Low Severity
Published: Oct 25, 2026
A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs and issues only.
# cve.now
**A free, public vulnerability feed.** [cve.now](https://cve.now) merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA's European Vulnerability Database (EUVD), CISA's Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.
This repository is cve.now's home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by [Sazabi](https://sazabi.com?utm_source=cve-now&utm_medium=github); its source code is not public.
## Feeds
One endpoint, `https://cve.now/feed`, narrowed with filters that combine freely. RSS by default; add `format=atom` or `format=json`.
| Feed | URL |
|---|---|
| Critical: in CISA KEV, CVSS 9+ in a listed technology, or CVSS 7+ with an EPSS score of 0.1 or more | `https://cve.now/feed?filter=critical` |
| New CISA Known Exploited Vulnerabilities | `https://cve.now/feed?filter=kev` |
| Every entry | `https://cve.now/feed` |
| One technology | `https://cve.now/feed?tech=nextjs` |
| One package ecosystem | `https://cve.now/feed?ecosystem=npm` |
| Combined | `https://cve.now/feed?filter=critical&tech=nextjs&format=json` |
| Several values | `https://cve.now/feed?tech=nextjs,react&ecosystem=npm,pypi` |
`filter`, `tech` and `ecosystem` each take one value or several, as a comma list or repeated. An entry must match any listed value of a field and every field given. A feed combines at most 16 combinations of values (for example 4 technologies x 4 ecosystems). `list_feed` in the MCP server takes the same three fields as lists.
Ecosystems: `npm`, `pypi`, `go`, `maven`, `crates.io`, `packagist`, `rubygems`, `hex`, `nuget`.
Technologies: `nextjs`, `react`, `node`, `express`, `django`, `flask`, `rails`, `spring`, `log4j`, `kubernetes`, `docker`, `nginx`, `apache-httpd`, `openssl`, `postgresql`, `mysql`, `redis`, `microsoft-sql-s