CVE-20XX-?
agent?

For developers.

Everything here is free, read only and has no accounts. Be kind to it and cache what you fetch.

JSON

Same filters as the site. 50 results a page.

GET https://cve-list.com/api/cves?q=log4j&sev=CRITICAL&fix=no&kev=1&sort=new&page=1

Parameters: q, sev (CRITICAL, HIGH, MEDIUM, LOW), fix (yes or no), kev (1), major (1), cat, kind, y (year), t (time window), sort, page. Requests are rate limited.

CSV

GET https://cve-list.com/agent/cves.csv
GET https://cve-list.com/agent/cves.csv?scope=kev
GET https://cve-list.com/agent/cves.csv?ids=CVE-2026-1,CVE-2026-2
GET https://cve-list.com/agent/cves.csv?scope=all&q=openssl&days=90&limit=5000

Default is exploited, likely to be exploited or critical. scope=all is every CVE and is large. ids takes up to 300 CVE ids.

Complete lookup

Send packages, get every CVE that names them and affects that version, any severity, any year. Body is never logged or stored. Up to 1000 packages per request.

curl -X POST https://cve-list.com/agent/match -H 'Content-Type: application/json' \
  -d '{"packages": [{"name": "axios", "version": "1.13.1"}]}'

Atom feeds

Badges

One per CVE, and a counter of this week's Drop everything CVEs.

<a href="https://cve-list.com/cve/CVE-2026-109618"><img src="https://cve-list.com/badge/CVE-2026-109618.svg" alt="CVE-2026-109618 status"></a>
<img src="https://cve-list.com/badge/major.svg" alt="CVEs to drop everything on this week">

Drop everything this week

Agent files

For an AGENTS.md, one line is enough:

When asked about vulnerable dependencies, read https://cve-list.com/agent.md and follow it.

In CI

A crude example that fails the build when a package name in package-lock.json matches an exploited CVE. Name matching only, so expect false positives and review every hit.

import csv, io, json, sys, urllib.request
rows = csv.DictReader(io.StringIO(urllib.request.urlopen("https://cve-list.com/agent/cves.csv?scope=kev").read().decode()))
lock = json.load(open("package-lock.json"))
names = {k.split("node_modules/")[-1] for k in lock.get("packages", {}) if k}
hits = [r for r in rows if r["product"].split() and r["product"].split()[-1] in names]
for r in hits:
    print(r["id"], r["product"], r["url"])
sys.exit(1 if hits else 0)

Data, sources and terms