免费的公共脆弱性信息:CVE、全球统一制度、OSV、CISA KEV和ESS合并为每个脆弱性一个条目。 RSS,JSON API和MCP. 互联网档案馆的存檔,存档日期2013-12-21. 文件和问题.
概览
cve.now将CVE列表,GitHub咨询数据库,OSV,NVD,ENISA的欧洲脆弱性数据库(EUVD),CISA的已知被剥削脆弱性目录(KEV),FIRST EPSS分数和被剥削-DB合并为每个脆弱性一个被贬损的条目,并作为RSS,Atom,JSON Feed,一个JSON API和一个MCP服务器发布. 没有账户 没有API密钥 这个寄存器是 Cve. 现在的家在GitHub上:它是什么,如何使用,在哪里报告问题. 该服务由萨扎比建立并运行;其源代码不公开. 一个端点,https://cve.now/feed,用自由结合的过滤器收缩. 默认的RSS; 添加格式=原子或格式=json. 过滤器、技术和生态系统各取一或数个值,作为逗号列表或重复。 条目必须匹配一个字段和每个给定字段的列表值 。 饲料最多结合了16个数值组合(例如4个技术×4个生态系统). 列表 feed 在 MCP 服务器中选择与列表相同的三个字段.
概述（AI 翻译）
一个免费的公众易感信息. cve. 现在将CVE列表,GitHub咨询数据库,OSV,NVD,ENISA的欧洲易感性数据库(EUVD),CISA的已知被剥削的易感性目录(KEV),FIRST EPSS分数和被剥削-DB合并成每个易感性的一个被贬损的条目,并作为RSS,Atom,JSON Feed,一个JSON API和一个MCP服务器发布. 没有账户 没有API密钥
这个寄存器是 Cve. 现在的家在GitHub上:它是什么,如何使用,在哪里报告问题. 该服务由萨扎比建立并运行;其源代码不公开.
□饲料
一个终点https://cve.now/feed,用自由结合的滤波器收缩. 默认的RSS; 添加 [[T1] 或 format=json.
[永久失效連結] 腾讯网.
|-|-|-.
QQ关键:在CISA KEV中,CVSS 9+在上市技术中,或CVSS 7+,EPSS分数为0.1分或以上QQhttps://cve.now/feed?filter=critical.
新CISA已知被剥削的弱点https://cve.now/feed?filter=kev
[T5] |:
[T6] 技术
[T7] |
++++ https://cve.now/feed?filter=critical&tech=nextjs&format=json ++++
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
cve.now
A free, public vulnerability feed. cve.now merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA’s European Vulnerability Database (EUVD), CISA’s Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.
This repository is cve.now’s home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by Sazabi; its source code is not public.
Feeds
One endpoint, https://cve.now/feed, narrowed with filters that combine freely. RSS by default; add format=atom or format=json.
| Feed | URL |
|---|---|
| Critical: in CISA KEV, CVSS 9+ in a listed technology, or CVSS 7+ with an EPSS score of 0.1 or more | https://cve.now/feed?filter=critical |
| New CISA Known Exploited Vulnerabilities | https://cve.now/feed?filter=kev |
| Every entry | https://cve.now/feed |
| One technology | https://cve.now/feed?tech=nextjs |
| One package ecosystem | https://cve.now/feed?ecosystem=npm |
| Combined | https://cve.now/feed?filter=critical&tech=nextjs&format=json |
| Several values | https://cve.now/feed?tech=nextjs,react&ecosystem=npm,pypi |
filter, tech and ecosystem each take one value or several, as a comma list or repeated. An entry must match any listed value of a field and every field given. A feed combines at most 16 combinations of values (for example 4 technologies x 4 ecosystems). list_feed in the MCP server takes the same three fields as lists.
Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget.
Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel. Missing one? Request it.
In Slack, run /feed subscribe https://cve.now/feed?filter=critical in any channel.
Check your stack
Upload a lockfile at cve.now to get a shareable report and an RSS feed of only the entries that affect your exact package versions. Supported: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock (checked by the git commit each input pins, through OSV; nixpkgs package CVEs are not checked).
For a short package list, build the feed URL yourself:
https://cve.now/stack?p=npm:[email protected],pypi:[email protected]
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"cve-now": { "url": "https://mcp.cve.now/mcp" }
}
}