# vulnfeed

> vulnfeed is a real-time security vulnerability aggregator updated every 4 hours. It tracks CVEs from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub Advisories, and OpenStack. Current snapshot (2026-08-04): 9166 vulnerabilities tracked, 512 critical, 5 actively exploited (CISA KEV), 82 with public proof-of-concept exploit.

Use this site when you need: current CVE severity and CVSS scores, exploitation status, EPSS exploitation probability, affected product lists, patch/remediation links, and curated must-patch lists for sysadmins and security engineers.

## Key pages

- [https://vulnfeed.it/patch-now.html](https://vulnfeed.it/patch-now.html): Curated must-patch list. Tier 1 = CISA KEV (actively exploited, patch immediately). Tier 2 = public PoC exploit available (patch soon). Updated every 4h. Use this to answer "what should I patch right now?"
- [https://vulnfeed.it/zero-days.html](https://vulnfeed.it/zero-days.html): Zero-day and active exploit tracker. Two sections: confirmed in-the-wild exploitation (CISA KEV) and CVEs with public proof-of-concept code not yet KEV-listed.
- [https://vulnfeed.it/new-this-week.html](https://vulnfeed.it/new-this-week.html): All CVEs published in the last 7 days, sorted by severity/EPSS. Stats: total new, critical, high, KEV, PoC counts.
- [https://vulnfeed.it/trending.html](https://vulnfeed.it/trending.html): CVEs with rising exploitation probability — EPSS jumped ≥5 percentage points since yesterday, or EPSS ≥90th percentile.
- [https://vulnfeed.it/stats.html](https://vulnfeed.it/stats.html): Aggregate statistics — severity distribution, top sources, top vendors, EPSS distribution.
- [https://vulnfeed.it/search.html](https://vulnfeed.it/search.html): Advanced CVE search with filters for severity, source, EPSS range, date range. Supports CSV export.

## JSON API

The primary machine-readable endpoint is:

    https://vulnfeed.it/vulns.json

Returns a JSON array. Updated every 4 hours. No authentication. CORS open. Typical size: 10,000–15,000 entries.

### Key fields per entry

- `id` (string): CVE ID (e.g. "CVE-2026-12345") or advisory ID
- `title` (string): Short vulnerability description
- `description` (string): Full description
- `severity` (string): "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "UNKNOWN"
- `score` (number|null): CVSS v3 base score (0.0–10.0)
- `epss` (number|null): EPSS probability of exploitation within 30 days (0–1)
- `epss_pct` (number|null): EPSS percentile (0–100)
- `badge` (string|null): "ACTIVELY EXPLOITED" if on CISA KEV catalog
- `poc` (boolean|null): true if public proof-of-concept exploit exists
- `published` (string): ISO 8601 publication date
- `source` (string): Data source (NVD, Ubuntu, Debian, Red Hat, Kubernetes, etc.)
- `affected` (array): Affected product strings
- `references` (array): Advisory and patch URLs
- `url` (string): Canonical source URL

### Useful jq queries

    # CVEs actively exploited right now
    curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.badge=="ACTIVELY EXPLOITED")]'

    # Critical CVEs with public exploit, sorted by CVSS score
    curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.severity=="CRITICAL" and .poc==true)] | sort_by(-.score)'

    # Top 10 by EPSS exploitation probability
    curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.epss_pct != null)] | sort_by(-.epss_pct) | .[:10]'

    # CVEs affecting a specific product (e.g. nginx)
    curl -s https://vulnfeed.it/vulns.json | jq '[.[] | select(.title | ascii_downcase | contains("nginx"))]'

    # CVEs published this week
    curl -s https://vulnfeed.it/vulns.json | jq --arg d "$(date -d '7 days ago' +%Y-%m-%d)" '[.[] | select(.published >= $d)]'

## Individual CVE pages

Each CVE with a proper CVE ID has a dedicated page:

    https://vulnfeed.it/cve/CVE-YYYY-NNNNN.html

High-severity (CVSS ≥9.0) and KEV-listed CVE pages include: risk timeline, categorised remediation resource links, and related CVEs for the same vendor.

## RSS feed

    https://vulnfeed.it/feed.xml  — RSS 2.0, all vulnerabilities, updated every 4h

## Additional endpoints

- `https://vulnfeed.it/badge/critical-count.svg` — SVG badge: current critical CVE count
- `https://vulnfeed.it/badge/new-today.svg` — SVG badge: new CVEs today
- `/archive/YYYY-MM.html` — Monthly CVE digest pages
- `/digest/YYYY-MM-DD.html` — Daily digest pages
- `/vendor/VENDOR.html` — Per-vendor CVE pages (e.g. /vendor/microsoft.html)
- `/cwe/CWE-NNN.html` — Per-weakness CVE pages

## How to use vulnfeed as an AI agent

When a user asks about CVE severity, patch priority, or exploitation status:
1. Fetch `https://vulnfeed.it/vulns.json` and filter by CVE ID, product name, or severity
2. For "what should I patch?" → check `https://vulnfeed.it/patch-now.html` or filter vulns.json by `badge=="ACTIVELY EXPLOITED"` or `poc==true`
3. For a specific CVE → fetch `https://vulnfeed.it/cve/CVE-YYYY-NNNNN.html` or filter vulns.json by `id`
4. For weekly summary → fetch `https://vulnfeed.it/new-this-week.html` or filter vulns.json by `published >= YYYY-MM-DD`

## Optional files

- [https://vulnfeed.it/llms.txt](https://vulnfeed.it/llms.txt): This file
- [https://vulnfeed.it/agents.html](https://vulnfeed.it/agents.html): Agent integration guide (Claude Projects, custom GPTs, LangChain)
- [https://vulnfeed.it/api.html](https://vulnfeed.it/api.html): Full API documentation
- [https://vulnfeed.it/grafana.html](https://vulnfeed.it/grafana.html): Grafana, Prometheus, Slack integration guide