Credits

The data on cve.bz is its sources', under their terms. These are the sources, their licenses and the notices they ask for.

NVD

The NIST National Vulnerability Database: descriptions, CVSS vectors and scores, CWE ids, affected products and references, under the NVD's terms of use.

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE List

The CVE Program's CVE List: the CVE records as their CNAs publish them, under the CVE Program's terms of use. This site is not affiliated with the CVE Program or MITRE.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

CWE

MITRE's Common Weakness Enumeration: the name and short description of each weakness, shown as MITRE wrote them, under the CWE terms of use. A weakness's common name (such as Cross-site Scripting beside CWE-79) is one of the alternate terms MITRE lists for it, the first in the role Common-Name; an entry MITRE deprecated is marked so, without the “DEPRECATED:” its name starts with, and links the entries MITRE's mapping notes suggest instead.

CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. Please contact cwe@mitre.org if you require further clarification on this issue.

By accessing information through this site you (as “the user”) hereby agrees the site and the information is provided on an “as is” basis only without warranty of any kind, express or implied, including but not limited to implied warranties of merchantability, availability, accuracy, noninfringement, or fitness for a particular purpose. Use of this site and the information is at the user’s own risk. The user shall comply with all applicable laws, rules, and regulations, and the data source’s restrictions, when using the site.

FIRST EPSS

Exploitation probabilities and percentiles from FIRST's Exploit Prediction Scoring System, used as FIRST asks: with this credit to EPSS and FIRST.

CISA KEV

CISA's Known Exploited Vulnerabilities Catalog, a work of the US government in the public domain. Its use here implies no endorsement by CISA.

OSV

Package advisories from OSV (Open Source Vulnerabilities), gathered from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, each under its database's license: CC BY 4.0 or CC0 1.0. This site shows an advisory's id, summary, severity, affected packages, version ranges and fixed versions, and links each to its OSV page.

Public exploits

Links to public exploit code, from three indexes; only each entry's link, title and date are kept, and no exploit code is fetched or served:

The Exploit Database, by OffSec: its index (files_exploits.csv) is under the GPL-2.0, and only its facts are read.
Rapid7's Metasploit Framework module metadata, under the BSD-3-Clause license.
ProjectDiscovery's nuclei templates, under the MIT license.

The notices in every answer

The JSON API, the MCP server and the agent guide carry these under attribution:

This product uses the NVD API but is not endorsed or certified by the NVD.
EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss
Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0
CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program.
Public exploits: links to the Exploit Database (https://www.exploit-db.com, by OffSec; index under GPL-2.0), Rapid7's Metasploit Framework modules (https://github.com/rapid7/metasploit-framework, BSD-3-Clause) and ProjectDiscovery's nuclei templates (https://github.com/projectdiscovery/nuclei-templates, MIT). Only the links, titles and dates are stored; no exploit code is fetched or served.
CWE names and descriptions: MITRE's Common Weakness Enumeration (https://cwe.mitre.org), Copyright © 2006–2026, The MITRE Corporation, under the CWE terms of use (https://cwe.mitre.org/about/termsofuse.html). CWE is a trademark of The MITRE Corporation.

Not affiliated with the CVE Program, MITRE, NIST, FIRST, CISA, OSV, OffSec, Rapid7 or ProjectDiscovery. More on the sources and how fresh they are: About.