Know which CVEs
actually matter.
Everyone lists today's criticals. We tell you which are widespread vs niche, and what's confirmed vs inferred – so you act on the real ones.
Unauthenticated RCE in a widely-deployed reverse proxy - public PoC, no vendor patch yet. Sitting on the edge of most stacks.
Every real CVE gets this - a priority score, a plain-language decision, and the signals behind it.
Built and run by Sebastian Obara, a security engineer - independent, not vendor-funded. LinkedIn →
How it works
From noise to a decision, in four steps
Collect
22+ sources refreshed every 15 minutes - NVD, CISA KEV, EPSS, OSV, vendor advisories, GitHub PoC.
Score
One Low-to-Critical priority score plus a plain-language decision: act now, this week, or monitor.
Match
Upload package.json / requirements.txt / an SBOM, or run the Patchboard agent on your servers.
Deliver
Slack, email, RSS, webhook, Jira, or a CI/CD exit code - wherever your team already works.
Signals this week
Trending this week
Detection Coverage
Live · dailyProof, not promises. Every day we scan the pinned dependencies of popular open-source projects and show exactly which CVEs we detect, cross-checked against OSV.dev.
REST API
Query CVEs, look up a product at a version, and scan dependency manifests, SBOMs & containers for known CVEs. Interactive docs with live “try it out” and an OpenAPI schema for SDKs.
Why vuln.today
Signal, not noise.
Most feeds hand you every CVE published today and call it a day. We go further: we tell you how widespread the affected software actually is, how confident we are in the analysis, and where it ranks against everything else on your plate.
Prevalence
Widespread or niche? A CVE in software running on a handful of machines isn't the same emergency as one in something half the internet runs. We flag which is which so you don't burn a Friday night patching a library nobody uses.
Confidence
Confirmed vs inferred – we say which. Some fields come straight from NVD, CISA, or the vendor; others are our best inference when official data is thin. We label the difference instead of presenting both as equally certain.
Priority
CVSS, EPSS, CISA KEV status, public exploit availability, and patch status all feed into one priority score and a plain-language decision label – so ranking a pile of CVEs takes seconds, not a spreadsheet.
Everything in one place
One platform, from a CVE to a fix
Priority score & decisions
One Low-to-Critical priority score plus a plain-language act now / this week / monitor label.
Watchlist + alerts
Watch vendors, products and techniques; get Slack, email or webhook alerts.
Stack scan & CI/CD gate
Scan manifests / SBOMs and block a deploy on a failing exit code.
SBOM + blast radius
Import CycloneDX / SPDX; see transitive deps and what a CVE really reaches.
Patchboard fleet monitor
An agent inventories your servers and tracks their SBOMs for new CVEs.
Threat model: STRIDE
Per-CVE STRIDE breakdown and an attack-path diagram for what matters.
NIS2 & DORA triage
Map findings to compliance obligations and export the evidence.
REST API
Search, product lookup and scanning with an OpenAPI schema for your tooling.
Who it's for
Built for how you actually work
Solo developers
Watch your stack, get fix commands, ship without CVE anxiety. From $22/mo.
See plansSmall security teams
Shared watchlists, Jira, threat models and NIS2 / DORA triage in one place.
See plansMSPs & consultancies
Per-client stacks, more seats, Patchboard servers and API keys as you scale.
See plansPricing
Free to browse. Full trial. Then from $22/mo + VAT.
Start with a 7-day trial - every feature unlocked. After that, stay on Free or upgrade.
Free
$0- Browse CVEs + priority scores
- Search, tags, trends, coverage
- Weekly Signal newsletter
Basic
$22/mo- Watchlist + Slack/email alerts
- Stack scan, SBOM + CI/CD gate
- REST API access
Trending topics
Where the CVEs are landing lately - jump straight in
Latest CVEs
View all →Latest intelligence
Not just data - we write it up
Frequently asked questions
What is vuln.today?
vuln.today is an independent vulnerability-intelligence platform that tells you which CVEs actually matter. It aggregates 22+ sources and adds AI-assisted prioritization, exploitability signals and patch status.
How is it different from reading the NVD or a raw CVE feed?
We combine CVSS, EPSS, CISA KEV, public-exploit and patch signals into a single priority score and a plain-language decision label - so ranking a pile of CVEs takes seconds, not a spreadsheet.
Where does the data come from?
22+ sources, including NVD, CISA KEV, EPSS, OSV, vendor advisories and public proof-of-concept repositories, refreshed every 15 minutes.
Do you have an API?
Yes - a REST API with an OpenAPI schema for search, product lookup and scanning, available on the Basic plan and up.
Who is behind it, and can I trust the analysis?
vuln.today is independent and not vendor-funded, built by Sebastian Obara. Severity and CVSS come from authoritative sources; AI adds context and prioritization and never invents severity.
Is it free? Do I need a credit card?
Browsing is free. You get a 7-day full trial with no credit card, then stay on Free or upgrade from $22/mo.
Ready to get started?
Join security teams who track smarter, not harder. 7-day free trial, no credit card required.
Prioritization you can trust
CVSS, EPSS, KEV, and exploit signals combined into one score – no more guessing what to patch first.
Real-time alerts
Slack and email alerts the moment a CVE hits your watched tags or stack – not once a week.