Security Vulnerability Tracker (CVE)

Track software security vulnerabilities from the US government's National Vulnerability Database (NVD), enriched with the two signals security teams actually prioritize by: CISA's Known Exploited Vulnerabilities flag (is it being exploited in the wild?) and the EPSS score (how likely is exploitation in the next 30 days?). No API key, no login, no browser.

What you get

One row per CVE:

• CVE id, published and last-modified dates, analysis status
• description, CVSS base score, severity, vector and version
• CWE weakness categories and affected products (CPE identifiers)
• knownExploited - whether it is on CISA's KEV catalog, with the CISA vulnerability name, the date it was added and the federal patch-by deadline
• epssScore / epssPercentile - exploit probability from FIRST.org
• advisory and patch reference links, and a link to the CVE on nvd.nist.gov

Ways to search

Combine free-text keywords with vendor/product, severity, exploited-only and date filters:

{
    "keywords": ["remote code execution"],
    "vendor": "fortinet",
    "product": "fortios",
    "severity": "CRITICAL",
    "kevOnly": true,
    "sinceDays": 90
}

• keywords - free-text searches across CVE descriptions, one per line
• vendor / product - limit to one vendor or product using CPE naming (lowercase, underscores: "microsoft", "windows_10"). Check any known CVE on nvd.nist.gov for the exact tokens.
• severity - one CVSS v3 severity level (LOW to CRITICAL)
• kevOnly - only vulnerabilities with confirmed in-the-wild exploitation
• sinceDays - only CVEs published in the last N days

Monitor mode

Turn on newOnly, put the actor on a schedule, and each run emits only CVEs it has not returned before. Point it at the vendors in your stack and get a new-vulnerability alert feed. Runs where nothing new arrived cost nothing.

Who uses this

• IT and security teams: a patching-priority feed for your stack - filter by your vendors, sort by EPSS, patch what is actually being exploited first.
• MSPs and consultancies: track client software portfolios without a paid vulnerability-intelligence subscription.
• Software vendors: watch CVEs published against your own products and your dependencies.
• Analysts and researchers: study vulnerability trends by vendor, weakness type or severity with structured data.

Pairs with our Website Tech Stack Detector to find what a site runs, then track its vulnerabilities, and with our Lookalike Domain Finder for the phishing side of the house.

Pricing

A small fee per CVE row. Searches that match nothing are free note rows, and the first 2 rows of every run are free.

Notes

• Sources: the NVD CVE API 2.0 and the CISA KEV fields it embeds (both US government public data), plus the EPSS API from FIRST.org. All keyless.
• The NVD's keyless rate limit is low, so large pulls are deliberately paced (about one request per 6.5 seconds). A few hundred rows per run is the sweet spot.
• Very new CVEs may still be "Awaiting Analysis" and carry no CVSS score yet; EPSS scores appear within a day or two of publication.