Vulnerability Database

Live CVE intelligence for researchers and engineers — ranked by real exploitation signals. The vulnerabilities most likely to be exploited (EPSS), those confirmed actively exploited (CISA KEV), and recent advisories across every major package ecosystem. Look up any CVE at /vulnerability/CVE-YYYY-NNNNN.

—

CISA KEV — actively exploited

—

Added to KEV (last 30 days)

798

High exploitation risk (EPSS > 90%)

—

Ransomware-linked CVEs

Know the ID? Go straight to /vulnerability/CVE-2021-44228 or any CVE / GHSA.

0 vulnerabilities are confirmed actively exploited in the CISA KEV catalog, with 0 added in the last 30 days. 798 CVEs carry an EPSS exploitation probability above 90%. 0 KEV entries are linked to known ransomware campaigns.

Exploitability quadrant

EPSS × CVSS · CISA KEV CVEs

Actively-exploited CVEs by likelihood × impact. Top-right = patch first.

100 CISA KEV (actively-exploited) CVEs plotted by exploitation likelihood (EPSS, x-axis) against impact (CVSS, y-axis). 0 sit in the top-right "patch first" zone — at least 50% EPSS probability and CVSS 7.0+ — making them the highest-priority vulnerabilities to remediate.

Severity of recent advisories

Critical5(9%)

High29(52%)

Medium20(36%)

Low2(4%)

Of 56 recent advisories across major ecosystems: 5 critical, 29 high, 20 medium, and 2 low severity.

CISA KEV additions per month

newly confirmed-exploited

Timeline feed briefly unavailable.

Exploitability landscape

all scored CVEs · EPSS bands

How likely the CVE universe is to be exploited (log scale).

Across all CVEs with an EPSS score: 798 are ≥ 90%, 3,543 are 50–90%, 13,024 are 10–50%, 351,405 are < 10% likely to be exploited within 30 days. The landscape is heavily skewed — the vast majority fall below 10%, so EPSS is effective at isolating the small set of genuinely high-risk CVEs.

Recent vulnerabilities by ecosystem

stacked by severity

CriticalHighMediumLow

Recent advisory volume per package ecosystem, each bar split into critical/high/medium/low. npm shows the most recent activity (8 advisories). Covers npm, PyPI, Go, Maven, RubyGems, crates.io, and NuGet.

How fresh is this vulnerability data?

It updates throughout the day. When CISA flags a vulnerability as actively exploited, or a new advisory lands for an npm or PyPI package, it shows up here the same day — usually within the hour. Exploitation-probability (EPSS) scores refresh daily.

What is the CISA KEV (Known Exploited Vulnerabilities) catalog?

It's the US government's list of vulnerabilities that attackers are actively exploiting in the real world — not theoretical risks, but ones with confirmed attacks behind them. Federal agencies are required to patch anything on it by a deadline. If a CVE is on this list, treat it as urgent.

What does an EPSS score actually tell me?

EPSS is a probability: the chance a vulnerability will actually be exploited in the next 30 days, from 0 to 100%. It cuts through the noise — most CVEs are never exploited, and EPSS helps you spot the small handful that likely will be, so you can fix those first.

CVSS, EPSS, KEV — what's the difference, and which matters?

They answer different questions. CVSS tells you how damaging a vulnerability would be if exploited (severity, 0–10). EPSS tells you how likely it is to be exploited soon. KEV tells you it already is. A scary CVSS score on its own doesn't mean you're in danger — pair it with a high EPSS or a KEV listing and you know what to patch today.

Which package ecosystems are covered?

All the major ones — npm, PyPI, Go, Maven, RubyGems, crates.io (Rust) and NuGet — plus everything else tracked by OSV, and vendor software CVEs from the National Vulnerability Database. If a CVE or GitHub advisory exists, you can pull it up here.

How do I look up a specific CVE?

Just add the ID to the address: o3.security/vulnerability/CVE-2021-44228, for instance. GitHub (GHSA) advisory IDs work the same way. You'll get the severity, which packages and products are affected, whether it's being exploited, and how to fix it — all on one page.

Where does the data come from?

From the sources security teams already trust: OSV and the GitHub Advisory Database for open-source packages, the National Vulnerability Database for vendor software, CISA's KEV catalog for active exploitation, and FIRST.org for EPSS. O3 brings them together and adds reachability analysis, so you can see which of these actually reach your code.

Find these CVEs in your own code

O3 Security's Impact-Aware SCA correlates every CVE against your dependency graph and confirms whether the vulnerable code path is actually reachable — so you patch what matters, not the whole list.

Impact-Aware SCA

Vulnerability Database

Exploitability quadrant

Severity of recent advisories

CISA KEV additions per month

Exploitability landscape

Recent vulnerabilities by ecosystem

Recently disclosed (last 7 days)

Trending by exploitation probability (EPSS)

Recently added to CISA KEV (confirmed exploited)

Recent vulnerabilities by ecosystem

Find these CVEs in your own code