CVE Tracker

Every public CVE in one place, free and open source. See how many vulnerabilities are published over time, browse the newest ones first, filter them down to what matters to you, and open any CVE for its scores, exploitation signals, affected products and links to the primary sources.

Live at trackcve.app, with its public API at api.trackcve.app.

CVE Tracker keeps its own copy of the public sources (the CVE List, NVD, CISA KEV, FIRST EPSS and the GitHub Advisory Database) and refreshes it every few minutes. It needs no paid API and no account, and runs on a single small server.

Website · API reference · MCP server · Architecture · Contributing · License

For terminal-first CVE tracking, try CVE Tracker CLI.

✨ Features

• The whole CVE List: every published record (400,000+), refreshed every 10 minutes from the official CVE Program repository.

• Timeline: CVEs per hour, day, week, month or year, depending on the period you look at, in three views:

  • New: counts stacked by severity.

  • Severity mix: each severity's share of a period.

  • Cumulative: the running total.

• One filter for the chart and the table: full-text search (title, description, vendor, product) or a CVE id, a publication period (today, last 24 hours, this week … all time, or a custom range), severity, "known exploited only", a vendor and product (with suggestions, matching every affected product of a record) a package ecosystem (npm, PyPI, Maven, Go, NuGet, crates.io…, from reviewed GitHub advisories), a weakness (CWE) and the CNA that assigned it.

• Take it with you: any filtered list downloads as CSV or JSON (up to 10,000 rows), and has its own Atom feed for a feed reader or a chat integration.

• Recently added to KEV: what CISA added to its Known Exploited Vulnerabilities catalog, by day, whatever the CVE's age, with its own feed.

• Statistics: severity, the most common weaknesses, vendors and CNAs of the last 7 days to 12 months.

• Watchlist: watch any filter and see what each found in the last week, with all their feeds as one OPML file; kept in the browser, no account.

• Badges: /badge/CVE-….svg shows a CVE's severity, score and KEV status in a README or a ticket.

• Server-side sorting and paging: by publication date, CVE id, CVSS score, EPSS probability or the day it was added to KEV.

• Shareable state: the filter, order, page and chart view all live in the URL. Copy it, bookmark it, send it; the browser's back button walks through your changes, and the way back from a CVE restores the list exactly as you left it.

• CVE detail page:

  • description and dates

  • every CVSS score (assigner, CISA Vulnrichment, NVD) with vectors

  • EPSS with its history over the last month, and CISA SSVC

  • the CISA KEV entry, including known ransomware use

  • CWE, affected products and version ranges, affected packages from GitHub advisories

  • solutions, workarounds and references

  • links to CVE.org, NVD, OSV.dev, GitHub Advisories and CIRCL

• Made to be found and cited: every CVE has its own server-rendered page with structured data and a share image; sitemaps for all of them, llms.txt, and a Markdown version of every CVE for AI agents (/cve/CVE-….md or Accept: text/markdown).

• An MCP server for AI assistants: connect Claude, Cursor or any other client to https://api.trackcve.app/v1/mcp and let it search CVEs itself, with no key.

• How it's built: docs/ARCHITECTURE.md, also on the site at trackcve.app/architecture.

• Accessible: WCAG 2.2 AA, checked with axe-core; full keyboard use, screen reader announcements, light and dark themes, reduced motion, and a table view of every chart's numbers.

How it works

 CVE List (GitHub)  ─┐
 NVD API 2.0        ─┤  in-process sync  ┌───────────────┐  /v1/*   ┌──────────────────────┐
 CISA KEV (JSON)    ─┼─────────────────▶ │ backend       │ ───────▶ │ frontend             │
 FIRST EPSS (CSV)   ─┤                   │ Hono + SQLite │          │ TanStack Start (SSR) │
 GitHub advisories  ─┘                   │               │          │                      │
                                         └───────────────┘          └──────────────────────┘

The severity a CVE is listed with comes from the assigner's (CNA) CVSS score, else CISA's, else NVD's; a CVE nobody has scored yet is "Not scored".

Security and performance

• Queries never block the server. Reads run in worker threads with read-only SQLite connections; a query still running after 3 s is stopped and its worker replaced, and past 200 waiting calls the API sheds load with 503 instead of piling up.

• Fair use. Every caller gets 120 requests a minute; the frontend's own rendering is exempt through a shared token. Paging is capped at 10,000 results, and one- or two-letter prefixes are not expanded.

• Answers are reused. The API keeps each answer for 30 seconds and drops them all when the sync changes the data; pages and answers carry s-maxage for a CDN.

• Hardened pages. A strict Content-Security-Policy that allows inline scripts only by hash, frame-ancestors 'none', HSTS, nosniff, a strict referrer policy; external links open without passing the referrer.

• The sync never loses changes. It only advances over runs the delta log really contains, retries records that could not be read or were still the cached previous version, and never re-downloads everything because of one bad answer.

• Supply chain. Exact dependency versions, each at least 7 days old before pnpm installs it; only fixed, public sources are ever fetched.

Repository layout

apps/backend     HTTP API (Hono on Node 24), SQLite store with query worker threads, and the source sync
apps/frontend    Web app (TanStack Start, Router, Query, Table, Charts; Tailwind; Nitro)
packages/core    Shared API contract (zod/mini), typed API client, severity and time-bucket model
skills           A skill that tells an AI agent when and how to use the MCP server

Related MCP server: nist-nvd-mcp-server

🚀 Getting Started

You need Node 24.22.1 (see .node-version) and pnpm 12 (the exact version is pinned in package.json and fetched automatically).

git clone https://github.com/janszotkowski/cve-tracker.git
cd cve-tracker
pnpm install
cp apps/backend/.env.example apps/backend/.env
cp apps/frontend/.env.example apps/frontend/.env
pnpm dev

On the first start the backend downloads the CVE List into apps/backend/data/cve.db, which takes about a minute; KEV and EPSS follow within seconds. NVD then fills in scores in the background, so older CVEs show as "Not scored" for a while. A free NVD API key in NVD_API_KEY makes that take minutes instead of about an hour.

📖 Usage

The public API is read-only and works directly from a browser, script, or other HTTP client. For example:

curl https://api.trackcve.app/v1/summary
curl "https://api.trackcve.app/v1/cves?severity=CRITICAL"

Full reference with examples: trackcve.app/api (source: docs/API.md). OpenAPI 3.1: /v1/openapi.json.

The frontend uses a public, read-only JSON API that anyone may call, within a fair-use limit (120 requests a minute per address by default; RateLimit-* headers tell you where you stand, and a 429 carries Retry-After). Answers carry Cache-Control headers suitable for a CDN; please cache on your side too. Paging reaches the first 10,000 results of a filter; narrow it or change the order for the rest.

Filter parameters (shared by /v1/cves, /v1/timeline and /v1/export; the site's own address and its Atom feed, /feed.xml, take the same ones):

The response shapes are defined once, as zod schemas, in packages/core/src/contract, and packages/core/src/client is a typed client for them.

MCP server

An AI assistant can use the same data over the Model Context Protocol. The server is free and read-only and needs no key. It has limits of its own and never uses more than one query worker, so agents cannot slow the site down.

claude mcp add --transport http cve-tracker https://api.trackcve.app/v1/mcp

Other clients and details: trackcve.app/mcp (source: docs/MCP.md).

⚙️ Configuration

The backend reads its settings from the environment once at start-up and refuses to start with a readable message when one is invalid. The full list, with defaults, is in apps/backend/src/config/env.ts.

The frontend's settings are build-time (VITE_*, baked into the bundle) plus one runtime variable:

🚢 Deployment

The whole service is two small Node processes and one SQLite file of about 1.5 GB. Any server with 1–2 GB of RAM and a persistent disk is enough; a Hetzner CX22 (about €4 a month) runs it comfortably.

SITE_URL=https://cve.example.org \
API_URL=https://api.cve.example.org \
ALLOW_INDEXING=true \
NVD_API_KEY=your-key \
docker compose up -d --build

On your own server: DEPLOY.md is a step-by-step guide for a Hetzner server behind a Cloudflare Tunnel (about 7 € a month), with a script that sets everything up.

docker-compose.yml builds both images from the Dockerfile and keeps the database on a volume, so a new release reads only what changed since the last one. Put a CDN or reverse proxy (Cloudflare's free plan, Caddy) in front for TLS. Pages and API answers carry s-maxage, so a CDN that caches them (on Cloudflare, add a cache rule for HTML) answers most traffic; the API reuses its own answers for 30 seconds as well. Set INTERNAL_API_TOKEN (required by the Compose file) and, behind Cloudflare, CLIENT_IP_HEADER=cf-connecting-ip (both services read it).

Railway or Fly.io with a volume mounted at /data work too. Serverless platforms without a persistent disk do not fit: the database and the sync loop need one long-lived process.

📚 Documentation

• API reference explains every public endpoint and filter with examples.

• MCP server shows how to connect an AI assistant, and lists its tools.

• Architecture describes the source sync, storage, backend, and frontend.

• Deployment guide covers a production deployment behind a Cloudflare Tunnel.

• Security policy explains how to report a vulnerability in CVE Tracker.

🛠️ Development

Use the commands below while developing or validating a change:

🤝 Contributing

Contributions are welcome: bug reports, data issues, new chart views, new sources. Please read CONTRIBUTING.md first; everyone taking part follows the Code of Conduct. To report a security problem in CVE Tracker itself, see SECURITY.md.

🐛 Issues & Support

Open an issue for a bug, data issue, or feature request. For a security issue in CVE Tracker itself, follow the private reporting process in SECURITY.md.

📋 Code of Conduct

Everyone taking part in the project is expected to follow the Code of Conduct.

📄 License

CVE Tracker shows public data as published by its sources, without warranty of any kind. Always check the primary source before acting on it.

• CVE® is a registered trademark of The MITRE Corporation. CVE records come from the CVE Program.

• This product uses the NVD API but is not endorsed or certified by the NVD.

• Known exploited vulnerabilities come from the CISA KEV catalog. cisa.gov refuses many data-centre addresses, so the sync falls back to CISA's own copy of the same file on GitHub (cisagov/kev-data).

• EPSS scores come from FIRST: Jacobs, Romanosky, et al., Exploit Prediction Scoring System.

• Affected packages come from the GitHub Advisory Database, licensed under CC-BY 4.0.

MIT © Jan Szotkowski. The data shown by the service stays under the terms of its respective sources.

👥 Authors & Contributors

Created and maintained by Jan Szotkowski. See the contributor graph for everyone who has helped improve CVE Tracker.