About the Author
Meet the cybersecurity expert behind this comprehensive vulnerability database analysis
Comprehensive analysis of publicly disclosed security vulnerabilities. Track, analyze, and protect your systems using the world's leading vulnerability intelligence sources.
We analyzed and ranked 7 of the most comprehensive and authoritative vulnerability intelligence sources for security professionals
Advanced real-time vulnerability monitoring platform with machine learning for attack vector prediction. Provides detailed analytics on CVE-exploit relationships and threat intelligence.
The official U.S. government vulnerability database managed by NIST. Contains the most complete collection of CVE entries with CVSS scores, impact information, and patch references.
The original vulnerability cataloging program created in 1999. Manages the CVE identifier system and coordinates CNA (CVE Numbering Authorities) worldwide.
Largest commercial vulnerability database with over 200,000 entries, including non-CVE vulnerabilities. Integrates data from dark web and closed sources for comprehensive threat intelligence.
European database with emphasis on timeliness and accuracy. Provides exploit information, patches, and cybercriminal activity related to vulnerabilities.
New official CVE program portal with improved search and navigation. Provides access to complete CVE catalog and CNA program information.
Comprehensive vulnerability management platform with emphasis on compliance standards. Includes risk assessment tools, patch tracking, and reporting for audits.
Current data on the growth and distribution of cyber threats across industries and vulnerability types
18% increase compared to 2022
CVSS score ≥ 7.0 (High or Critical)
From CVE publication to first exploit
Across 36 countries worldwide
Meet the cybersecurity expert behind this comprehensive vulnerability database analysis
Choose the optimal solution based on your functional requirements, budget, and integration needs
| Feature / Database | CVEFeed.io | NVD | MITRE CVE | VulnDB |
|---|---|---|---|---|
| Real-time Updates | Yes | Partial | No | Yes |
| REST API Access | Full | Full | Limited | Full |
| Free Access | Paid | Full | Full | Paid |
| CVSS 3.1 Scoring | Yes + Predictions | Yes | Yes | Yes + Custom |
| SIEM Integration | Native | Via API | Limited | Native |
| Dark Web Monitoring | Yes | No | No | Yes |
| Predictive Analytics | Machine Learning | No | No | Basic |
Explore CVE record structure and CVSS scoring with real-world examples of critical vulnerabilities
CVE ID: CVE-2023-34362
Description: SQL injection vulnerability in Progress MOVEit Transfer
before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4),
2022.1.5 (14.1.5), and 2023.0.1 (15.0.1) allows an unauthenticated
attacker to gain access to MOVEit Transfer's database.
CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Score: E:X/RL:O/RC:C
Vector Breakdown:
- Attack Vector: Network (N)
- Attack Complexity: Low (L)
- Privileges Required: None (N)
- User Interaction: None (N)
- Scope: Changed (C)
- Confidentiality Impact: High (H)
- Integrity Impact: High (H)
- Availability Impact: High (H)
Published: May 31, 2023
Exploits: Actively Exploited
Tags: SQLi, RCE, Zero-day
Each CVE record contains structured information about a vulnerability:
A CVSS vector is a text string that encodes the metrics used to score a vulnerability. Each letter corresponds to a specific metric value, allowing precise understanding of vulnerability characteristics.
CVSS scores range from 0.0 to 10.0, where 10.0 is maximum severity. Critical: 9.0-10.0, High: 7.0-8.9, Medium: 4.0-6.9, Low: 0.1-3.9.
Answers to common questions about vulnerability databases and cyber risk management
For small companies, we recommend starting with free options: NVD (National Vulnerability Database) or CVE.org. They provide full access to the CVE catalog with CVSS scores. If you need more advanced functionality, consider VulDB with free access to basic features.
CVE (Common Vulnerabilities and Exposures) - specific instances of vulnerabilities in software. CWE (Common Weakness Enumeration) - common classes of weaknesses in architecture or code. CAPEC (Common Attack Pattern Enumeration and Classification) - tactics and techniques used by attackers.
Update frequency varies: NVD updates daily, commercial solutions like CVEFeed.io and VulnDB provide real-time updates. MITRE CVE updates as new identifiers are assigned, typically several times per day.
CNA (CVE Numbering Authority) - organizations authorized to assign CVE identifiers for vulnerabilities in their products or scope of responsibility. There are 307 CNAs across 36 countries. They ensure decentralized but coordinated management of the CVE ID assignment process.
CVSS scores should be consistent across databases since they follow the same standard. However, temporal and environmental scores may vary based on when they were calculated. NVD scores are considered the reference standard for most organizations.
Yes, many organizations use multiple databases: NVD for baseline CVE data, a commercial database for real-time alerts, and specialized databases for specific technologies or threat intelligence. API integrations make combining data sources feasible.