git clone https://github.com/janszotkowski/cve-tracker.git
cd cve-tracker
pnpm install
cp apps/backend/.env.example apps/backend/.env
cp apps/frontend/.env.example apps/frontend/.env
pnpm dev

The web app runs at http://localhost:3000 and the API at http://localhost:4000/v1/health. The first start downloads the CVE List (about a minute); see docs/DEVELOPMENT.md for the details and every command.

📖 Use it

• Website: cveledger.app. Browse, filter, export and watch CVEs; no account.

• REST API: public and read-only, 120 requests a minute. Full reference at cveledger.app/api (docs/API.md), OpenAPI 3.1 at /v1/openapi.json.

  curl "https://api.cveledger.app/v1/cves?severity=CRITICAL"
  

• MCP server: connect an AI assistant to https://api.cveledger.app/v1/mcp, free and with no key. Setup for each client at cveledger.app/mcp (docs/MCP.md).

• Feeds and badges: any filter has an Atom feed (https://cveledger.app/feed.xml?…), and https://cveledger.app/badge/CVE-….svg shows a CVE's severity, score and KEV status. See Beyond the JSON API.

📚 Documentation

• Features: everything the site offers.
• API reference: every public endpoint and filter, with examples.
• MCP server: how to connect an AI assistant, and its tools.
• Data sources: what each source adds, how it is read, and its attribution.
• Architecture: the source sync, storage, backend, frontend, security and performance.
• Configuration: every environment variable, and running it with Docker Compose.
• Deployment guide: a production deployment behind a Cloudflare Tunnel, step by step.
• Development: local setup, repository layout and commands.
• Changelog: every change to the API and the site.

🤝 Contributing

Contributions are welcome: bug reports, data issues, new chart views, new sources. Please read CONTRIBUTING.md first; everyone taking part follows the Code of Conduct. Open an issue for a bug, data issue, or feature request.

To report a security problem in CVE Ledger itself, follow the private reporting process in SECURITY.md.

📄 License and attribution

MIT © Jan Szotkowski. The data shown by the service stays under the terms of its respective sources, and is shown as published, without warranty of any kind: always check the primary source before acting on it.

CVE® is a registered trademark of The MITRE Corporation; CVE records come from the CVE Program. This product uses the NVD API but is not endorsed or certified by the NVD. Known exploited vulnerabilities come from CISA KEV, EPSS scores from FIRST, affected packages from the GitHub Advisory Database (CC-BY 4.0), public exploits from the Metasploit Framework (BSD 3-Clause), Nuclei templates (MIT) and the Exploit Database (GPLv2), EUVD data from ENISA's EU Vulnerability Database (source: ENISA), and sightings from CIRCL's Vulnerability-Lookup. The full attribution is in docs/SOURCES.md.

Created and maintained by Jan Szotkowski. See the contributor graph for everyone who has helped improve CVE Ledger.