About this data
Where the vulnerability data comes from, how we combine it and how often it updates.
This database brings together every public source of vulnerability information and turns it into one page per vulnerability, written so that anyone can act on it.
Where the data comes from
- CVE List, the official record for every CVE, published by the CVE Program.
- NVD, which adds severity scores and the products each CVE affects.
- GitHub Advisory Database and OSV, which list the exact package versions that are affected and fixed.
- CISA Known Exploited Vulnerabilities, the catalog of flaws attackers are using right now.
- EPSS from FIRST, a daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
- Metasploit, Exploit-DB, Nuclei and public proof-of-concept code, to show whether working exploits exist.
One page per vulnerability
The same flaw often has several identifiers: a CVE, a GitHub advisory and an entry for each Linux distribution. We match them up, so every identifier leads to the same page and you never read the same flaw twice.
Plain-English summaries
Each summary, type and “who can exploit it” answer is written by a language model from the official description, then checked against the severity data where it exists. The official description is always shown in full alongside it.
Who maintains it
The database is built and maintained by sbomify, the Security Artifact Hub. The team helped shape SBOM standards and uses this same data to tell sbomify users which vulnerabilities affect the software they ship.
How often it updates
Every day. New CVEs, exploit likelihood scores and the exploited-in-the-wild catalog are refreshed overnight, and each page shows when it was last updated.
Corrections
If something on a page is wrong, the official description and the linked sources are the record. Tell us at sbomify.com and we will fix the summary.