OpenCVE
v3.1.0 open-sourceThe section your link pointed to isn't on OpenCVE's page any more, so we've brought you to the top.
OpenCVE is a platform that monitors and manages CVEs by aggregating data from multiple sources and alerting users to new or updated vulnerabilities.
curl -s -H 'Accept: application/json' 'https://example.com/api/reports/E8FBU53LDW8O/alerts?page=1'
curl -s -H 'Accept: application/json' 'https://example.com/api/reports/E8FBU53LDW8O/alerts/a7098731-ddca-4a40-9b0e-e7f513ce76ad'
curl -s -H 'Accept: application/json' 'https://example.com/api/reports/E8FBU53LDW8O/alerts?page=1'
curl -s -H 'Accept: application/json' 'https://example.com/api/reports/E8FBU53LDW8O/alerts/a7098731-ddca-4a40-9b0e-e7f513ce76ad'
curl -X PUT \
"https://app.opencve.io/api/v2/organizations/acme/projects/production/subscriptions" \
-H "Authorization: Bearer $OPENCVE_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"vendors": ["python", "microsoft"],
"products": {
"apache": ["http_server", "airflow"],
"fortinet": ["fortios"]
}
}'
curl -H "Authorization: Bearer $OPENCVE_TOKEN" \
-H "Accept: application/json" \
"https://app.opencve.io/api/v2/cves?page=2&page_size=100"
curl -X PUT \
"https://app.opencve.io/api/v2/organizations/acme/projects/production/subscriptions" \
-H "Authorization: Bearer $OPENCVE_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"vendors": ["python", "microsoft"],
"products": {
"apache": ["http_server", "airflow"],
"fortinet": ["fortios"]
}
}'
curl -H "Authorization: Bearer $OPENCVE_TOKEN" \
-H "Accept: application/json" \
"https://app.opencve.io/api/v2/cves?page=2&page_size=100"
ENABLE_REGISTER: false
curl -H 'Authorization: Token <api_key>' https://<opencve_host>/api/vulnerability/?format=csv
POST /api/organizations/<org_id>/tokens/ with body {"name": "ci-bot", "scope": "organization"}
curl -X POST https://opencve.example.com/api/v1/search/products \
-H "Authorization: Bearer <TOKEN>" \
-d '{"q": "nginx"}'
opencve upgrade-db
curl -s https://opencve.example.com/api/vuln/CVE-2023-1234 | jq '.updated_at'
curl -D- https://opencve.example.com/api/vuln/CVE-2023-1234 | grep -i rate-limit
opencve search --cvssv3 NONE,CRITICAL
Summary
OpenCVE is an open-source vulnerability intelligence platform that synchronizes the CVE database from sources like MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language., NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., RedHat, and Vulnrichment, letting you search, filter, and track vulnerabilities by vendor, product, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use., or EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score. It is free to install and self-host via Docker, or you can use the hosted SaaS version at opencve.io with no setup required. It suits security and vulnerability-management teams who need to monitor specific vendors or products and get alerted by email, webhook, or Slack when relevant CVEs appear or change, with a REST API for connecting to a CMDB, SIEM, or SOAR. It sits in the vulnerability-intelligence space rather than scanning software directly, tracking exposure rather than finding it. Started in 2020, it has 29 contributors and remains active, with 155 commits and a release this week.
OpenCVE is a platform that monitors and manages CVEs by aggregating data from multiple sources and alerting users to new or updated vulnerabilities.
How OpenCVE helps
Which vendors or products in my stack have new or updated CVEs I haven't seen yet?
synchronizes CVE data from MITRE, NVD, RedHat, and Vulnrichment and alerts by email, webhook, or Slack whenever a CVE matching your subscribed vendors or products appears or changes
Which of the CVEs piling up against my stack actually need attention first?
filters the CVE database by CVSS, KEV, or EPSS score so you can separate the ones with known exploitation or high likelihood from the rest
Did a CVE I already reviewed change since I last looked at it?
keeps a history of each CVE's scores, description, and references, so a re-scored or updated entry shows up as a distinct change rather than looking untouched
What changed across all my tracked vendors and products this week?
generates reports per project summarizing new and updated CVEs, with an AI-generated summary of what to prioritize
Can my other security tools react automatically when a relevant CVE shows up?
exposes the same CVE and subscription data through a REST API and webhook notifications, so a CMDB, SIEM, or SOAR can pick up matching CVEs without someone checking manually
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for OpenCVE, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail OpenCVE puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
21 entries
No entries match these filters.
- September 20261
- August 20261
- July 20264
- June 20262
- February 20261
- January 20261
- August 20251
- January 20251
- December 20241
- December 20231
- November 20221
- January 20221
- August 20211
- June 20211
- April 20211
- January 20212
Project health
Issue, contributor and maintainer activity in opencve/opencve, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 5 −3 vs prior 12 months
- Maintainers 1 +0 joined · −0 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close 43 days first maintainer reply 3.9 days
- Open backlog 90 of 439 issues ever filed
- Issues opened / month 4 · 0 communitymaintainers
- Open backlog 90
- Contributors / month 2
- Commits / month 4
- Stars 2,830
- features 10%
- other 90%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.