Public API

Free, unauthenticated JSON API. No rate limits. Updated every 4 hours by GitHub Actions.

Endpoints

All vulnerabilities

GET https://vulnfeed.it/vulns.json

Returns an array of all vulnerability objects tracked in the last 30 days (~10,000+ entries). No authentication required.

Individual CVE page

GET https://vulnfeed.it/cve/{CVE-ID}.html

Human-readable page for a specific CVE with explainer text, severity, CVSS, EPSS, affected products, fix command, and references.

RSS feed

GET https://vulnfeed.it/feed.xml

RSS 2.0 feed of the latest vulnerabilities. Subscribe in any feed reader.

Vendor RSS feeds

GET https://vulnfeed.it/vendor/{vendor}.xml

Per-vendor RSS feeds. Available vendors: kubernetes, nginx, openssl, cisco, fortinet, vmware, ubuntu, debian, and more — see the vendor index.

Embeddable badges

GET https://vulnfeed.it/badge/critical-count.svg
GET https://vulnfeed.it/badge/new-today.svg

SVG badges for embedding in READMEs or dashboards. Updated every 4 hours.

 

Data schema

Each object in vulns.json has the following fields:

Field	Type	Description
id	string	CVE ID (e.g. CVE-2024-1234) or advisory ID (USN-xxx, DSA-xxx)
title	string	Short human-readable title
description	string	Full vulnerability description
severity	string	CRITICAL / HIGH / MEDIUM / LOW / UNKNOWN
score	number|null	CVSS v3 base score (0.0–10.0)
epss	number|null	EPSS exploitation probability (0–1)
epss_pct	number|null	EPSS percentile (0–100)
source	string	Data source: NVD, Ubuntu, Debian, Microsoft, Cisco, Fortinet, etc.
published	string	ISO 8601 publish date
url	string	Canonical advisory URL
badge	string	"ACTIVELY EXPLOITED" if in CISA KEV catalog, else empty
poc	bool	true if a public PoC exploit exists on GitHub
patch	bool|null	true = patch available, false = no fix, null = unknown
fix	string	Shell command to apply the fix (e.g. apt-get install --only-upgrade nginx)
affected	array	List of affected package/product strings
references	array	List of reference URLs
_new	bool	true if this entry is new since yesterday's snapshot
_trending	bool	true if EPSS score jumped ≥5pp since yesterday

Usage examples

curl + jq

# All critical CVEs
curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.severity=="CRITICAL")]'

# CVEs with public exploits
curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.poc==true)] | sort_by(-.score)'

# Top 10 by EPSS score
curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.epss!=null)] | sort_by(-.epss) | .[:10]'

# New CVEs since yesterday
curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(._new==true)]'

# Actively exploited
curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.badge=="ACTIVELY EXPLOITED")]'

Python

import urllib.request, json

with urllib.request.urlopen("https://vulnfeed.it/vulns.json") as r:
    vulns = json.load(r)

critical = [v for v in vulns if v.get("severity") == "CRITICAL"]
exploited = [v for v in vulns if v.get("badge") == "ACTIVELY EXPLOITED"]
print(f"{len(critical)} critical, {len(exploited)} actively exploited")

Embed a badge

Copy into any GitHub README or Markdown document:

[![critical CVEs](https://vulnfeed.it/badge/critical-count.svg)](https://vulnfeed.it)
[![new today](https://vulnfeed.it/badge/new-today.svg)](https://vulnfeed.it)

Data sourced from NVD, CISA KEV, Ubuntu Security Notices, Debian Security Announcements, Red Hat, Microsoft MSRC, Cisco, Fortinet, Juniper, Kubernetes, Exploit-DB, OSS-Security, GitHub Advisory Database, and OSV. Updated every 4 hours.