Data sources & licences
vuln.mlab.sh aggregates public vulnerability data. Each source below keeps its own
licence, and some ask for a specific notice. When you reuse our data, the
source's licence travels with it: the API returns the same list
under sources.
Sources
| Source | What we use | Licence / terms |
|---|---|---|
| NVD (NIST) | CVSS scores and vectors, CWE, CPE configurations, references. | NVD terms of use |
| CVE Program | CVE identifiers and records (CVE JSON 5.x), used when NVD has not analysed a CVE yet. | CVE terms of use |
| OSV.dev | Package advisories and affected version ranges, for package search and SBOM scans. | CC BY 4.0, unless an upstream database states otherwise |
| GitHub Advisory Database | GHSA advisories, received through OSV.dev. | CC BY 4.0 |
| EPSS by FIRST | Probability of exploitation in the next 30 days, and its percentile. | Free use, attribution to FIRST.org |
| CISA KEV | Known exploited vulnerabilities, date added and remediation deadline. | CC0 1.0 |
| ENISA EUVD | EUVD identifiers and the EU known-exploited list. | Reuse with acknowledgement of ENISA |
| ETDA Threat Group Cards, via actors.mlab.sh | Threat actors documented exploiting a CVE, on CVE pages. | CC BY-NC-SA 4.0, non-commercial only |
| CIRCL, Red Hat, vendor CSAF feeds, national CERTs | Fallback CVE records, vendor fix status and advisories, each linked to its origin. | Per publisher, cited on the record |
Required notices
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE® is a registered trademark of The MITRE Corporation.
Package advisory data from OSV.dev and the GitHub Advisory Database is licensed under CC BY 4.0. vuln.mlab.sh normalises and enriches it; those changes are ours, the underlying data is theirs.
EPSS scores by FIRST.org.