Vulnetix
Try Vulnetix Request Demo

The right vulnerability data.
Where your decisions happen.

The most comprehensive collation of vulnerability and exploit intelligence in the world, with 160+ databases aggregated into one normalised, enriched API. Delivered through CLI, REST API (OpenAPI v2, GA), and AI coding agents. Free community tier.

Try the Console

What's in the VDB

Vulnerability Intelligence

Aggregated from CVE.org, NVD, EUVD, Google OSI, OSV, GitHub Security Advisories, VulDB, and 150+ more sources. Every CVE enriched with CVSS v2/v3/v4, EPSS, SSVC, and KEV status.

Exploit Intelligence

18+ exploit sources including ExploitDB, Metasploit, GitHub PoCs, and NVD. Know which vulnerabilities have working exploits before you triage.

Fix Intelligence

Patch availability, vendor advisories, and remediation guidance correlated across all vulnerability sources.

Package Risk

Search packages across npm, PyPI, Maven, RubyGems, crates.io, Go modules, NuGet, and more. Identify malicious packages, version ranges, and safe upgrade paths.

Scorecards

OpenSSF Scorecard integration for open source project security health scoring.

SOC Detection Content

Snort/Suricata IDS/IPS rules, YARA signatures, Nuclei templates and MITRE ATT&CK technique chains, generated from exploit intelligence and ready for the SOC pipeline.

Vulnerability Data Sources

Comprehensive coverage from government agencies, security organisations, and ecosystem-specific advisories, aggregated, normalised, and enriched in real time. Every record keeps its upstream identifier, so a finding always traces back to the authority that published it.

OSV.dev

Largest vulnerability data source

Open Source Vulnerabilities aggregator including GitHub Security Advisories, PyPA, RustSec, and Global Security Database.

  • GitHub Security Advisories
  • PyPA vulnerabilities
  • RustSec database
  • Global Security Database

VulnCheck Community

USA-centric

NIST NVD and CISA KEV catalog with daily CVE updates stored locally for instant enrichment.

  • NIST NVD database
  • CISA KEV catalog
  • Daily CVE updates
  • Browser-based enrichment

CVE.org

Global standard

Official MITRE CVE Records in CVE JSON 5.0 format. Authoritative, but fewer than 1% of known vulnerabilities ever get a CVE record.

  • CVE JSON 5.0 format
  • Official CVE records
  • VEX production support
  • Real-time checking

MITRE CWE

Attack vector analysis

Common Weakness Enumeration with automatic integration for weakness classification and attack vectors.

  • Weakness classification
  • Attack vector analysis
  • Mitigation strategies

CISA

USA critical infrastructure

Known Exploited Vulnerabilities catalog and Vulnrichment data from the US cybersecurity agency.

  • Known Exploited Vulnerabilities (KEV)
  • Vulnrichment data enrichment

GitHub Security Advisory

Open source

Comprehensive vulnerability information from GitHub's curated security advisory ecosystem.

  • Ecosystem-specific advisories
  • GHSA identifiers without a CVE

Python Software Foundation

Python ecosystem

Python ecosystem-specific vulnerability information including PyPI packages and interpreter issues.

  • Python interpreter vulnerabilities
  • Community security research

RustSec Advisory Database

Rust ecosystem

Rust ecosystem vulnerability database with crate advisories and memory safety analysis.

  • Crate advisories
  • Memory safety analysis

Go Security Advisory

Go ecosystem

Go vulnerability database with module advisories and standard library security information.

  • Go module advisories
  • Standard library security

OSS-Fuzz

Dynamic analysis

Google's continuous fuzzing discoveries with memory safety vulnerabilities and automated bug detection.

  • Memory safety vulnerabilities
  • Open source security analysis
  • Early vulnerability detection

OpenSSF Malicious Packages

Supply chain security

Malicious package database identifying supply chain threats and registry violations.

  • Malicious package detection
  • Registry violation identification
  • Package integrity assessment

Linux Distribution Security

Linux kernel and distros

Comprehensive coverage of Debian, Ubuntu, Alpine, and AlmaLinux security advisories.

  • Distribution-specific remediation
  • Container security analysis
  • Cloud infrastructure security

Advanced Scoring Systems

Multi-dimensional risk assessment with predictive analytics. Severity alone does not rank work: every record carries the prediction and weakness scores that decide what gets fixed first. This exploit-aware enrichment is the evidence layer under Continuous Threat Exposure Management (CTEM) and Risk-Based Vulnerability Management (RBVM), exposure scored by real-world exploitability rather than raw CVSS.

FIRST.org

Exploit Prediction Scoring System (EPSS) and Common Vulnerability Scoring System (CVSS) standards.

  • EPSS scoring system
  • CVSS v2/v3/v4 severity ratings

Coalition ESS

Coalition Exploit Scoring System providing Exploit Availability and Usage Probability analysis.

  • Exploit Availability Probability (EAP)
  • Exploit Usage Probability (EUP)

CWSS

Common Weakness Scoring System, a developer-friendly scoring system focused on code weaknesses rather than deployed vulnerabilities.

  • Code weakness assessment
  • Implementation complexity metrics

SSVC

Stakeholder-Specific Vulnerability Categorization, an infinitely customisable policy-based prioritisation system.

  • Customisable decision trees
  • Context-aware scoring

AI-Powered Intelligence Extraction

Upstream advisories describe a vulnerability in a paragraph of English. Machine learning turns that paragraph into the fields triage needs: affected functions, version ranges, fix commits, and a prediction of whether anyone will exploit it.

Affected functions extraction

AI extracts function names from vulnerability descriptions to enable precise reachability analysis and cut false positives.

Example: Extracts parseXML() from the description for targeted code analysis

Version range intelligence

Smart parsing of vulnerable and fixed version ranges from natural-language descriptions, giving accurate vulnerability windows.

Example: Converts "fixed in 2.1.3" to the semantic range >=2.1.3

Git commit hash detection

Identifies and extracts git commit hashes from advisories, linking straight to the security fix.

Example: Finds "commit abc123f" and links to the actual code change

Remediation advice generation

Context-aware guidance generated from your technology stack, the vulnerability type, and your organisational policies.

Example: Suggests the specific configuration change for your environment

Pix assistant triage

Triage assistant that analyses vulnerabilities, writes investigation notes, and recommends prioritisation for your environment.

Example: Analyses exploitability and business impact automatically

Vulnetix LEV

Likely Exploited Vulnerabilities (LEV) predicts exploitation likelihood beyond traditional scoring systems.

Example: Predicts exploitation probability from attack vectors, vulnerability age, and threat-actor intelligence

Advanced Processing Capabilities

What runs on every record before it reaches the API.

Syntax pattern extraction

NLP extracts structured data from unstructured vulnerability descriptions.

  • Function signatures
  • Version constraints
  • Configuration parameters
  • File paths and locations

Multi-scoring integration

Unified scoring framework with automatic CVSS/CWSS/EPSS/ESS integration.

  • Custom score overrides
  • Temporal scoring
  • Environmental adjustments
  • Confidence indicators

Vulnerability timeline

Automated lifecycle tracking from discovery to remediation.

  • Discovery timestamps
  • Disclosure timeline
  • Fix availability
  • Patch deployment status

Smart URL categorisation

Automatic classification and validation of advisory and reference URLs.

  • Vendor advisories
  • Proof-of-concept code
  • Technical details
  • Mitigation resources

SOC / Detection Engineering

Turn a CVE into deployable defence. Pull detection content straight from the VDB, or ingest the free per-ecosystem STIX feeds into your SIEM, firewall, EDR or CTI platform, no licence, refreshed every 15 minutes.

$ vulnetix vdb snort-rules get CVE-2024-3094    # Snort/Suricata rules (also: list)
$ vulnetix vdb yara-rules get CVE-2024-3094     # YARA signatures (also: list)
$ vulnetix vdb attack-techniques CVE-2024-3094  # MITRE ATT&CK chain
$ vulnetix vdb exploits CVE-2024-3094 -o json   # Snort/YARA/Nuclei/Metasploit/ExploitDB/PoCs

Free STIX 2.1 threat-intel feeds (malicious DNS + URLs): Generic DNS STIX · Generic URLs STIX · per-ecosystem feeds →

Supported Ecosystems

npm PyPI Maven RubyGems crates.io Go modules NuGet Composer Hex SwiftPM Conan Alpine Debian Ubuntu RHEL Amazon Linux Windows macOS Android iOS

Pricing

Community: Free

  • 100 queries / week (unauthenticated)
  • 10,000 queries / week with free API key
  • Full VDB access: all endpoints
  • CLI, API, and AI Coding Agent support
  • No credit card required

Get free API key →

Pro: $25 / month

  • 120 requests / minute
  • Priority support
  • Higher rate limits
  • Usage dashboard
  • Billing portal

Enterprise

  • Custom rate limits
  • SLA guarantees
  • Dedicated support
  • On-premise options
  • Data residency

Contact us →

API: OpenAPI v2 (GA)

The REST API is generally available at v2, a single, stable, fully documented OpenAPI surface. Browse it interactively, download the machine-readable spec, or fetch it from the CLI.

Authentication is optional, the API serves unauthenticated callers on a shared pool. For a free Community key (higher limits), sign in once from the CLI and it stores the credential for you:

$ vulnetix auth
Approve this login: https://www.vulnetix.com/cli-login-code?user_code=XXXX-YYYY

$ vulnetix vdb vulns --package lodash

Or just run /vulnetix:get-api-key in the Pix AI coding-agent plugin. Register (FREE API key) →

Access Methods

Open Console → Get Free API Key →