Data and coverage
Where cve.now's data comes from, how often each source is checked, what makes a vulnerability critical, how summaries are written, and what a lookup does not cover.
cve.now keeps one entry per vulnerability. When the same vulnerability appears in several sources under different ids (a CVE id, a GHSA id, an OSV id), cve.now merges them into one entry, uses the CVE id when one exists, and lists the other ids as aliases. Any of those ids opens the same entry.
Sources
| Source | What it adds | How often it is checked |
|---|---|---|
| CVE List (cvelistV5) | The canonical CVE records, the CNA's CVSS score, and CISA's SSVC decision points | Every few minutes |
| GitHub Advisory Database and OSV | Affected packages with version ranges, and aliases | Every few minutes |
| CISA KEV | Whether a vulnerability is known to be exploited in the wild, with the date added and CISA's due date | Every few minutes |
| FIRST EPSS | The probability that a vulnerability will be exploited; cve.now records when a score first reaches 0.1 | Every few minutes for new entries; existing entries are re-checked a few times a day |
| NVD | A CVSS score when the CVE's publisher gave none, and affected products when the publisher named none | Every 10 minutes |
| ENISA EUVD | The European vulnerability database's records | Every 10 minutes |
| Exploit-DB | Public exploit code, with the publication date | Every few minutes |
| Metasploit, Nuclei, and PoC-in-GitHub | Metasploit modules, Nuclei detection templates, and GitHub proof-of-concept repositories that name the CVE | Every few minutes |
Historical CVEs come from a complete, verified snapshot of the official CVE List. New records and edits are layered on top of that snapshot as they are published. The time shown at the top of the homepage is the latest polling run, not a fresh read of every source. /api/v1/status reports the last check of each source and the snapshot's coverage.
A vulnerability appears on cve.now after the first check that finds it. Vendor announcements whose CVE records have not been published yet are not in the CVE List; see Early warnings for incidents that have no CVE.
Severity
An entry's CVSS score comes first from the CNA that published the CVE, then from the CVE record's enrichment containers (including CISA's) in the order they appear in the record. NVD, GitHub, or ENISA supply a score when none of those has one. The entry records which provider supplied the score. When a publisher gives a rating (low, medium, high, or critical) but no score, the entry shows that stated rating and who gave it.
What makes an entry critical
The critical list is deliberately short: it is the set of vulnerabilities most likely to need action now. An entry is critical when any of these is true:
- It is listed in CISA KEV.
- Its CVSS score is 9.0 or higher and it affects one of the tracked technologies.
- Its EPSS score has reached 0.1 and its CVSS score is 7.0 or higher.
Exploitation signals
Each entry shows what is known about exploitation:
- Known exploitation — the entry is in CISA KEV, with the date added and CISA's due date.
- Likely exploitation — its EPSS score, a prediction rather than an observed attack, has reached 0.1.
- Public exploit — Exploit-DB has published exploit code for it. Metasploit modules and Nuclei templates that name the CVE are listed too.
- Proof-of-concept repositories — GitHub repositories listed by PoC-in-GitHub. These are unreviewed and often contain scanners, patch checkers, or notes rather than working exploits, so treat them as a weaker signal than Exploit-DB.
CISA SSVC
When CISA has published its SSVC (Stakeholder-Specific Vulnerability Categorization) assessment for a CVE, the entry shows its three decision points: Exploitation (none, poc, or active), Automatable (yes or no), and Technical impact (partial or total). Values are shown as CISA published them.
Summaries
A model writes a short plain-language summary for new entries and for critical and KEV-listed entries. Each summary is labeled as model-written and names the model that wrote it. Severity, exploitation status, and affected versions always come from the source data, never from the model. Not every entry has a summary; without one, cve.now shows the original description. For anything that matters, read the original description and the references on the entry page.
Coverage limits
- Package matching needs affected-version data in a supported ecosystem. A vulnerability without that data can be listed on cve.now but cannot match a lockfile.
- A clean stack check means cve.now found no matching advisory. It does not prove a version is safe: it does not cover vulnerabilities without version data, unsupported ecosystems, or anything not yet disclosed.
- JVN iPedia and CNNVD are not sources.
Licensing
Summaries are licensed CC BY 4.0. Each entry lists its sources and their licenses. cve.now uses NVD data but is not endorsed by NVD.