01 About
exploit.cc holds every record in the CVE List — published, rejected and reserved — and serves them as web pages and as an open JSON API. Nothing is behind a login, a key or a paywall, and no record is edited, summarised or scored by us.
exploit.cc is an independent project. It is not an official CVE Program property and it is not affiliated with, endorsed by or operated by the CVE Program, MITRE or CISA.
Every record originates from CVEProject/cvelistV5, the CVE Program’s own repository of CVE JSON 5 documents. The upstream document is stored byte for byte and is served back unmodified at /v1/cves/{id}/raw, so anything on a record page can be checked against its source without leaving the site.
The fields shown on a record page — description, CVSS scores and vector, CWE assignments, SSVC decision, affected products, references, solutions — are read out of that document. Severity is the one derived value: it is computed from the numeric CVSS score, never taken from upstream prose, because CNAs and their own vectors disagree often enough that the score is the only defensible authority.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities catalog, not from the CVE record. The catalog is the sole authority for the KEV badge, the date a record was added and its remediation due date.
The CVE List is polled every 15 minutes and the KEV catalog every 6 hours. A record typically lands here within one poll of being published upstream. Sync lag is the age of the newest upstream change this mirror holds — not the age of the last fetch, which would look healthy even while the feed returned nothing.
This version deliberately does a small number of things completely:
And it is honest about what it does not do yet:
CVE content is courtesy of the CVE Program (cve.org). CVE and the CVE logo are registered trademarks of The MITRE Corporation. Use of CVE records is governed by the CVE Program Terms of Use, which apply to the records reproduced here exactly as they apply upstream.
KEV catalog data is published by the Cybersecurity and Infrastructure Security Agency (CISA) and is in the public domain.
exploit.cc is not an official CVE Program property. If a record here disagrees with the record at cve.org, cve.org is correct and this mirror is stale or wrong — report it and check the raw document, which carries the digest of exactly what was ingested.