VulnpatchCVE data that shows its sources

One record per CVE from MITRE, NVD, OSV, GitHub Advisories, EPSS, CISA KEV and nixpkgs security issues, stating which sources answered and what is still missing.

Get Started

API Reference

Open the CVE database

One dossier per CVE

Canonical description, severity, affected packages, fixed versions and typed references in a single JSON document.

Provenance you can check

Every source consulted is listed with what it returned and an integrity hash, so a reader can tell agreement from assumption.

Gaps stated, not hidden

A dossier distinguishes a source that found nothing from one that could not be reached, and says what would close each gap.

Nixpkgs coverage

Where a CVE stands in nixpkgs, read from the nixpkgs security issues on GitHub, and an OSV feed for nixpkgs, which OSV.dev does not publish.

Built for agents

Stable error codes, next-action hints, an agent manifest and llms.txt, so an agent can act on a record without scraping a page.

Many ecosystems

OSV advisories across 38+ ecosystems, including npm, PyPI, Go, Debian and Ubuntu, alongside the CVE record itself.