CVE Tracker CLI

CVE Tracker CLI is a curl-first vulnerability tracker. Point curl at it and get the latest CVEs, CISA Known Exploited Vulnerabilities, and EPSS scores as a colored table right in your terminal.

It is for developers, sysadmins, and security folks who want a quick look at new vulnerabilities without opening a browser or installing anything. There is no package to install: you only need curl.

This is a free community project running on free tiers. Data may lag a few minutes. Sponsors are welcome at OSS Philippines.

Prefer a web-based CVE reference or tracker? We recommend TrackCVE. Its browser-based experience also inspired this project.

Routes · Repository instructions

✨ Features

• Latest CVEs at a glance. ID, CVSS severity with color, short description, KEV flag, and EPSS score in a neat terminal table.
• Terminal CVE links. Click a CVE ID in supporting terminals to open its detail URL, or copy the curl hint to keep reading in the terminal.
• CVE details. CVSS score and vector, CWE, published and modified dates, KEV status and due date, EPSS score and percentile, affected and fixed versions, vendor solutions and workarounds, patch references, GitHub advisory data, and references. Remediation details appear when upstream sources provide them.
• CVE List V5. For CVEs in the published latest-CVE snapshot, missing descriptions, scores, and remediation details can be filled from the CVE Services API and CVEProject/cvelistV5.
• TrackCVE fallback. For CVEs already in that snapshot, TrackCVE can fill details still missing after NVD and CVE List V5, including affected versions, solutions, workarounds, and patch references. Primary-source values take precedence. The public service does not add CVEs that are absent from its NVD snapshot.
• CVE.now discovery and fallback. Recent published CVEs can be discovered through the CVE.now API, including records that have not reached NVD yet. It can also fill missing source-backed fields after NVD, CVE List V5, and TrackCVE; values already supplied by those sources take precedence. Model-generated summaries are not used as CVE descriptions.
• GitHub Security Advisories. GHSA id, ecosystem, affected package, vulnerable version range, and patched versions on the CVE page, plus /ghsa for the latest reviewed advisories.
• CISA KEV feed. The newest Known Exploited Vulnerabilities entries, with ransomware use and due dates.
• Live monitor. curl -N .../live works like tail -f and streams new CVEs and KEV entries as they appear.
• Filters. ?severity=critical, ?severity=high+, ?limit=20, and ?kev=1, also in live mode.
• Any client. Colors for curl, wget, and HTTPie; plain text for browsers and /plain; JSON with ?format=json or Accept: application/json.
• AI-friendly guide. https://cve.ossph.org/llms.txt documents the service routes, formats, data sources, and usage limits for AI agents.
• Free data sources. CVE.now for recent discovery and field fallback, NVD CVE API 2.0, CVE List V5, TrackCVE as a fallback, the CISA KEV feed, the FIRST EPSS API, and GitHub Security Advisories. No paid keys.

🚀 Getting Started

You need curl (or wget or HTTPie). Nothing else.

curl https://cve.ossph.org

You get a summary of recently published CVEs by severity, the KEV catalog size, and a table of the newest CVEs. In a terminal that supports clickable links, select a CVE ID to open its detail URL. To keep the details in your terminal, run the curl command shown below the table with that CVE ID.

📖 Usage

Routes

curl https://cve.ossph.org                    # summary and latest CVEs
curl https://cve.ossph.org/CVE-2024-3094      # details for one CVE, including GHSA when one exists
curl https://cve.ossph.org/kev                # latest CISA KEV entries
curl https://cve.ossph.org/ghsa               # latest reviewed GitHub advisories
curl https://cve.ossph.org/help               # all routes with examples

Filters

curl "https://cve.ossph.org/?severity=critical"        # one severity
curl "https://cve.ossph.org/?severity=critical,high"   # several severities
curl "https://cve.ossph.org/?severity=high+"           # high and above
curl "https://cve.ossph.org/?limit=20"                 # rows to show, max 100
curl "https://cve.ossph.org/?kev=1"                    # only CVEs listed in CISA KEV
curl "https://cve.ossph.org/kev?limit=5"               # five newest KEV entries
curl "https://cve.ossph.org/ghsa?severity=high+"      # high and critical advisories
curl "https://cve.ossph.org/ghsa?ecosystem=npm"       # one package ecosystem

/ghsa reads the public GitHub advisories API. It works without a token. A CVE detail page adds the GHSA id, ecosystem, package name, and patched version when GitHub has an advisory for that id. Details NVD does not have yet come from CVE List V5.

Live monitor

curl -N https://cve.ossph.org/live
curl -N "https://cve.ossph.org/live?severity=high+"

The connection prints a line for each new CVE or KEV entry, plus a heartbeat line so proxies keep the connection alive. On the public service the stream re-checks the cached snapshot about once a minute, closes after about two minutes, and the last line asks you to run the command again. A local bun run dev server keeps the stream open until you press Ctrl+C.

CVE Tracker CLI · live monitor, polling every 60s for 120s. Press Ctrl+C to stop.

Most recent matching CVEs:
10:15:36Z RECENT  CVE-2026-121022  CRITICAL 9.2  Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One bef…
Watching for new CVEs and KEV entries...
10:15:46Z · heartbeat, still watching
10:17:36Z · live session ended. run curl -N https://cve.ossph.org/live again to continue.

Plain text and JSON

curl https://cve.ossph.org/plain                          # no colors (also /plain/kev, /plain/ghsa, /plain/CVE-..., /plain/live)
curl "https://cve.ossph.org/CVE-2024-3094?format=json"     # JSON
curl -H "Accept: application/json" https://cve.ossph.org/kev

In JSON mode, /live streams newline-delimited JSON events (hello, cve, kev, heartbeat, and bye when the public stream closes). /ghsa and CVE details include advisory objects.

⚙️ Configuration

These environment variables apply when you run your own instance.

Variable	Default	Purpose
PORT	3000	HTTP port.
HOST	0.0.0.0	Bind address.
PUBLIC_HOST	cve.ossph.org	Host shown in /help examples.
NVD_API_KEY	none	Optional NVD API key for higher rate limits. Works without it.
LOOKBACK_DAYS	3	Days of NVD publications scanned for "latest". NVD allows at most 120 days, and longer values are capped.
CACHE_TTL_MS	600000	In-memory cache lifetime.
BACKGROUND_POLL_MS	600000	Background refresh interval.
LIVE_POLL_MS	300000	Upstream poll interval for /live.
HEARTBEAT_MS	15000	Heartbeat interval for /live.
LIVE_MAX_CLIENTS	64	Simultaneous /live connections. Extra clients get HTTP 503.
GITHUB_TOKEN	none	Optional GitHub token for higher advisory API rate limits. The public API works without it.

Without an API key, NVD allows about 5 requests per 30 seconds, so requests to NVD are spaced out automatically.

🛠️ Development

You need Bun for the toolchain and Node.js 20.10 or newer for the runtime.

git clone https://github.com/OSSPhilippines/cve-tracker-cli.git
cd cve-tracker-cli
bun install
bun run dev          # watch mode on http://localhost:3000

Try it locally:

curl localhost:3000
curl localhost:3000/CVE-2024-3094
curl -N localhost:3000/live
LIVE_POLL_MS=15000 HEARTBEAT_MS=5000 bun run dev   # faster live cycles for testing

Build, run, and validate:

bun run dev:worker   # Cloudflare Workers runtime via wrangler dev
bun run build        # compile TypeScript to dist/
bun run start        # node dist/server.js
bun run typecheck
bun test

The data layer sits behind the CveProvider interface in src/types.ts, so another runtime can supply its own implementation. Upstream reads use CVE.now for recent CVE discovery and missing-field fallback, NVD, the CVE Services API (with the cvelistV5 repository as a fallback), TrackCVE as a field-level fallback, CISA KEV, FIRST EPSS, and the GitHub advisories API.

Releases

Pushes to main run Release Build Flow Action v1.8.0. The workflow plans a version from Clean Commit history, updates CHANGELOG.md and package.json, then creates a tag and a GitHub Release when the version changes. The package stays private. The workflow does not publish to npm. With no existing tags, the first release is 0.1.0.

Pull requests into dev and main run typecheck and unit tests.

☁️ Deploy

The public service runs as a Cloudflare Worker on cve.ossph.org (account Open Source Software PH). The Worker only reads a compact snapshot and renders it. It does not call upstream feeds. A GitHub Actions job (.github/workflows/refresh.yml) builds that snapshot every 10 minutes with Bun, from CVE.now, NVD, CISA KEV, EPSS, GitHub advisories, CVE List V5, and TrackCVE as a field fallback, then writes one key to the CVE_CACHE KV namespace. The service cannot look up CVEs absent from that snapshot. You can also run the job with workflow_dispatch. Until the first write, routes answer data warming up, try again shortly.

The Worker keeps the snapshot in memory for 60 seconds and in the colo cache, so /live re-checks that cache instead of reading KV on every heartbeat. Descriptions in the public snapshot are shortened so a request stays small.

The KV namespace cve-tracker-cli-CVE_CACHE is already bound in wrangler.jsonc. The Worker is published with a route for cve.ossph.org/* on the ossph.org zone. Confirm that zone is on the same Cloudflare account. The route does not create DNS.

The deploy token needs Workers KV Storage Edit, Workers Scripts Edit, and zone Workers Routes Edit.

Add the DNS record yourself, proxied (orange cloud), for the name cve. An AAAA record pointing at 100::, or an A record pointing at 192.0.2.1, both work.

bun run dev:worker
bun run refresh-snapshot -- snapshot.json

Variable	Default	Purpose
PUBLIC_HOST	cve.ossph.org	Host shown in /help and the /live reconnect line.
LIVE_POLL_MS	60000	How often /live re-checks the cached snapshot.
HEARTBEAT_MS	15000	Heartbeat interval for /live.
LIVE_MAX_MS	120000	How long one /live stream stays open.

NVD_API_KEY, GITHUB_TOKEN, and LOOKBACK_DAYS are read by bun run dev. The refresh job reads NVD_API_KEY when that Actions secret is set. It calls the public GitHub advisory API with no token, because Actions reserves the name GITHUB_TOKEN. These are not Worker bindings.

Pushes to main run .github/workflows/deploy.yml with cloudflare/wrangler-action, alongside the release workflow. Deploy and refresh both skip when CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is unset. PORT, HOST, CACHE_TTL_MS, BACKGROUND_POLL_MS, and LIVE_MAX_CLIENTS apply to bun run dev only.

🤝 Contributing

Contributions are welcome. Read AGENTS.md before you open a pull request.

• Create a short-lived branch from dev.
• Open the pull request against dev.
• Do not push directly to dev or main.
• Use Clean Commit messages: <emoji> <type>: <description>, in lowercase present tense, with no final period.
• Run bun run typecheck and bun test before you push.
• Do not create release tags by hand. A push to main runs the release workflow described under Development.

🐛 Issues & Support

Search existing issues before you open a new issue.

Include the command you ran and the output you got. Do not include API keys or other secrets.

CVE data comes from NVD, CISA, and FIRST. Report data errors in a CVE record to those sources.

📄 License

CVE Tracker CLI is licensed under the MIT License.

Copyright (c) 2026 OSS Philippines.

👥 Authors & Contributors

Created by Waren Gonzaga under OSS Philippines, with contributions from the community.

CVE® is a registered trademark of The MITRE Corporation. This project uses NVD data but is not endorsed or certified by NVD. CVE.now also states that it is not endorsed by NVD. Verify critical details against original sources before acting. Data from CVE.now, the NVD, CVE List V5, CISA KEV, FIRST EPSS, and GitHub Security Advisories. Inspired by covid19-tracker-cli.