cve.bz

About cve.bz

cve.bz publishes a vulnerability database as its sources publish it: every CVE with the scores that decide what to fix first. No sign-in, no key.

Sources

NVD
The NIST National Vulnerability Database: descriptions, CVSS 4.0 and 3.x vectors and scores, CWE ids, affected products and references. Checked every 15 minutes; updated 3 minutes ago.
CVE List
The CVE Program's records: a CVE minutes after it is published, before the NVD has analyzed it, with the CNA's own description and scores. Checked every 10 minutes; updated 6 minutes ago.
FIRST EPSS
The Exploit Prediction Scoring System: for every CVE, the probability of exploitation in the next 30 days and its percentile, scored daily. Checked every 6 hours (FIRST publishes it once a day); updated 4 hours ago.
CISA KEV
The Known Exploited Vulnerabilities catalog: the CVEs CISA has seen exploited, with the date added, the federal due date and known ransomware use. Checked every hour; updated 14 minutes ago.
OSV
Open Source Vulnerabilities: package advisories with affected version ranges and fixes, behind check your stack. Checked every 30 minutes; updated 11 minutes ago.

Each source is checked on its own schedule for what changed since the last check, and a new record is served as soon as it is stored. A record's page shows the dates its sources carry and when it was last synced; the home says how long ago the freshest source synced, or, while the first import of the NVD or the CVE List runs, how many records are stored so far. Pages are cached for five minutes, so a page can be up to five minutes behind the database.

What this site is not

Who runs it

cve.bz is run by Tarnover, the company behind Flawharbor, an open-source vulnerability management platform. The code that serves these pages is in its open core, so anyone running Flawharbor can serve their database the same way. cve.bz, its API, feeds and MCP server are covered by Flawharbor's Terms of Service and Privacy Policy.

Feeds

The newest records as RSS 2.0 at /cve/feed.rss and as JSON Feed 1.1 at /cve/feed.json, 100 records each. The list's filters apply to both:

https://cve.bz/cve/feed.rss?kev=true&severity=critical

is the critical CVEs in CISA's KEV catalog.

API

The same records as JSON: no key, cacheable for five minutes, the sources' notices in every answer. The list takes the pages' filters (q, kev, epss, severity, limit up to 100) and answers a next cursor for the page after:

GET https://cve.bz/api/public/cves?severity=critical&limit=20

One record, with its CVSS vectors, EPSS score, KEV listing, CWEs, affected products and references:

GET https://cve.bz/api/public/cves/CVE-2024-3094

Check your stack as JSON: the lockfile or SBOM itself is the body, its file name the query:

curl --data-binary @package-lock.json "https://cve.bz/api/public/check-stack?name=package-lock.json"

MCP server

Coding agents can query the same data over the Model Context Protocol at https://cve.bz/mcp (Streamable HTTP, no key), with three tools: get_vulnerability (a CVE, OSV or GHSA id), list_feed (the newest records, with the list's filters) and check_stack (a lockfile or SBOM, stored nowhere). A stack check, here or as the check_stack tool, counts against one budget per address: 10 at once, then 30 a minute; over it the API answers 429 with Retry-After and the tool an error naming the seconds to wait. Add it to an agent's MCP configuration as:

{"type": "http", "url": "https://cve.bz/mcp"}

Check your stack

Check your stack takes a lockfile (package-lock.json, poetry.lock, Cargo.lock, go.sum, Gemfile.lock) or a CycloneDX or SPDX SBOM and lists the packages the stored OSV advisories affect, with severity and fixed version. The file is matched in memory and discarded: no table, log line or cache holds it.