Skip to content

Every advisory behind a CVE, in one record.

Search a CVE or GHSA ID. CVEminer resolves the CVE to its GitHub advisories, pulls the matching data from OSV, GitHub, CVE.org and CISA, and joins it into one page: affected packages and PURLs, fixed versions and patch commits, scores and exploitation status, with the source of every value.

Try

CVEminer in numbers

Records in CVEminer
107
Known exploited
12
Critical severity
21
With a published fix
97

These counts cover records already in CVEminer, not every CVE ever published. A record joins the database when someone first looks up its ID, or with a batch of new advisories and known-exploited CVEs.

Vulnerabilities everyone remembers

The nicknames are the community's. The records behind them are the full CVEminer view, with every GitHub advisory attached.

  • Log4ShellCVE-2021-44228

    JNDI lookups in Log4j 2 turned a log line into remote code execution.

    Critical10.0Known exploited

  • React2ShellCVE-2025-55182

    Unsafe deserialisation in React Server Components let requests run code on the server.

    Critical10.0Known exploited

  • Next.js middleware bypassCVE-2025-29927

    A spoofed internal header skipped middleware entirely, including auth checks.

    Critical9.1

  • xz backdoorCVE-2024-3094

    A maintainer-planted backdoor in xz/liblzma targeting OpenSSH authentication.

    Critical10.0

  • HTTP/2 Rapid ResetCVE-2023-44487

    Stream resets at line rate took down HTTP/2 servers across every major stack.

    Medium6.9Known exploited

  • Spring4ShellCVE-2022-22965

    Data binding in Spring MVC exposed the class loader and enabled code execution.

    Critical9.8Known exploited

  • IngressNightmareCVE-2025-1974

    Unauthenticated configuration injection in the ingress-nginx admission controller.

    Critical9.8

  • Text4ShellCVE-2022-42889

    Apache Commons Text interpolation evaluated attacker-controlled script lookups.

    Critical9.8

Published in the last 30 days

The newest advisories reviewed by the GitHub Advisory Database. Opening one builds its full CVEminer record.

See recently updated records
  1. CVE-2026-102989GHSA-qx66-fv34-fjm8
    TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

    npm package@tanstack/start-server-coreand 3 more

    Critical9.3
  2. CVE-2026-102682GHSA-hqm2-cfx2-2vgh
    Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

    PyPI packagepipecat-ai

    Medium5.6
  3. CVE-2026-94603GHSA-2cvf-wqm6-wr9g
    Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

    Go packagegithub.com/containers/podmanand 1 more

    Critical10.0
  4. CVE-2026-102832GHSA-jwrc-gm9j-263p
    JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

    PyPI packagejupyterlaband 2 more

    Medium4.2
  5. CVE-2026-103028GHSA-wwv9-g5x4-966q
    SFTPGo source-side file-pattern filter bypass during copy operations

    Go packagegithub.com/drakkan/sftpgo/v2

    Medium4.3
  6. CVE-2026-86063GHSA-pq7j-f95f-qfcv
    Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

    npm package@anthropic-ai/claude-code

    High7.5
  7. CVE-2026-95838GHSA-rp3h-jf77-q9p4
    containerd: Unpack DoS via repeated opaque whiteouts

    Go packagegithub.com/containerd/containerd/v2and 1 more

    Medium4.6
  8. CVE-2026-85747GHSA-685w-q87j-wqw3
    Distribution: Client `manifests.Get()` does not verify returned content against requested digest

    Go packagegithub.com/docker/distributionand 1 more

    Medium6.8
  9. CVE-2026-84994GHSA-x586-xvc8-g7q6
    Qwik: Crashing any Qwik Server via Resource thenable

    npm package@builder.io/qwikand 1 more

    High8.7
  10. CVE-2026-95837GHSA-p7v4-vr35-mj6f
    containerd CRI plugin: Checkpoint restore bypasses destination security context

    Go packagegithub.com/containerd/containerd/v2

    High7.8

How a lookup works

CVEminer doesn't copy whole databases in advance. The first time anyone searches an ID, it runs these five steps live and shows each one as it happens. Everyone after that gets the stored record straight away.

Read the full pipeline, with real examples

  1. Step 1: Resolve aliases

    CVEminer asks OSV and the GitHub Advisory Database which GitHub advisories (GHSAs) carry the CVE. Some CVEs have several, and the reviewed one becomes the headline. Unreviewed GHSAs that OSV doesn't carry are found through GitHub.

  2. Step 2: Fetch the advisory

    The OSV record and the GitHub advisory are fetched together: affected packages and version ranges, PURLs, CVSS vectors, weaknesses (CWEs), credits and references.

  3. Step 3: Enrich

    CVE.org adds the CNA's record and CISA's SSVC decision. The CISA KEV catalog says whether it's exploited in the wild, FIRST EPSS estimates how likely exploitation is, and GitHub supplies the diff of each fix commit.

  4. Step 4: Check and normalise

    Scores are computed from their vectors, PURLs are validated against the purl-spec, git tags that aren't versions are dropped, and the commit that patches the bug is kept apart from the commit a release was tagged on.

  5. Step 5: Store and serve

    The record is cached in MongoDB and refreshed from upstream after 24 hours. Analysts correct PURLs and add intelligence, and every value keeps its source, so you can see what came from where.

What you get on every record

The examples come from the stored record for Log4Shell.

Both IDs in the headline
The CVE and its GitHub advisory side by side, each linked to its source. When a CVE has several GHSAs, you can switch between them.
Example: CVE-2021-44228GHSA-jfh8-c2jp-5v3q
Scores with the vector decoded
Every CVSS vector the sources publish, with each metric spelled out. When a source ships only a vector, CVEminer computes the score from it.
Example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC, KEV and EPSS
CISA's SSVC decision points from CVE.org, the KEV listing with its required action and due date, and FIRST's probability of exploitation.
Example: Exploitation: active. Automatable: yes. Technical impact: total.
Affected packages with PURLs
Each package with its ecosystem, vulnerable ranges and a Package URL you can paste into a scanner or SBOM query. PURLs CVEminer had to build are labelled Derived.
Example: pkg:maven/org.apache.logging.log4j/log4j-core
Fixed versions and patch commits
The versions that fix it, the commits that patch it and the files each one changed, with release-tag commits listed separately.
Example: 2.15.0, 2.12.2, 2.3.1
References grouped by type
Fixes, advisories, reports, exploits and write-ups in separate groups, instead of one long list of links.
Example: Fixes, Advisories, Exploits and evidence, Package, Other links
Data provenance
Every section names the source it came from and links the upstream API, so you can check the raw data yourself.
Example: Severity from GitHub. SSVC from CVE.org. KEV from CISA.

Questions people ask

More on sources, licences and the API is on the About page.

Where does the data come from?
From public sources: OSV, the GitHub Advisory Database, CVE.org (including CISA's enrichment of CVE records), the CISA Known Exploited Vulnerabilities catalog and FIRST EPSS. NVD is used only when no other source has a CVSS score. Every record names the source of each section. The data sources table lists what each one supplies and its licence.
How fresh is it?
Any CVE or GHSA ID is fetched live the first time anyone looks it up, and new GitHub-reviewed advisories and CISA known-exploited CVEs are added in batches. After that a record is served from CVEminer's store and re-fetched from its sources once it's more than 24 hours old, so upstream changes show up within a day. The list of newly published advisories on the home page is refreshed every hour.
Why do some PURLs say “Derived”?
OSV publishes a Package URL for most packages, but not all. When it doesn't, CVEminer builds one from the ecosystem and package name following the purl-spec rules and labels it Derived. Treat a derived PURL as a well-formed guess and check it against your package manager before you rely on it. A PURL an analyst has checked is labelled Verified.
What does a locked intelligence block mean?
Root cause analysis, remediation guidance and detection rules are written by CVEminer analysts, not pulled from a feed. Vulnerable functions come from GitHub when it lists them, otherwise from an analyst. A locked block means nobody has written that part for this vulnerability yet. Selecting it opens a request with the ID filled in; requests are prioritised by severity and demand.
Is there an API?
Yes. GET /api/vulnerabilities/{id} returns the same record as JSON for any CVE or GHSA ID, with CORS enabled. IDs that aren't in CVEminer yet count towards a limit of 20 new lookups per 10 minutes per network. The API reference has the fields, status codes and an example.
How do I report a mistake?
Use the contact form with the topic “Report a data error”. Include the ID, the field that's wrong and a link to a source that shows the right value. An analyst makes the correction, and the record shows that it was edited.

Need a deeper analysis?

CVEminer analysts write root cause analyses, vulnerable-function maps, remediation steps and detection rules for specific vulnerabilities. Tell us which one matters to you.

Request an analysisBrowse the database