Sources

CVE List (opens in a new window)

The official CVE records, and the starting point for most entries.

© The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. CVE is a registered trademark of The MITRE Corporation.

Licensed under CVE Terms of Use · 418,305 records · Synced 17m ago

National Vulnerability Database (opens in a new window)

CVSS scores, weakness types and affected products, from NIST.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Licensed under US government public data · 418,249 records · Synced 50m ago

GitHub Advisory Database (opens in a new window)

Reviewed advisories with affected packages and fixed versions.

GitHub Advisory Database, licensed CC-BY-4.0 (creativecommons.org/licenses/by/4.0). Every CVE normalizes and merges these records.

Licensed under CC-BY-4.0 · 524,339 records · Synced 18m ago

OSV (opens in a new window)

Package-level advisories across open source ecosystems.

Data from OSV (osv.dev) and the databases it aggregates, listed with their licenses at google.github.io/osv.dev/data. Every CVE normalizes and merges these records.

Licensed under Set by each database: CC0, MIT, Apache 2.0, BSD, CC-BY 4.0, CC-BY-SA 4.0 (Ubuntu, Alpine) or CC-BY-NC-ND 4.0 (Chainguard, Wolfi) · 2,354,677 records · Synced 9m ago

ENISA EU Vulnerability Database (opens in a new window)

The European vulnerability database, run by ENISA.

Source: ENISA, EU Vulnerability Database (euvd.enisa.europa.eu).

Licensed under ENISA legal notice: reproduction allowed with the source acknowledged · 416,947 records · Synced 50m ago

CISA Known Exploited Vulnerabilities (opens in a new window)

The US government’s list of vulnerabilities used in real attacks.

CISA does not endorse Every CVE.

Licensed under CC0-1.0 · 1,766 records · Synced 50m ago

FIRST EPSS (opens in a new window)

Daily estimates of how likely each CVE is to be exploited.

See EPSS at https://www.first.org/epss.

Licensed under Free to use, attribution requested · 398,815 records · Synced 1h ago

Exploit Database (opens in a new window)

A public archive of exploits.

Exploit Database by OffSec (exploit-db.com).

Licensed under GPL-2.0 repository, metadata and links only · 27,250 records · Synced 21h ago

Metasploit Framework (opens in a new window)

Modules from the penetration testing framework.

Copyright © 2006-2026, Rapid7, Inc. Rapid7 does not endorse Every CVE.

Licensed under BSD-3-Clause, metadata and links only · 3,137 records · Synced 21h ago

Nuclei Templates (opens in a new window)

Community detection templates for known vulnerabilities.

Copyright © 2025 ProjectDiscovery, Inc., under the MIT License.

Licensed under MIT, metadata and links only · 4,553 records · Synced 21h ago

PoC-in-GitHub (opens in a new window)

An index of proof-of-concept repositories on GitHub.

Index maintained by nomi-sec.

Licensed under CC0-1.0, metadata and links only · 11,535 records · Synced 21h ago

CWE List (opens in a new window)

What each kind of weakness is.

Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE's copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation.

Licensed under CWE Terms of Use · 1,352 records · Synced 21h ago