cve.now

A free public vulnerability feed with no login or API key. Subscribe over RSS, Atom, or JSON, check your own dependencies, or query it from a coding agent over MCP.

cve.now is a free, public vulnerability feed from Sazabi. It merges the CVE List, OSV and the GitHub Advisory Database, CISA's Known Exploited Vulnerabilities catalog (KEV), and EPSS exploit scores into one deduplicated entry per vulnerability. You do not need a Sazabi account, a login, or an API key.

To do this	Use
Get new vulnerabilities as they appear	The feed at `https://cve.now/feed`
Watch only the packages you run	A stack feed at `https://cve.now/stack`
Let a coding agent check your dependencies	The MCP server at `https://cve.now/mcp`
Read or fetch one vulnerability	An entry page or the JSON API

One endpoint serves every feed. RSS is the default format, and filters combine: filter=critical&tech=nextjs returns critical Next.js vulnerabilities only.

Parameter	Values	Default
`filter`	`critical` or `kev`	All vulnerabilities
`tech`	A technology slug from the list below	Any technology
`ecosystem`	A lowercase package ecosystem, such as `npm`, `pypi`, `go`, `maven`, `crates.io`, `packagist`, or `rubygems`	Any ecosystem
`format`	`rss`, `atom`, or `json` (JSON Feed 1.1)	`rss`

An unrecognized filter, tech, or format, or an invalid ecosystem, returns HTTP 400 with a JSON error message. A well-formed ecosystem with no matching entries returns an empty feed.

Filters

filter=critical is the short list of vulnerabilities that need action. An entry is critical when any of these is true:

It is listed in CISA KEV.
Its CVSS score is 9.0 or higher and it affects one of the technologies below.
Its EPSS score has reached 0.1 and its CVSS score is 7.0 or higher.

filter=kev returns the entries listed in CISA KEV, the catalog of vulnerabilities known to be exploited in the wild.

Technologies

tech takes one of these slugs.

Frameworks and runtimes: nextjs, react, node, express, django, flask, rails, spring, log4j, php, wordpress
Infrastructure: kubernetes, docker, nginx, apache-httpd, openssl, linux-kernel, jenkins, gitlab
Databases: postgresql, mysql, redis
Vendors and products: fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome

Add a feed

Add the feed URL as a new subscription in any reader that supports RSS, Atom, or JSON Feed:

https://cve.now/feed?filter=critical

Add Slack's RSS app to your Slack workspace, then subscribe a channel:

/feed subscribe https://cve.now/feed?filter=critical

Request the feed in the format you want, and filter it with your own tools:

curl "https://cve.now/feed?filter=kev&format=json"
curl -s "https://cve.now/feed?filter=critical&tech=nextjs&format=json" | jq -r '.items[].title'

What an item contains

Each item links to the entry page. cve.now adds an item when an entry first appears, and again when it changes in a way that matters: it is added to CISA KEV, it becomes critical, or its CVSS score is published or changes. Update items say why in the title.

A feed holds the 200 newest items. cve.now refreshes feeds at most every five minutes and caches responses for about a minute, so polling more often than every few minutes returns the same items.

Check your stack

A stack feed contains only the vulnerabilities that affect the exact package versions you list.

https://cve.now/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0&format=rss

p is required. It is a comma-separated list of ecosystem:name@version items, such as npm:@scope/name@1.0.0 or maven:org.apache.logging.log4j:log4j-core@2.14.1.
The ecosystems are npm, pypi (or pip), go (or golang), crates.io (crates or cargo), rubygems (or gem), packagist (or composer), nuget, and maven.
format is rss (the default) or json. The JSON response has the number of packages checked and the matching entries, each with a matched field naming the package that matched.
A request takes at most 500 packages. A missing or malformed p, an unknown ecosystem, an unsupported format, or more than 500 packages returns HTTP 400.

The package list is part of the URL. Any service that stores the URL, such as a feed reader or Slack, stores your dependency list too.

cve.now matches against the vulnerabilities it has ingested, which are recent ones rather than the full history of the CVE List. An empty result does not prove that a version is safe.

Use it from a coding agent

cve.now runs a remote MCP server over Streamable HTTP at https://cve.now/mcp. It needs no authentication.

To set it up in any coding agent, paste this prompt:

Add the cve.now MCP server to your MCP configuration: name `cve-now`, remote Streamable HTTP server at https://cve.now/mcp, no authentication. Then confirm the tools get_vulnerability, list_feed and check_stack are available, and run check_stack on this project's lockfile.

To add it yourself in Claude Code, run:

claude mcp add --transport http cve-now https://cve.now/mcp

For other clients, add a remote HTTP server named cve-now with that URL and no headers. Connect your coding agent shows where each client keeps its MCP configuration; leave out the Sazabi secret key header.

Tool	What it does	Arguments
`get_vulnerability`	Returns one entry as JSON.	`id`: a CVE, GHSA, or OSV id
`list_feed`	Lists the newest items in a feed.	`name`: `critical` (the default), `all`, `kev`, `tech/` plus a slug, or `ecosystem/` plus an ecosystem. `limit`: 1 to 200, default 20
`check_stack`	Lists vulnerabilities affecting exact versions.	`lockfile_name` and `lockfile_content`, or `packages`: a list of objects with `ecosystem`, `name`, and `version`

check_stack reads package-lock.json, npm-shrinkwrap.json, bun.lock, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt, Cargo.lock, go.sum, Gemfile.lock, mix.lock, and flake.lock. A flake.lock pins source trees, not packages, so it is checked by the git commit each input pins, through OSV, which only knows the projects it tracks. Package CVEs in nixpkgs are not checked, and the commit hashes are sent to OSV. It checks at most 500 packages per call. For a larger lockfile, pass packages in batches of up to 500.

Look up one vulnerability

Each entry has a page at https://cve.now/ plus its id, such as https://cve.now/CVE-2026-12345. Any CVE, GHSA, or OSV id of the entry opens the same page.

The JSON API returns the same entry. Responses allow cross-origin requests, and an unknown id returns HTTP 404.

curl https://cve.now/api/v1/entries/CVE-2026-12345

Field	Contents
`id`	The CVE id when one exists, otherwise the GHSA or OSV id
`aliases`	Other ids for the same vulnerability
`status`	`provisional`, `superseded`, `published`, or `rejected`
`title`	A short title
`summary`	A plain-language summary written by a model in `text`, or `null` when there is none
`originalDescription`	The description as the source published it
`severity`	The CVSS `cvss` score, its `vector`, and its `source`, or `null`
`statedSeverity`	The `low`, `medium`, `high`, or `critical` rating the publisher gave, and who gave it, or `null`
`exploitation`	`kev` with the date added and due date, and `epssReached` with the date, or `null` for each
`affected`	Affected packages and products, with version ranges
`references`	Links, each with a type such as `advisory` or `fix`
`sources`	Where the data came from, with each source's license
`firstSeenAt`, `publishedAt`, `modifiedAt`	Timestamps

The response also links related and superseded entries.

Data sources and freshness

Source	What it adds
CVE List (cvelistV5)	The canonical CVE records
OSV and GitHub Advisory Database	Affected packages with version ranges, and aliases
CISA KEV	Whether a vulnerability is known to be exploited, with the date added
EPSS	An exploit-likelihood score; cve.now records when a score first reaches 0.1

cve.now checks these sources every five minutes. A vulnerability appears after the first check that finds it in the CVE List.

Summaries are written by a model and labeled as such on the entry page. Not every entry has one: without a summary, feeds show the original description, shortened. Check the original description for anything that matters. Summaries are licensed CC BY 4.0, and each entry lists its sources and their licenses.

On this page