Where the CVE data comes from
The CVE pages, the API, the MCP server and the TAXII feed draw on 21 upstreams. Each is listed here with what we take from it, its licence and what its terms say about redistribution.
Notices every copy carries
MITRE licenses CVE records on condition that its copyright designation and the licence accompany every copy, and NIST asks for its notice in any product that uses the NVD API. Both appear under every CVE page, in every API answer and in the TAXII markings.
Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE catalogue
| Source | What we take | Licence | Redistribution |
|---|---|---|---|
| CVE Program The MITRE Corporation | CVE records: identifiers, descriptions and CNA data, relayed by NVD | CVE Program Terms of Use MITRE's copyright designation and the Terms of Use licence, reproduced in every copy. | Allowed with conditions (credit, notice) |
| CVE List V5 (cvelistV5) CVE Program (The MITRE Corporation) | New CVE records minutes after publication: the CNA's description, scores, weaknesses, references, title and declared products | CVE Program Terms of Use MITRE's copyright designation and the Terms of Use licence, reproduced in every copy. | Allowed with conditions (credit, notice) |
| NVD NIST | Severity, CVSS, CWE, references, affected configurations, analysis status | Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms This product uses data from the NVD API but is not endorsed or certified by the NVD. | Allowed with conditions (credit, notice) |
| OpenCVE Amber Security SAS | Titles and copies of the SSVC decision | OpenCVE terms of service | Forbidden by the terms |
| VulnCheck VulnCheck | Affected CPE ranges of the CVEs NVD has not configured, used only to match an organization's watched stack | VulnCheck Service Terms, community tier (revision of 2026-04-20) This product uses data from VulnCheck (https://vulncheck.com). | Allowed with conditions (credit, notice) |
| CISA Vulnrichment CISA | CISA's ADP container: SSVC decisions, CVSS, CWE, CPE | CC0-1.0 | Allowed |
Exploitation evidence
| Source | What we take | Licence | Redistribution |
|---|---|---|---|
| CISA KEV CISA | Known exploited status, date added, due date, required action, ransomware use | CC0-1.0 (cisagov/kev-data) | Allowed |
| CISA KEV (GitHub mirror) CISA | The same KEV catalogue read from CISA's GitHub mirror (CC0) every 15 minutes, between two nightly runs | CC0-1.0 (cisagov/kev-data) | Allowed |
| Exploit-DB OffSec | Public exploit identifiers | Exploit-DB terms of service | Forbidden by the terms |
| GCVE CIRCL (GCVE) | Exploitation assertions from other catalogues (Shadowserver, Previdian…) | GCVE dump terms (preserve source attribution) Exploitation assertions from GCVE (CIRCL), each with the catalogue that published it. | Allowed with conditions (credit, notice) |
| Nuclei templates ProjectDiscovery | Whether a public Nuclei detection template exists for the CVE | MIT Detection templates from ProjectDiscovery nuclei-templates (MIT). | Allowed with conditions (credit, notice) |
| PoC-in-GitHub nomi-sec | Public proof-of-concept repositories | CC0-1.0 | Allowed |
| ZeroDayClock zerodayclock.com | Exploit timing, frozen since the service closed (2026-09-16) | No licence published (Content-Signal: use=reference) | The terms say nothing |
Affected packages
| Source | What we take | Licence | Redistribution |
|---|---|---|---|
| GitHub Advisory Database GitHub | GitHub advisory identifiers, each linked | CC-BY-4.0 GitHub Advisory Database (CC BY 4.0), with a link to each advisory. | Allowed with conditions (credit, notice) |
| OSV.dev Google (OSV.dev), from each ecosystem's own database | Affected packages and fixed versions, per ecosystem | Per record: the licence of the ecosystem that published it, carried in each row's sourceLicense where one is served Affected packages from OSV.dev, under each record's own licence. | Allowed with conditions (credit, notice) |
Vendor and national advisories
| Source | What we take | Licence | Redistribution |
|---|---|---|---|
| CERT-FR ANSSI (CERT-FR) | Advisories and alerts that name the CVE, with their link | Licence Ouverte / Open Licence 2.0 (Etalab) Source: CERT-FR (ANSSI), with the date of last update. | Allowed with conditions (credit, notice) |
| CISA ICS advisories (CSAF) CISA | ICS advisories (CSAF): affected products and fixes | Public domain (US Government work) | Allowed |
| Microsoft MSRC Microsoft | Microsoft's exploited flag and title | Microsoft terms of use (personal and non-commercial use) | Forbidden by the terms |
| Red Hat Product Security (CSAF and VEX) Red Hat | Red Hat advisories and VEX statements | CC-BY-4.0 Security data from Red Hat Product Security (CC BY 4.0). | Allowed with conditions (credit, notice) |
| Siemens ProductCERT (CSAF) Siemens | Siemens ProductCERT advisories | TLP:WHITE (commercial use and redistribution granted) | Allowed |
Scores
| Source | What we take | Licence | Redistribution |
|---|---|---|---|
| FIRST EPSS FIRST | The daily exploitation probability (EPSS) | EPSS terms of use (free use, attribution requested) EPSS scores from FIRST.org (https://www.first.org/epss). | Allowed with conditions (credit, notice) |
Sources served against their terms
These publishers' terms forbid or restrict what we do with their data. We serve it anyway and flag it wherever it appears: in the API's attribution block, in the TAXII markings and on this page.
Exploit-DB
You agree not to reproduce, duplicate, copy, sell, resell, or exploit any portion of the Service, use of the Service, or access to the Service without The Exploit Database…
Microsoft MSRC
Unless otherwise specified, the Services are for your personal and non-commercial use. You may not modify, copy, distribute, transmit, display, perform, reproduce…
OpenCVE
[You may not] provide access to (except for Users), distribute, sell (except for Resellers) or sublicense the Service to a third party, use the Service to develop a similar or competing…
VulnCheck
§7: Customer may not make the Services Data available for free or under an open source or similar license. §12: a free offering may be used in a product only with a visible attribution notice, in its interface and in its outputs; no AI model training.
Owner decision (2026-10-31): nothing is removed, everything is flagged. These values are redistributed under an isMalicious decision, not under a licence from their publisher.
Manifest updated 2026-11-01. The same list, machine-readable, free and without a key: GET /cve/attribution