Skip to main content
Skip to main content
PANOPTICON
back

CVE Resources Catalog

71 hand-picked CVE resources across 6 categories. Right tool for the right question — "what is this CVE?" / "is there an exploit?" / "what's the patch?" / "should I patch NOW?" / "who's writing about it?" / "tell me when something hits".

For the broader SecOps surface (DFIR, threat intel, malware analysis, AI sec, etc): SecOps Tools Catalog. For per-CVE lookups: CVE Lookup (NVD + CVSS + EPSS + KEV in one query).

pricing:
categories:

Showing 71 of 71

  • NVD (NIST) Free
    industry-standard wired into /dfir/cve

    NIST National Vulnerability Database. Authoritative metadata + CVSS scoring. Free API (5 req/30s anon, 50 req/30s with key).

  • CVE.org (MITRE) Free
    industry-standard

    Authoritative CVE assignment + metadata. The canonical source upstream of NVD enrichment.

  • OSV.dev (Google) Free

    Google's open-source vulnerability database. Excellent for SBOM + dependency-graph queries.

  • GitHub Advisory Database Free

    Curated advisories for npm, PyPI, Maven, NuGet, Composer, RubyGems, Cargo, Pub. Free GraphQL API.

  • OSS Index (Sonatype) Free

    Sonatype's open vulnerability index. Free REST API for component lookups.

  • Snyk Vulnerability DB Freemium

    Snyk-curated DB. Stronger metadata than NVD on package-ecosystem CVEs; free browse + paid API.

  • VulnCheck NVD++ Free

    Independent NVD mirror with faster updates and additional enrichment (CPE, CWE, EPSS). Free with signup.

  • VulDB Freemium

    Independent vuln database with exploit prices, attacker-side metadata. Limited free tier.

  • Vulners Freemium

    Aggregated vuln search across 200+ sources (NVD, Exploit-DB, Metasploit, Nessus). Free tier limited.

  • CVE Search (cveaaas) Free

    CIRCL's CVE search API. Mirrors NVD with fast queries; OSS code at github.com/cve-search.

  • cve-search (CIRCL) Open Source

    Self-hostable local CVE search engine. Imports NVD + CPE into MongoDB so sensitive queries stay on-prem. AGPL-3.0, the original project behind CIRCL's cve.circl.lu public instance (now superseded by Vulnerability-Lookup).

    source
  • GlobalCVE Open Source

    Unified CVE aggregator pulling NVD, MITRE, CNNVD, JVN, CERT-FR, Exploit-DB, CIRCL into a single search. Strong when you need to query non-English national CERTs. Self-hostable, TypeScript/Next.js.

    source
  • CVE Find Free

    Search CVE + CWE + CISA KEV + CPE with free configurable real-time email alerts (per-keyword, per-vendor/product, per-CWE, per-CVSS-range, per-KEV). Operated by tesweb SA / bexxo.

  • Red Hat CVE Database Free

    Red Hat-maintained mirror with severity + RHEL-specific impact ratings. Often more accurate than NVD for RHEL CVEs.

  • Debian Security Tracker Open Source

    Debian-maintained CVE tracker per source package. The reference for Debian/Ubuntu vuln state.

    source
  • Exploit-DB Free
    industry-standard

    Offensive Security exploit archive. PoCs, shellcodes, exploitation techniques — historical + current.

  • Metasploit Modules Open Source

    Rapid7 module DB — searchable. If a CVE has a Metasploit module, this is where to find it.

  • GitHub PoC search Free

    GitHub search for "CVE-YYYY-NNNNN poc". Many fresh PoCs land here days before official catalogs pick them up.

  • Nuclei templates Open Source

    ~9000 community templates including thousands of CVE detection templates. Detection-grade, not weaponised.

  • Packet Storm Free

    Long-running exploit + advisory archive. Older but still updated daily.

  • AttackerKB (Rapid7) Free

    Rapid7's CVE-by-CVE attacker-perspective ratings. Often has working exploitation notes earlier than NVD or KEV.

  • inTheWild.io Free

    Aggregates "in the wild" exploitation evidence per CVE — cross-referencing CISA KEV, vendor PSIRTs, and reports. RSS + JSON.

  • CISA KEV Catalog Free
    essential wired into /dfir/cve

    Known Exploited Vulnerabilities catalog. The "patch this first" list — every entry has confirmed exploitation.

  • Huntress Tradecraft Tuesday Free

    Weekly weaponised-CVE writeups. Often shows attacker behaviour observed in EDR data.

  • Microsoft MSRC Free
    essential

    Microsoft Security Response Center update guide. Patch Tuesday + out-of-band advisories. CVRF + REST API.

  • Cisco PSIRT openVuln API Free

    Cisco Product Security Incident Response Team. JSON API + advisory listing for all Cisco products.

  • Adobe Security Bulletins Free

    Adobe ASBs. Patch Tuesday + APSB releases for Acrobat, Photoshop, ColdFusion, Magento, etc.

  • Apple Security Releases Free

    macOS / iOS / iPadOS / Safari security updates. Often released without prior notice; check often.

  • Oracle Critical Patch Updates Free

    Quarterly Oracle CPU plus interim alerts. Java SE, MySQL, WebLogic, Oracle DB, etc.

  • Red Hat Security Advisories Free

    RHSAs — the canonical patch advisory for RHEL packages. CVRF feeds available.

  • Ubuntu USN Free

    Ubuntu Security Notices. JSON + RSS feeds; per-package CVE state.

  • Kubernetes CVE Feed Free

    Official Kubernetes CVE list. JSON feed; useful for K8s compliance + audit pipelines.

  • AWS Security Bulletins Free

    AWS-side CVEs (EKS, EMR, etc) plus AWS-rated impact for upstream package CVEs.

  • GCP Security Bulletins Free

    Google Cloud security bulletins. GKE, Anthos, Cloud Run vulns.

  • Azure Security Update Guide Free

    Azure-specific vuln entries within MSRC's update guide.

  • Mozilla Foundation Security Advisories Free

    Firefox / Thunderbird / NSS advisories. Per-release MFSA list + CVE mapping.

  • WPScan Vulnerability DB Freemium

    WordPress core + plugin + theme CVEs. Free browse, paid API for scanning at scale.

  • VMware Security Advisories Free

    VMSA listing. Critical for vCenter / ESXi patching cadence.

  • Fortinet PSIRT Free

    Fortinet Product Security Incident Response Team advisories. RSS + JSON.

  • Palo Alto Networks Security Advisories Free

    PAN-OS, Prisma, Cortex, GlobalProtect. CSAF JSON-formatted feed.

  • Ivanti Security Advisories Free

    Connect Secure / Policy Secure / EPM advisories. Watch closely after the 2024 mass-exploit incidents.

  • CVSS v4.0 Calculator Free
    industry-standard

    FIRST CVSS v4.0 spec + calculator. Replaces v3.1 — supports environmental + threat vector metrics.

  • EPSS (FIRST) Free
    essential wired into /dfir/cve

    Exploit Prediction Scoring System — probability that a CVE will be exploited in the next 30 days. Free API.

  • VulnCheck KEV Free

    Independent KEV catalog — earlier exploitation signals than CISA, broader source set. Free API.

  • CISA Vulnrichment Open Source

    CISA-led CVE enrichment effort — adds SSVC, CWE, CVSS, mitigations to CVEs MITRE has assigned. Daily updates on GitHub.

  • SSVC (CISA / CMU SEI) Free

    Stakeholder-Specific Vulnerability Categorization. Decision-tree replacement for raw CVSS — outputs Track / Track*/ Attend / Act.

  • Tenable VPR Paid

    Tenable's Vulnerability Priority Rating. Combines CVSS + threat intel + exploit availability. Paid product.

  • Nucleus Security KEV+ Paid

    Vendor-agnostic vuln-prioritisation platform with extended KEV signals.

  • Google Project Zero Free
    industry-standard

    In-depth vulnerability research blog. Bug tracker also public at bugs.chromium.org/p/project-zero.

  • Trend Micro ZDI Free

    Zero Day Initiative published advisories. Many CVEs originate here via Pwn2Own + responsible disclosure.

  • Mandiant Blog Free

    Mandiant (Google) advanced threat-actor + 0day research. Often first to publish detection guidance.

  • CrowdStrike Blog Free

    CrowdStrike Falcon team writeups. Strong on actor-attribution + EDR-observable behaviour.

  • Palo Alto Unit 42 Free

    Palo Alto threat intel + vuln research. Fast on mass-exploit campaigns.

  • Cisco Talos Intelligence Free

    Cisco Talos blog. Vuln research, malware analysis, weekly threat round-ups.

  • Volexity Free

    Memory-forensics + 0day research. Often discovers nation-state APT activity ahead of public disclosure.

  • Horizon3.ai Disclosures Free

    NodeZero attack-research team. Very fast publication of weaponised exploit details after CVE drops.

  • watchTowr Labs Free

    Aggressive vuln research with PoCs published days after vendor patches. Strong on edge / appliance bugs.

  • CVE Trends Free

    CVEs trending on Twitter/X right now. Useful "what is the security community panicking about today" signal.

  • VulnMon Free

    Independent CVE search engine with exploit availability indicators.

  • Patchstack (WordPress focus) Freemium

    WordPress + plugin CVE database with virtual-patch focus. More current than NVD on WP.

  • OSS-Fuzz Vulnerabilities Open Source

    Google OSS-Fuzz finds vulns in OSS daily. Issue tracker is public for fixed bugs.

    source
  • CISA Alerts Free
    essential

    CISA Cybersecurity Advisories. RSS + email. Often includes joint advisories with FBI / NSA / international CSIRTs.

  • US-CERT Feeds Free

    NCAS alert feeds (now CISA-branded). RSS for Alerts, Bulletins, Tips.

  • CISA KEV RSS Free

    KEV catalog as a JSON feed. Pull every hour to catch new entries; the cron-job hook for KEV alerting.

  • Risky Business newsletter Freemium

    Patrick Gray's weekly podcast + newsletter. Strong "what mattered this week" filter; free podcast, paid newsletter tier.

  • This Week in Security (Hackaday) Free

    Hackaday's weekly security round-up. Approachable summaries of the week's CVEs + exploits.

  • VulnMon RSS Free

    New CVE additions as RSS. Filterable by severity.

  • CVEDetails Free

    Enriched CVE browser with vendor + product trees + RSS feeds per product. Useful for "alert me when nginx has a new CVE".

  • NVD RSS feeds Free

    Daily / hourly JSON + XML feeds + RSS. The lowest-friction way to mirror NVD locally.

  • kubernetes-security-announce Free

    Official Kubernetes security announcement list. Subscribe + filter; lower noise than the full discuss list.

  • oss-security mailing list Free

    Openwall oss-security list. Coordinated disclosure for OSS vulnerabilities. Many CVEs surface here before NVD.