Terms of use

CVEminer looks up CVE and GitHub Security Advisory (GHSA) identifiers in public vulnerability sources, joins what they publish into one record per vulnerability and shows where each value came from. Records are stored when someone first looks them up, or in batches of newly published advisories, and are refreshed from upstream over time. CVEminer analysts may correct records and add their own analysis; edited sections are marked.

Most of what you see on a record comes from these sources, and their terms still apply when you reuse it:

• OSV and the GitHub Advisory Database: CC BY 4.0. Reuse requires attribution to the source.
• CVE.org CVE records, including CISA's enrichment: the CVE Terms of Use.
• CISA KEV catalog: a U.S. government work in the public domain.
• FIRST EPSS: published free by FIRST; credit FIRST when you reuse the scores.
• NVD, used only as a fallback score: this product uses data from the NVD API but is not endorsed or certified by the NVD.

Analyses written by CVEminer analysts (root cause, vulnerable functions, remediation and detection) are CVEminer's work. You're welcome to quote them with a link to the record; ask us before republishing them in bulk.

CVEminer is provided as is, without warranty of any kind. Upstream sources can be incomplete, late or wrong, they can disagree with each other, and normalisation can introduce errors of its own. A missing entry doesn't mean a package is safe, and a listed fix doesn't guarantee you're protected.

Verify before acting. Check the vendor's advisory or the CNA's record before making security decisions. To the extent the law allows, CVEminer isn't liable for losses that result from relying on its data.

You can browse, search, link to and cite CVEminer freely. Please don't:

• Get around the rate limits: 20 lookups of new IDs per 10 minutes per network, and 5 contact messages per hour. Each new lookup calls up to eight upstream services on your behalf.
• Crawl or scrape the site or API at a rate that degrades it for others. For regular or bulk access, ask us first.
• Attack, probe or overload the service, or try to reach the admin area without permission.
• Send spam, abuse or automated messages through the contact form.
• Present CVEminer's records or analyses as a source's official statement, or as your own work.

We may block networks that break these rules, without notice.

The JSON API at /api/vulnerabilities/{id} is covered by these terms. It's free, needs no key and is offered without a service level: fields, limits and availability may change. The API reference describes the current behaviour.

CVE® is a registered trademark of The MITRE Corporation. GitHub, OSV, CISA, FIRST and NVD are names of their respective owners, used here only to identify the sources of the data. None of them endorses CVEminer.

We may update these terms; the date at the top shows when they last changed. How we handle personal data is described in the privacy notice. Questions: info@cveminer.com.