The List, Changing Screensaver
The The List, Changing screensaver shows what the CVE Program recorded as changed in its last publishing window, read live and key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the The List, Changing screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
What the CVE Program recorded as changed in its last publishing window, read live and key-less. Most feeds show new identifiers; this shows the churn, including the quiet edits to old records that every downstream view discards.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
Reading the CVE change feed
The CVE Program assigns identifiers like CVE-2024-12345 that the security industry uses to refer to a specific vulnerability. MITRE acts as editor and primary CVE Numbering Authority, alongside many other CNAs such as software vendors, which assign identifiers and publish their own records. The official list is cached publicly as the cvelistV5 repository on GitHub, holding records in the CVE JSON 5 format, refreshed about every seven minutes from the CVE Services API.
The repository also publishes a baseline snapshot each day at midnight UTC and hourly delta files containing only the changes since that baseline. A record is not written once and left alone: descriptions are rewritten, references are added, and records can carry extra containers from other contributors, such as CISA’s ADP container with vulnerability-prioritisation data. Some records are moved to a rejected status when they prove to be duplicates or do not meet the inclusion criteria; a rejected ID is kept so identifiers stay unique.
The numbers describe bookkeeping, not threat levels. A burst of updated records may be a batch of tidy-ups by one authority, and a new CVE is only a labelled report of a flaw. Counting edits alongside new IDs shows how much of the work is maintenance.
A worked example
What the CVE Program recorded as changed in its last publishing window, read live and key-less. Most feeds show new identifiers; this shows the churn, including the quiet edits to old records that every downstream view discards.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What does a rejected CVE mean?
- The record was withdrawn, for example because it duplicates another or does not meet the inclusion criteria. The ID is retained so identifiers stay unique.
- Who writes CVE records?
- CVE Numbering Authorities, which include software vendors and other organisations. MITRE acts as editor and primary CNA but is not the author of every entry.
- Is a long list of changes a sign of more attacks?
- No. Changes are edits to existing records and new reports, so they reflect how the list is maintained, not how many attacks are occurring.