Free to reuse · CC BY 4.0
Open vulnerability data
The 390,007 records behind our vulnerability database, free for anyone: JSON, CSV and RSS, no key and no sign-up. Use it in your own tools, reports and dashboards. All we ask is a credit and a link back.
API
Plain HTTPS GET, JSON by default, cached for an hour at the edge, open to any origin (CORS).
Everything on CISA’s Known Exploited Vulnerabilities list, with CVSS, EPSS odds, ransomware use and our categories. Add ?format=csv for a spreadsheet.
Any record in the database by CVE number.
Every record for a plugin (or /wordpress/theme/<slug>) by its wordpress.org slug. ?format=csv works here too.
Totals, the year-by-year record, products, every exploited flaw and the latest severe ones.
Feeds
RSS for any feed reader, Slack or Teams channel, or monitoring tool.
What’s in it
- The whole National Vulnerability Database, every year, synced twice a day, with the credit for each record (Wordfence, Patchstack, WPScan, the vendors themselves).
- CISA’s Known Exploited Vulnerabilities: which flaws attackers are using, since when, and which ransomware groups use.
- FIRST’s EPSS: the odds each CVE is exploited in the next 30 days, updated daily.
- Ours: plain-language titles, a small-business category, the WordPress plugin or theme each record belongs to, and normalized vendor names.
License and credit
The compilation is offered under Creative Commons Attribution 4.0. Credit it as “Huttenlocher Technologies vulnerability database” with a link to huttenlochertech.com/vulnerabilities. The underlying NVD and CISA data are U.S. government works; EPSS is FIRST’s, used under its terms. It’s provided as is: check the linked record before acting on a detail.
Building something bigger, or need a higher volume? Tell us about it.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.