CVE Tracker

Look up and filter public CVEs from your AI assistant, with CVSS scores, CISA KEV and EPSS. Free, open source, no API key.

Auf trackcve.app ansehen

Gehosteter MCP-Server

npx add-mcp 'https://api.trackcve.app/v1/mcp'

Installiert in Claude Code, Codex, Cursor und mehr

Dokumentation

CVE Tracker

CVE Tracker is a free, open-source website that tracks every public CVE (Common Vulnerabilities and Exposures record). It shows how many CVEs are published over time, lists the newest first, and has a page for every CVE with its CVSS scores, CISA known-exploited status, EPSS exploit probability, affected products and links to the primary sources. No account, no ads, no tracking.

When to use this

  • Look up one CVE. Open https://trackcve.app/cve/CVE-2021-44228 with any CVE id: description, scores from the assigner, CISA and NVD, KEV entry, EPSS, CWE, affected versions, references. Send Accept: text/markdown (or add .md) for a Markdown version.

  • See what was published recently. https://trackcve.app/ with a period (?range=24h, 7d, 30d, month, year…), severity (?severity=CRITICAL,HIGH), known exploited only (?kev=true), a vendor or product (?vendor=Microsoft&product=Windows 11), a package ecosystem (?ecosystem=npm), a weakness (?cwe=CWE-79), the CNA that assigned it (?assigner=GitHub_M) or a search (?q=openssl).

  • Follow new CVEs. Every filter has an Atom feed: https://trackcve.app/feed.xml with the same parameters (/feed.xml?severity=CRITICAL&kev=true); sort=kevAdded follows CVEs as CISA adds them to KEV instead. https://trackcve.app/kev lists the latest additions.

  • Embed a CVE's status. https://trackcve.app/badge/CVE-2021-44228.svg is a badge with its severity, score and KEV status, for a README or a ticket.

  • Use the data in code. A public read-only JSON API at https://api.trackcve.app/v1 (/v1/cves, /v1/cves/{id}, /v1/cves/{id}/epss, /v1/timeline, /v1/summary, /v1/vendors, /v1/products, /v1/ecosystems, /v1/cwes, /v1/assigners, /v1/stats), and any filter as CSV or JSON from /v1/export, rate limited to 120 requests a minute per address. Full reference: https://trackcve.app/api; OpenAPI 3.1 description: https://api.trackcve.app/v1/openapi.json.

  • Give an AI assistant the data. A free Model Context Protocol server at https://api.trackcve.app/v1/mcp (Streamable HTTP, no key), with tools to search CVEs (search_cves), read one in full (get_cve), count them over time (get_timeline), profile a vendor or weakness (get_vendor, get_weakness), and read the weekly digest, statistics and rising EPSS. How to connect a client: https://trackcve.app/mcp.

Do not use CVE Tracker for: vulnerability scanning of your own systems, patch management, or legal advice. It shows public data as published, without warranty; always check the primary source.

Data

About

Built and maintained by Jan Szotkowski as an independent open-source project (MIT license): https://github.com/janszotkowski/cve-tracker. Not affiliated with MITRE, NIST, CISA, FIRST or GitHub. English only.

Pages