PAGES
← all tools
◆ Vulnerability Management

OpenCVE

v3.1.0 open-source

OpenCVE is a platform that monitors and manages CVEs by aggregating data from multiple sources and alerting users to new or updated vulnerabilities.

Summary

OpenCVE is an open-source vulnerability intelligence platform that synchronizes the CVE database from sources like MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language., NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., RedHat, and Vulnrichment, letting you search, filter, and track vulnerabilities by vendor, product, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use., or EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score. It is free to install and self-host via Docker, or you can use the hosted SaaS version at opencve.io with no setup required. It suits security and vulnerability-management teams who need to monitor specific vendors or products and get alerted by email, webhook, or Slack when relevant CVEs appear or change, with a REST API for connecting to a CMDB, SIEM, or SOAR. It sits in the vulnerability-intelligence space rather than scanning software directly, tracking exposure rather than finding it. Started in 2020, it has 29 contributors and remains active, with 155 commits and a release this week.

OpenCVE is a platform that monitors and manages CVEs by aggregating data from multiple sources and alerting users to new or updated vulnerabilities.

How OpenCVE helps

Which vendors or products in my stack have new or updated CVEs I haven't seen yet?

synchronizes CVE data from MITRE, NVD, RedHat, and Vulnrichment and alerts by email, webhook, or Slack whenever a CVE matching your subscribed vendors or products appears or changes

Which of the CVEs piling up against my stack actually need attention first?

filters the CVE database by CVSS, KEV, or EPSS score so you can separate the ones with known exploitation or high likelihood from the rest

Did a CVE I already reviewed change since I last looked at it?

keeps a history of each CVE's scores, description, and references, so a re-scored or updated entry shows up as a distinct change rather than looking untouched

What changed across all my tracked vendors and products this week?

generates reports per project summarizing new and updated CVEs, with an AI-generated summary of what to prioritize

Can my other security tools react automatically when a relevant CVE shows up?

exposes the same CVE and subscription data through a REST API and webhook notifications, so a CMDB, SIEM, or SOAR can pick up matching CVEs without someone checking manually

all 20 features, with the evidence for each →

Languages

Not documented

Features

20 capabilities across 3 capability groups

Built from OpenCVE's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What OpenCVE offers you

  • Outbound webhooks (the product notifies you)2
  • REST API2
  • Role-based access control2
  • Administrative audit log1
  • Command-line interface1
  • Scheduled jobs1
  • Scripting API1
  • Web management console1
REST API 1 feature Interfaces and integrations since 2021
REST API integration shipped Exposes a REST API so external systems such as CMDBs, SIEMs, SOARs, and ITSM platforms can consume vulnerability data and trigger workflows programmatically. 7 releases · 4 other sources · first seen Apr 2021

Shared capability: REST API

Also counts toward: REST API, Scripting API

release 7 total

  • GET /api/v2/ endpoints now available with OpenAPI documentation and support for scoped API tokens v3.1.0 · Aug 2026 · source · release history
  • Organization API tokens now accept access_mode and granular scopes fields to restrict token capabilities v3.1.0 · Aug 2026 · source · release history
  • Adds REST API v2 with OpenAPI documentation and scoped tokens for integrations. v3.1.0 · Aug 2026 · source · release history
  • Adds CSV export capability for filtered vulnerabilities via the UI or API for external reporting and processing v2.4.0 · Feb 2026 · source · release history
  • Add API ratelimit headers/limits v1.1.0 · Apr 2021 · source · release history
  • Return API datetimes in ISO8601 format v1.1.0 · Apr 2021 · source · release history

docs

  • Alerts API GET /reports/<string:link>/alerts List the alerts of a report. Parameters: page (optional, default: 1): the page to start Example request: GET /api/reports/E8FBU53LDW8O/alerts HTTP/1.1 Host: example.com Accept: application/json Example response: HTTP/1.1 200 OK [{ id :… docs update · Jul 2026 · source
  • The OpenCVE REST API lets your own tools interact with OpenCVE programmatically. Connect it to your CMDB, inventory, ITSM, SOAR, SIEM, or internal scripts to build vulnerability workflows that fit the way your team already works. docs update · Jul 2026 · source

example

  • Export filtered vulnerability data for offline analysis or integration with external ticketing systems. curl -H 'Authorization: Token <api_key>' https://<opencve_host>/api/vulnerability/?format=csv v2.4.0 · Feb 2026 · source
  • Monitor API usage to stay within rate limits imposed by the new ratelimit feature curl -D- https://opencve.example.com/api/vuln/CVE-2023-1234 | grep -i rate-limit v1.1.0 · Apr 2021 · source
Outbound webhooks (the product notifies you) 1 feature Interfaces and integrations since 2021
Automations engine shipped Lets users build CVE workflows by combining triggers, conditions, and actions such as notifications, assignments, status changes, and webhooks. 5 releases · 1 other source · first seen Jun 2021

Shared capability: Outbound webhooks (the product notifies you)

Also counts toward: Outbound webhooks (the product notifies you)

release

  • Alert automations react to matching CVEs and execute configurable actions including notifications, assignments, status changes, or webhooks. v3.0.0 · Jun 2026 · source · release history
  • Introduces Automations engine to configure alert and report workflows using triggers, conditions, and actions v3.0.0 · Jun 2026 · source · release history
  • Default report and alert automations are created automatically during project onboarding. v3.0.0 · Jun 2026 · source · release history
  • New Automations engine lets teams define CVE workflows with triggers, conditions, and actions (notifications, assignments, status changes, webhooks). v3.0.0 · Jun 2026 · source · release history
  • Adds opencve upgrade-db command to apply migrations including the pg_trgm extension and GIN indexes on cves.summary and cves.cve_id v1.2.0 · Jun 2021 · source · release history

example

  • Upgrade the database schema and enable full-text search capabilities using trigram indexes. opencve upgrade-db v1.2.0 · Jun 2021 · source
Multi-factor authentication 1 feature Identity and access since 2021
User and access administration shipped Lets administrators reset user MFA and disable public self-registration to control who can create accounts on a self-hosted instance. 4 releases · 3 other sources · first seen Jan 2021

Shared capability: Multi-factor authentication

release

  • Administrators can now reset user MFA. v3.0.0 · Jun 2026 · source · release history
  • New ENABLE_REGISTER setting allows administrators to disable new user signups. v3.0.0 · Jun 2026 · source · release history
  • Adds ENABLE_REGISTER environment variable to disable new user signups v3.0.0 · Jun 2026 · source · release history
  • Displays the is_confirmed field in users list v1.0.1 · Jan 2021 · source · release history

example

  • Disable public self-registration on a self-hosted instance to lock down new account creation. ENABLE_REGISTER: false v3.0.0 · Jun 2026 · source
  • Check if a user account has been confirmed by viewing the users list. View the `is_confirmed` column in the users list table v1.0.1 · Jan 2021 · source
  • Access admin functions directly from your user menu in the UI. Click the 'admin' link in the user menu v1.0.1 · Jan 2021 · source
Other / not yet classified 17 features Features we have not matched to a capability yet. A suggested match is marked.
CVE enrichment and data exposure shipped Surfaces enriched CVE details including NVD CPE configurations and versioned enrichment data through the CVE detail view and API. 11 releases · first seen Dec 2023

release 11 total

  • Exposes NVD CPE configurations in CVE API response v3.0.0 · Jun 2026 · source · release history
  • NVD CPE configurations now exposed in the CVE API response. v3.0.0 · Jun 2026 · source · release history
  • OpenCVE Enrichment versioning added to CVE details. v3.0.0 · Jun 2026 · source · release history
  • Adds a new Mitre tab within the CVE details page's affected vendors and products section displaying associated MITRE data v2.4.0 · Feb 2026 · source · release history
  • Adds truncated display with see more toggle for long MITRE tables and CVE descriptions in the CVE details interface v2.4.0 · Feb 2026 · source · release history
  • Displays OpenCVE Enrichment data in CVE details v2.2.0 · Aug 2025 · source · release history
Organization management shipped Provides organization management pages with tabs for member role management and an audit log of changes. 5 releases · 2 other sources · first seen Dec 2024

Also counts toward: Administrative audit log, Role-based access control

release

  • Extends organization audit logs to cover automations, CVE comments, and project membership changes. v3.1.0 · Aug 2026 · source · release history
  • Organization audit logs now record events for automations, CVE comments, and project membership changes v3.1.0 · Aug 2026 · source · release history
  • Redesigned organization pages with tabs, member role management, and audit logs. v3.0.0 · Jun 2026 · source · release history
  • Adds support for Organizations and Projects to isolate subscriptions (vendors and products) and organize notifications v2.0.0 · Dec 2024 · source · release history
  • The v2 is a complete refactoring requiring a new instance setup; existing v1 data and configuration are not directly compatible without migration. v2.0.0 · Dec 2024 · source · release history

docs

  • Access Control OpenCVE uses a role-based access control system with two levels: organization and project . This model helps teams collaborate safely: you control who can manage the organization, who can create projects, and who can work on CVEs inside each project, without giving everyone full access to everything. seen Aug 2026 · source

example

  • View the project members panel to assign roles and control access. In the dashboard, navigate to the project's Settings tab and open the Members view. v3.1.0 · Aug 2026 · source
CVE tracking and triage shipped Lets teams track CVEs across projects, assign review statuses, and hold discussions through comments. 3 releases · 1 other source · first seen Jan 2026

release

  • Comments now supported in CVE tracking. v3.0.0 · Jun 2026 · source · release history
  • Project vulnerabilities can be filtered by multiple statuses simultaneously, or by vulnerabilities without any status. v3.0.0 · Jun 2026 · source · release history
  • Add CVE tracking with assignee and status management v2.3.0 · Jan 2026 · source · release history

docs

  • Vulnerability intelligence platform that aggregates CVEs from multiple sources and lets teams filter, track, and manage them by vendor, product, and severity.
Notification channels shipped Sends CVE alerts through configurable delivery channels and includes a test action to verify that a channel is working correctly. 4 releases · first seen Dec 2024

Also counts toward: Outbound webhooks (the product notifies you)

release

  • Test notification action and notification type picker modal for verifying delivery channels. v3.0.0 · Jun 2026 · source · release history
  • SSRF blocked in webhook and Slack notification channels. v3.0.0 · Jun 2026 · source · release history
  • Add Slack notifications support v2.3.0 · Jan 2026 · source · release history
  • Adds webhook support to integrate OpenCVE notifications into external systems and workflows v2.0.0 · Dec 2024 · source · release history
Report automations shipped Delivers scheduled daily or weekly CVE digest reports with configurable conditions, CVSS summaries, and optional AI-generated summarization. 4 releases · first seen Jan 2026

Also counts toward: Scheduled jobs

release

  • Enhanced reports dashboard widget for at-a-glance digest tracking. v3.0.0 · Jun 2026 · source · release history
  • Report automations deliver daily or weekly CVE digests with configurable conditions and timezone support. v3.0.0 · Jun 2026 · source · release history
  • Reports now include CVE and CVSS summaries plus weekly AI-generated summarization. v3.0.0 · Jun 2026 · source · release history
  • Add AI-powered report summarization using user-provided LLM v2.3.0 · Jan 2026 · source · release history
Activity dashboard shipped View recent activities related to user subscriptions on a dedicated dashboard with configurable pagination. 4 releases · first seen Aug 2021

release

  • Adds a new Statistics view displaying aggregated CVE data metrics within the OpenCVE interface. v2.1.0 · Jan 2025 · source · release history
  • Dashboard now displays all recorded activities instead of only subscription changes. v1.3.0 · Jan 2022 · source · release history
  • Introduces a new dashboard showing the last activities of your subscriptions v1.2.1 · Aug 2021 · source · release history
  • Adds activities_per_page setting to opencve.cfg to control the number of activities displayed per page v1.2.1 · Aug 2021 · source · release history
Enhanced CVE search and indexing shipped suggested Perform full-text searches on CVE summaries and identifiers using trigram indexes for improved performance. 3 releases · 1 other source · first seen Jun 2021

Suggested capability: Vulnerability database matching. This is our guess, not confirmed.

Also counts toward: Command-line interface, REST API

release

  • Adds the Advanced Search feature for CVE queries, enabling complex filtering beyond basic lookups. v2.1.0 · Jan 2025 · source · release history
  • POST /api/v1/search/products endpoint allows searching products without a vendor filter. v1.3.0 · Jan 2022 · source · release history
  • Adds opencve upgrade-db command to apply migrations including the pg_trgm extension and GIN indexes on cves.summary and cves.cve_id v1.2.0 · Jun 2021 · source · release history

example

  • Upgrade the database schema and enable full-text search capabilities using trigram indexes. opencve upgrade-db v1.2.0 · Jun 2021 · source
Organization-scoped API tokens shipped Restrict API token permissions to a specific organization boundary with configurable access modes and scopes. 2 releases · 1 other source · first seen Feb 2026

release

  • Adds access mode and fine-grained scopes to organization API tokens, enabling tighter permission control on existing org-level tokens. v3.1.0 · Aug 2026 · source · release history
  • Adds organization-scoped API tokens to restrict token permissions to a specific organization boundary v2.4.0 · Feb 2026 · source · release history

example

  • Create an API token that only has access to data within your specific organization, isolating it from other tenants. POST /api/organizations/<org_id>/tokens/ with body {"name": "ci-bot", "scope": "organization"} v2.4.0 · Feb 2026 · source
Project-level access control shipped Enforce role-based access control at the project level with specific member roles and ACLs for CVE views and dashboards. 3 releases · first seen Aug 2026

Also counts toward: Role-based access control, Web management console

release

  • Adds project-level access control with membership roles and enforced ACLs across CVE views and dashboard widgets. v3.1.0 · Aug 2026 · source · release history
  • Project members management UI enables assigning specific roles to users within a project v3.1.0 · Aug 2026 · source · release history
  • Adds project members management UI for administering per-project roles. v3.1.0 · Aug 2026 · source · release history
MITRE weakness browsing shipped Provides a searchable browser for MITRE CWE weakness entries kept in sync within the tool. 2 releases · 1 other source · first seen Aug 2025

release

  • MITRE weaknesses synced with improved browsing and search. v3.0.0 · Jun 2026 · source · release history
  • Supports new project and cwe keywords in advanced search v2.2.0 · Aug 2025 · source · release history

example

  • Navigate to the new MITRE integration section on a CVE page to view associated tactics and techniques without scrolling through massive tables. In the Console, go to any CVE detail page and click the 'Mitre' tab in the affected vendors and products section v2.4.0 · Feb 2026 · source
CVSS scoring configuration shipped suggested Lets users choose which CVSS version is used for scoring when setting up a project. 2 releases · first seen Nov 2022

Suggested capability: Vulnerability prioritization. This is our guess, not confirmed.

release

  • CVSS version selection added to the onboarding flow. v3.0.0 · Jun 2026 · source · release history
  • Increases performance by adding database indexes on the reports and alerts tables (requires running upgrade-db) v1.4.0 · Nov 2022 · source · release history
Listings filtering shipped Lets users filter notification and report listings to locate specific entries more quickly. 1 release · 1 other source · first seen Jan 2021

release

example

  • Filter CVE lists to show only those with no CVSS v3 score or the highest severity. opencve search --cvssv3 NONE,CRITICAL v1.0.2 · Jan 2021 · source
Vendor browsing shipped Lets users browse vendors with results loading incrementally rather than triggering full page reloads. 1 release · 1 other source · first seen Jan 2022

release

example

  • Find CVEs related to a product like nginx where the vendor is not explicitly linked or known. curl -X POST https://opencve.example.com/api/v1/search/products \ -H "Authorization: Bearer <TOKEN>" \ -d '{"q": "nginx"}' v1.3.0 · Jan 2022 · source
Backend infrastructure configuration shipped Configure Redis-based task locking, SMTP SSL usage, and analytics inclusion via configuration file settings. 2 releases · first seen Nov 2022

release

  • Adds start_tls setting to SMTP configuration for the scheduler component. v2.1.0 · Jan 2025 · source · release history
  • Adds celery_lock_url, include_analytics, reports_cleanup_days, and smtp_use_ssl settings to opencve.cfg for Redis-based task locking, analytics inclusion, automated report retention, and SMTP SSL control v1.4.0 · Nov 2022 · source · release history
CVE tagging and subscriptions shipped Associate custom tags with CVEs for organization and manage user subscriptions to specific CVEs via a dedicated API endpoint. 2 releases · first seen Jun 2021

release

  • Adds tags feature allowing association of tags with CVEs and users v1.2.0 · Jun 2021 · source · release history
  • Adds new API endpoint for managing user subscriptions v1.2.0 · Jun 2021 · source · release history
Multi-dashboard support shipped Create and manage multiple distinct dashboards to organize vulnerability monitoring views. 1 release · first seen Feb 2026

release

  • Adds Multiple dashboards support allowing users to create and manage several distinct dashboards for organizing vulnerability monitoring v2.4.0 · Feb 2026 · source · release history
Automated report lifecycle management shipped Automatically retain or remove historical CVE digest reports based on configurable time periods. 1 release · first seen Nov 2022

release

  • Adds celery_lock_url, include_analytics, reports_cleanup_days, and smtp_use_ssl settings to opencve.cfg for Redis-based task locking, analytics inclusion, automated report retention, and SMTP SSL control v1.4.0 · Nov 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for OpenCVE, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail OpenCVE puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

21 entries

  1. September 20261
  2. August 20261
  3. July 20264
  4. June 20262
  5. February 20261
  6. January 20261
  7. August 20251
  8. January 20251
  9. December 20241
  10. December 20231
  11. November 20221
  12. January 20221
  13. August 20211
  14. June 20211
  15. April 20211
  16. January 20212
    Show

    21 entries

    Project health

    Issue, contributor and maintainer activity in opencve/opencve, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 5 −3 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 43 days first maintainer reply 3.9 days
    6. Open backlog 90 of 439 issues ever filed
    1. Issues opened / month 4 · 0 communitymaintainers
    2. Open backlog 90
    3. Contributors / month 2
    4. Commits / month 4
    5. Stars 2,830
    Issue themes, last 12 months
    • features 10%
    • other 90%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →