No — the NVD's public API allows free, key-less access for light use.

How is this different from Cyber Threat Map?

Cyber Threat Map tracks live botnet command-and-control IPs; this tracks newly disclosed software vulnerabilities — a different security topic entirely.

Yes — the National Vulnerability Database is the U.S. government's official CVE repository.

Yes — free, no download, in your browser.

What does the year in a CVE number mean?

It is the year the ID was assigned (or earlier, if the flaw had already been made public). It does not show when the flaw was discovered, introduced or fixed.

Is a critical score always urgent?

Not for everyone. A CVSS base score rates the flaw in general. Whether it matters to you depends on whether you run the affected software and whether an attacker can reach it.

Why can a record have no score yet?

Scoring is a separate step from publication. A record can appear first and be scored later by its CNA or by NVD, and NVD does not enrich every CVE.

CVE Security Feed Screensaver

The CVE Security Feed screensaver scrolls newly published software vulnerabilities as they're recorded, drawn key-less from the U.S. National Vulnerability Database. It's free, runs in your browser, and ESC exits.

How the CVE Security Feed screensaver works

The saver queries the National Vulnerability Database's public API for recently published CVEs, with no key required.

Each entry scrolls through with its real CVE identifier and severity score.

Filter to high and critical severity only, or see the full real feed.

The feed refreshes on a schedule to track real newly disclosed vulnerabilities.

CVE identifiers and CVSS scores explained

A CVE, or Common Vulnerabilities and Exposures entry, is a standard identifier for a publicly known security flaw. The identifier has the form CVE-YEAR-NUMBER, so vendors, researchers and defenders can refer to the same problem by the same name. The programme is sponsored by the US Department of Homeland Security through CISA, and MITRE maintains it. The National Vulnerability Database at NIST builds on the CVE list.

The severity figure is a CVSS base score, a number from 0.0 to 10.0 defined by FIRST. It is built from characteristics of the flaw: attack vector, attack complexity, privileges required, user interaction and the effect on confidentiality, integrity and availability. In CVSS v3.1 the labels run Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0). The score describes the flaw in general, not the danger in your environment.

New entries can appear before analysis is complete, so a record may be published without a score or have its details revised later. Scores can come from the CNA that submitted the record or from NVD, and NIST has said it no longer enriches every CVE. Patching decisions belong with the software vendor’s advisories.

A worked example

You might see a real CVE for a web-framework flaw scroll past with its severity score — genuine vulnerability disclosure data, the same feed security teams monitor.

Settings & tips

Minimum severity filters out lower-severity entries.
Accent recolours the CVE identifiers.
This tracks software vulnerabilities — distinct from the site's Cyber Threat Map, which tracks active botnet infrastructure.

Frequently asked questions

Is a key needed?: No — the NVD's public API allows free, key-less access for light use.
How is this different from Cyber Threat Map?: Cyber Threat Map tracks live botnet command-and-control IPs; this tracks newly disclosed software vulnerabilities — a different security topic entirely.
Is this official?: Yes — the National Vulnerability Database is the U.S. government's official CVE repository.
Is it free?: Yes — free, no download, in your browser.
What does the year in a CVE number mean?: It is the year the ID was assigned (or earlier, if the flaw had already been made public). It does not show when the flaw was discovered, introduced or fixed.
Is a critical score always urgent?: Not for everyone. A CVSS base score rates the flaw in general. Whether it matters to you depends on whether you run the affected software and whether an attacker can reach it.
Why can a record have no score yet?: Scoring is a separate step from publication. A record can appear first and be scored later by its CNA or by NVD, and NVD does not enrich every CVE.

← All Security & Privacy screensavers