Changelog#

What changed on cveledger.app and in its API, newest first. The data itself changes every few minutes and is not listed here; this is about what the site and the API can do.

API releases carry the version of the /v1 contract; how it is versioned is at the end of this page.

2026-11-08#

• The site is now CVE Ledger, at cveledger.app, with the API at api.cveledger.app. "CVE Tracker" is a name several other sites share; the old addresses at trackcve.app forward to the new ones.
• The MCP server introduces itself as cve-ledger, and the skill for agents is now skills/cve-ledger. A client already connected keeps working; only the name it shows changes after you add the server again under the new address.

2026-11-07#

API 1.6.0#

• exploit on every CVE (list rows and the detail): a public exploit or proof of concept is known, from a reference the CNA or CISA tagged exploit, or CISA's SSVC exploitation poc or active. About one CVE in six has one.
• Filter exploit=true on /v1/cves, /v1/timeline, /v1/export and the feeds; the MCP tool search_cves takes it too.
• history on GET /v1/cves/{id}: what changed after publication, oldest first (a new severity or score, a public exploit appearing, EPSS crossing 1, 10 or 50 %, leaving KEV, a rejection). Kept from this release on; earlier changes are not known. The MCP tool get_cve returns it too.

Site#

• A Public exploit badge next to KEV in the list and on the CVE page, a Public exploit only filter, and on the CVE page a section with the exploit references (they are highlighted among the other references too).
• Every CVE page has a Timeline: the id reserved, published, added to KEV, each change since, and the last update of the record, as a rail of moments by year. The Markdown version for agents has it as a list.
• robots.txt asks AI crawlers to wait 2 seconds between requests (Crawl-delay). A full crawl of the vendor pages misses the cache on every page and slowed the site down for people; crawlers are still welcome and see the same pages, only spread over a longer time.
• Pages of one CVE, vendor, product, weakness or week are kept by the CDN for an hour instead of a minute, so a page many people (or several crawlers) open is rendered once. Lists and overviews still refresh every minute.
• One address may load at most 120 pages a minute; past that it gets 429 Too Many Requests with Retry-After before anything is rendered. A person never gets near it (pages after the first are rendered in the browser); a crawler or script walking the site slows down instead of slowing the site down for everyone.

2026-11-05#

API 1.5.0#

• POST /v1/mcp: a Model Context Protocol server, so an AI assistant can search CVEs, read one in full, and profile vendors, weaknesses and weeks. No key, read-only, with limits of its own so that agents never slow the site down.

Site#

• MCP server: how to connect Claude, Cursor or VS Code, and the tools it offers. It is linked from the menus and the quick search, and listed in llms.txt and /.well-known/ai-catalog.json.

2026-11-04#

• Vendor and weakness pages of the largest groups (Microsoft, CWE-79) timed out and showed an error; they now answer in a fraction of a second. The rising exploitation page is faster too.
• Navigation: the header groups every page into three menus (Browse, Use the data, Project), a phone gets the same as one menu, and the footer lists the same links. New pages were hard to find before.
• About points to CVE Tracker CLI, a terminal companion from OSS Philippines that reads this API.
• The vendor, product and CNA suggestions in the filters are counted once per sync instead of on every keystroke, so they come back at once.
• Under a flood of slow or many requests the API now keeps answering everyone else: slow queries no longer pile up query workers, and past 10,000 distinct callers in a minute newcomers share one rate limit.
• The outline of the API documentation and of this page follows the reading position with less work, so long pages scroll smoothly on a phone.

2026-11-03#

API 1.4.0#

• GET /v1/vendors/{vendor}?product=: one vendor's or product's CVEs by severity and year, with its top products and weaknesses, the newest and the known exploited.
• GET /v1/cwes/{cwe}: the CVEs of one weakness by severity and year, with the vendors it comes up for most, the newest and the known exploited.
• GET /v1/weekly?week=2026-W45: one ISO week of CVEs, with counts by severity, the most severe, KEV additions, and the top vendors and weaknesses.

API 1.3.0#

• GET /v1/epss/movers?window=1d|7d|30d: the 50 CVEs whose EPSS rose the most over the last day, week or month, with the earlier score as epssBefore.

API 1.2.0#

• Filters cwe (a weakness, CWE-79 or 79) and assigner (the CNA's short name) on /v1/cves, /v1/timeline and /v1/export, with suggestions from GET /v1/cwes and GET /v1/assigners.
• sort=kevAdded orders the list by the day CISA added each CVE to KEV, and every row has that day as kevAdded.
• GET /v1/stats?range=7d|30d|90d|12m: severity, top weaknesses, vendors and CNAs of the CVEs published in a window, and how many CISA added to KEV.

API 1.1.0#

• GET /v1/openapi.json: an OpenAPI 3.1 description of the whole API, generated from the schemas the answers are checked against. Generate a client in any language from it.
• strict=true on /v1/cves, /v1/timeline and /v1/export: an unknown parameter or a value the filter would otherwise ignore is a 400 that names the problem, instead of a wider result.
• /v1/health reports the deployed commit as version instead of dev.

Site#

• Quick search: ⌘K (Ctrl+K) or / on any page, or the search button in the header, opens a CVE by its id, a vendor, a weakness or any page, or searches the whole list.
• Vendor and product pages, such as Microsoft: CVEs per year, how many are critical and known exploited, the products and weaknesses that come up most, and the newest CVEs, with a feed. The affected products on a CVE's page link to them, and the sitemap lists the 2,000 vendors with the most CVEs.
• Weakness pages, such as CWE-79: how many CVEs of the kind there are per year, how many are exploited, the vendors it comes up for most and the newest, with a feed and a link to MITRE's description. A CVE's weaknesses link to them.
• Weekly digest: any ISO week (/week/2026-W45) at a glance: how many CVEs, how severe, the worst of them, what CISA added to KEV, and the vendors and weaknesses named most, with links to the weeks before and after.
• Rising exploitation: the CVEs whose EPSS rose the most since yesterday, last week or last month, often a sign of attacks before CISA adds them to KEV.
• Recently added to KEV: what CISA added to its catalog, by day, with an Atom feed of new additions (/feed.xml?sort=kevAdded).
• Statistics: severity, the most common weaknesses, vendors and CNAs of the last 7 days to 12 months; every number opens the CVEs behind it.
• Watchlist: watch any filter (a vendor, a package ecosystem, a weakness) from the list and see what each found in the last week, with all their feeds as one OPML file. Kept in your browser; no account.
• Weakness (CWE) and CNA filters in the list; a CVE's page links to the other CVEs with the same weakness or from the same CNA.
• A badge for a README or a ticket, /badge/CVE-….svg, with the CVE's severity, score and KEV status; its Markdown is on every CVE page.
• How it's built: the tech stack and how the site keeps its data current, fast and secure.
• KEV and Stats in the header.
• API documentation: every endpoint, filter and field, with rate limits, error codes, recipes for shell scripts and an outline of the page (folded on a phone). Code examples have a copy button.
• This changelog.
• Data sources says whether every source is up to date, and names the one that is delayed when one is.

2026-11-02#

• Illustrations for an empty result, a lost connection and a page that does not exist.
• A fuller footer on every page: where to go next, the author, and the attributions the sources ask for.
• /.well-known/api-catalog (RFC 9727) and /.well-known/ai-catalog.json point programs and AI agents to the API, the feed and llms.txt.
• When cisa.gov refuses the download, the KEV catalog is read from CISA's own copy on GitHub, so known exploited flags no longer fall behind.

2026-11-01#

• WebMCP tools: an AI agent in the browser can search and filter CVEs, read their details, the timeline and the summary, and get export links, through the page itself.
• The first full read of the CVE List resumes where it stopped after an interruption instead of starting over.

2026-10-27#

• Fair limits for the pages themselves: the site's server rendering is counted per visitor, so one busy visitor cannot use up the API for everyone.
• Self-hosting: DEPLOY.md and two scripts set the whole site up on a small server behind a Cloudflare Tunnel, and update it.

2026-10-26: first release#

API 1.0.0#

• /v1/cves with filters by text, severity, CISA KEV, vendor, product, package ecosystem and publication date, in any order; /v1/cves/{id} with every CVSS score, affected versions, references, KEV, EPSS, SSVC and packages; /v1/cves/{id}/epss with the last month of EPSS.
• /v1/export for a whole filter as CSV or JSON, /v1/timeline, /v1/summary, and /v1/vendors, /v1/products and /v1/ecosystems for the filters.
• 120 requests a minute per address, with RateLimit-* headers; answers cached by the CDN in front.

Site#

• The timeline of every published CVE by severity, the filterable list, and a page for each CVE.
• An Atom feed for any filter, each CVE as Markdown (/cve/{id}.md), llms.txt, sitemaps and security.txt.
• About and Data sources pages.
• Light and dark themes, loading states that keep the current results in view, and WCAG 2.2 AA accessibility, checked by an automated audit on every change.

Versioning policy#

The /v1 contract is versioned semantically; its version is info.version of /v1/openapi.json.

• Within /v1 only additions are made: a new endpoint, parameter, field or enum value. Nothing is removed, renamed or changes meaning or type. Ignore fields you do not know, and treat an enum value you do not know (a new severity, a new source) as "other".
• Lenient defaults stay lenient. A request that works today keeps working; stricter checks are opt-in (strict=true).
• A breaking change gets a new path (/v2), announced here, with /v1 kept running alongside it for at least six months.
• Error messages are for people and may be reworded at any time; codes are part of the contract.