** 무료, 공개 취약점 피드. ** cve.now는 CVE 목록, GitHub Advisory Database, OSV, NVD, ENISA의 유럽 취약점 데이터베이스 (EUVD), CISA의 Known Exploited Vulnerabilities Catalog (KEV), FIRST EPSS 점수 및 Exploit-DB를 취약점 당 하나의 deduplicated Entry로 병합하고 RSS, AJP, JSON 및 MCP로 배포합니다. 계정 없음, API 키 없음.

이 저장소는 GitHub의 cve.now의 홈입니다. 그것이 무엇인지, 사용하는 방법, 그리고 문제를 보고. 서비스는 건축되고 Sazabi에 의해 달립니다; 그것의 근원 부호는 공중이 아닙니다.

피드

1개의 엔드포인트, https://cve.now/feed], 필터로 축소하여 자유롭게 결합합니다. 기본적으로 RSS; 추가 format=atom 또는 format=json.

| 링크 | URL | |—||| | 중요: CISA KEV, CVSS 9+에 나열된 기술, 또는 CVSS 7+의 EPSS 점수 0.1 이상|[T3]| | 새로운 CISA Known Exploited Vulnerabilities | [T4] | | 각 항목 | [T5] | | 원 기술 | [T6] | | 한 패키지 생태계 | [T7] | | 복합 | [T8] |

cve.now

A free, public vulnerability feed. cve.now merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA’s European Vulnerability Database (EUVD), CISA’s Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.

This repository is cve.now’s home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by Sazabi; its source code is not public.

Feeds

One endpoint, https://cve.now/feed, narrowed with filters that combine freely. RSS by default; add format=atom or format=json.

filter, tech and ecosystem each take one value or several, as a comma list or repeated. An entry must match any listed value of a field and every field given. A feed combines at most 16 combinations of values (for example 4 technologies x 4 ecosystems). list_feed in the MCP server takes the same three fields as lists.

Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget.

Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel. Missing one? Request it.

In Slack, run /feed subscribe https://cve.now/feed?filter=critical in any channel.

Check your stack

Upload a lockfile at cve.now to get a shareable report and an RSS feed of only the entries that affect your exact package versions. Supported: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock (checked by the git commit each input pins, through OSV; nixpkgs package CVEs are not checked).

For a short package list, build the feed URL yourself:

https://cve.now/stack?p=npm:[email protected],pypi:[email protected]