Data sources & licenses
Everything on this site comes from public sources. Here is each one, how often we refresh it, its license, and the attribution it requires.
CISA Known Exploited Vulnerabilities Catalog
- Website
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- License
- CC0 1.0 (public domain)
- Commercial use
- allowed
- Refresh
- every 2 hours
- Last success
- 2026-11-07 06:53 UTC · <built-in method items of dict object at 0x7fc68ff462c0> records
- Attribution
- Contains data from the CISA Known Exploited Vulnerabilities Catalog. Use does not imply endorsement by CISA or DHS.
CVE Program (CVE List V5)
- Website
- https://github.com/CVEProject/cvelistV5
- License
- CVE Program Terms of Use
- Commercial use
- allowed
- Refresh
- hourly changes; records from 2020 onward
- Last success
- 2026-11-07 03:03 UTC · <built-in method items of dict object at 0x7fc68ff44580> records
- Attribution
- CVE® records © The MITRE Corporation, reproduced under the CVE Program Terms of Use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation.
OSV.dev open source vulnerability database
- Website
- https://osv.dev
- License
- Per-source licenses (below)
- Commercial use
- allowed with attribution
- Refresh
- daily
- Last success
- 2026-11-06 23:41 UTC · <built-in method items of dict object at 0x7fc68ff44240> records
- Attribution
- Vulnerability data from OSV.dev and its upstream databases, under their respective licenses.
| Upstream database | License |
|---|---|
| GitHub Advisory Database (npm, PyPI, Go, Maven, NuGet, Packagist, RubyGems) | CC BY 4.0 |
| PyPA Advisory Database | CC BY 4.0 |
| Go Vulnerability Database | CC BY 4.0 |
| OpenSSF Malicious Packages | Apache 2.0 |
| Drupal security advisories | MIT |
| Ubuntu Security Notices | CC BY-SA 4.0 |
| Alpine SecDB | CC BY-SA 4.0 |
| AlmaLinux errata | MIT |
| Rocky Linux errata (RESF) | BSD |
| Debian Security Tracker | No license stated; published openly by Debian |
Advisory data derived from Ubuntu Security Notices and Alpine SecDB is shared under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Provided as-is, without warranty.
EPSS – Exploit Prediction Scoring System
- Website
- https://www.first.org/epss/
- License
- Published free of charge, no registration required (no formal license stated)
- Commercial use
- allowed (no restriction stated; confirm with FIRST for certainty)
- Refresh
- daily
- Last success
- 2026-11-06 22:50 UTC · <built-in method items of dict object at 0x7fc68ff44380> records
- Attribution
- EPSS scores by FIRST.org and Empirical Security (https://www.first.org/epss). This product uses EPSS scores but is not endorsed or certified by the EPSS SIG.
CVSS-BT exploit signals (t0sche/cvss-bt)
- Website
- https://github.com/t0sche/cvss-bt
- License
- MIT
- Commercial use
- allowed
- Refresh
- daily
- Last success
- 2026-11-06 22:50 UTC · <built-in method items of dict object at 0x7fc68ff46ac0> records
- Attribution
- Exploit-availability signals from CVSS-BT by Stephen Shaffer (MIT license), which aggregates Metasploit (BSD), Nuclei templates (MIT), PoC-in-GitHub (CC0) and NVD (public domain).
VulnCheck KEV flag (via CVSS-BT) Not used
- Website
- https://vulncheck.com/kev
- License
- VulnCheck community terms
- Commercial use
- NOT used: VulnCheck's general terms forbid commercial redistribution without written consent
- Refresh
- off unless SOURCE_VULNCHECK_KEV=true
Exploit-DB flag (via CVSS-BT) Not used
- Website
- https://www.exploit-db.com/
- License
- Exploit-DB site terms
- Commercial use
- NOT used: site terms forbid reuse without written permission
- Refresh
- off unless SOURCE_EXPLOITDB=true