About
About CveMate
Free vulnerability intelligence: every known vulnerability with its severity, exploitation signals and affected software, merged from 30 sources. No account needed.
Who publishes CveMate
CveMate is an independent project, with its roadmap, issues and discussions on GitHub. It is not affiliated with MITRE, NIST, CISA, ENISA or any other source below: it reads their public data, merges it per vulnerability and links back to each source.
Data sources
30 sources: the 14 below, plus the advisories of 16 package ecosystems published through OSV (Alpine, Chainguard, crates.io, Debian, Go, Mageia, Maven, npm, NuGet, openSUSE, PyPI, Red Hat, RubyGems, SUSE, Ubuntu, Wolfi).
Vulnerability records
- CVE.org: Official CVE records from the CVE Program and its CNAs.
- NVD: NIST analysis: CVSS scores, CWE and affected products (CPE).
- OSV: Open-source advisories, including GitHub, with affected and fixed package versions.
- GCVE: Global CVE identifiers from GCVE numbering authorities.
- Azure Linux OVAL: Azure Linux package advisories.
- Wordfence Intelligence: WordPress core, plugin and theme vulnerabilities.
Exploitation
- CISA KEV: US known exploited vulnerabilities, with remediation due dates.
- ENISA CNW: Known exploited vulnerabilities of the EU CSIRTs Network.
- CIRCL Vulnerability-Lookup: Exploitation sightings published by CIRCL.
- FIRST EPSS: Daily probability of exploitation in the next 30 days.
- Exploit-DB: Public exploits and proofs of concept.
- Metasploit: Exploit modules from the Metasploit Framework.
Context
- MITRE CWE: Weakness names and descriptions.
- endoflife.date: End-of-life dates of affected products.
How often the data refreshes
Sources are checked every hour and a full re-sync runs weekly. EPSS scores change once a day, when FIRST publishes them. Each record shows when it was published and last modified, and each score names the source it comes from.
How records are built
CveMate does not rewrite advisories. Where sources disagree, the record shows every value with its source instead of picking one: several CVSS scores, the KEV catalogs that list a vulnerability and when each added it. The risk level combines severity, EPSS, KEV listings, ransomware use and public exploits; the FAQ explains each signal and how the score is calculated.
Corrections and reuse
Found a wrong value? Open an issue on GitHub or write to contact@cvemate.com. Data mistakes usually come from a source; we fix how we read it and report the rest upstream. Reused data stays under each source's own terms.