Critical Severity
Published: Nov 1, 2026
A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs and issues only.
# cve.now
**A free, public vulnerability feed.** [cve.now](https://cve.now) merges the CVE List, the GitHub Advisory Database, OSV, NVD, ENISA's European Vulnerability Database (EUVD), CISA's Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability, and publishes it as RSS, Atom, JSON Feed, a JSON API and an MCP server. No account, no API key.
This repository is cve.now's home on GitHub: what it is, how to use it, and where to report problems. The service is built and run by [Sazabi](https://sazabi.com?utm_source=cve-now&utm_medium=github); its source code is not public.
## Feeds
One endpoint, `https://cve.now/feed`, narrowed with filters that combine freely. RSS by default; add `format=atom` or `format=json`.
| Feed | URL |
| --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Critical: in CISA KEV, CVSS 9+ in a listed technology, or CVSS 7+ with an EPSS score of 0.1 or more | `https://cve.now/feed?filter=critical` |
| New CISA Known Exploited Vulnerabilities | `https://cve.now/feed?filter=kev` |
| Every entry | `https://cve.now/feed` |
| One technology | `https://cve.now/feed?tech=nextjs` |
| One package ecosystem | `https://cve.now/feed?ecosystem=npm` |
| Combined