Skip to content
Noroxi

Open data

The whole database as a daily snapshot: CSV and Parquet, version = date, reproducible from source watermarks. For academic work, your own pipeline or offline use.

Snapshots

Generated daily at 05:30 UTC. The last 7 days and the first snapshot of each month are kept; older versions stay citable through their manifest.

VersionGeneratedCVEsSizeFiles
2026-09-29latestSep 29, 2026385,712351 MBmanifest · README

Tables and columns

Every table ships as <name>.csv.gz (UTF-8, header row) and <name>.parquet (Snappy). Empty cell = NULL. Timestamps are ISO 8601 UTC. cve.tags is '|'-separated.

  • cve385,712 rowsparquet csv.gz

    Main record: scores, KEV, EPSS, CNA, SSVC, tags, exploit counts (no identifiers)

    id, source, title, summary, published, updated, cvss_score, cvss_vector, cvss_version, cvss_source, cvss_cna_score, cvss_cna_vector, cvss_cna_version, severity, cwe_id, cwe_name, kev, kev_added, kev_due, kev_ransomware, epss, epss_pct, exploit_maturity, action_score, primary_vendor, primary_product, cna, ssvc_exploitation, ssvc_automatable, ssvc_impact, fix_available, has_patch_ref, tags, exploitdb, metasploit, nuclei, github_poc, sources

  • product1,517,664 rowsparquet csv.gz

    NVD CPE products

    cve_id, vendor, product, cpe

  • product_version1,957,592 rowsparquet csv.gz

    NVD version ranges (vsi/vse/vei/vee = start/end, incl./excl.)

    cve_id, vendor, product, version, vsi, vse, vei, vee

  • cna_affected940,288 rowsparquet csv.gz

    Affected product/version rows reported by the CNA

    cve_id, vendor, product, version, less_than, less_than_eq, status, version_type, default_status, changes

  • fix677,424 rowsparquet csv.gz

    Fix versions (CNA, OSV, MSRC)

    cve_id, source, product, fixed_version, url, note

  • package_affected2,453,406 rowsparquet csv.gz

    OSV/GHSA package ranges (17 ecosystems)

    cve_id, osv_id, ecosystem, package, purl, introduced, fixed, last_affected

  • alias474,595 rowsparquet csv.gz

    Aliases: GHSA, OSV, EUVD, BDU

    cve_id, scheme, alias, url

  • credit102,577 rowsparquet csv.gz

    CNA credits (finder, reporter, analyst)

    cve_id, name, name_l, org, kind

  • reference_link2,017,569 rowsparquet csv.gz

    References; Exploit-tagged rows excluded

    cve_id, url, tags

  • cve_related304,213 rowsparquet csv.gz

    Variant and chain candidates (nightly)

    cve_id, related_id, kind, days

  • cwe1,391 rowsparquet csv.gz

    MITRE CWE names

    id, name, abstraction

  • capec559 rowsparquet csv.gz

    MITRE CAPEC patterns

    id, name, abstraction, likelihood, severity, summary

  • cwe_capec1,212 rowsparquet csv.gz

    CWE → CAPEC

    cwe_id, capec_id

  • capec_attack271 rowsparquet csv.gz

    CAPEC → ATT&CK technique

    capec_id, technique_id, technique_name

  • bounty_program949 rowsparquet csv.gz

    Public bug bounty programs

    platform, handle, name, url, bounty, max_payout, updated_at

  • bounty_scope210 rowsparquet csv.gz

    Program ↔ vendor mapping (probable)

    platform, handle, vendor, product, via

  • tag_facet25 rowsparquet csv.gz

    Tag counts

    tag, n, n_year

  • vendor_facet37,893 rowsparquet csv.gz

    Vendor counts

    vendor, n

  • product_facet250,567 rowsparquet csv.gz

    Product counts

    vendor, product, n, src

  • credit_facet20,333 rowsparquet csv.gz

    Researcher counts

    name_l, name, org, n, n_year, kev, last_at

The dump contains no exploit code or links: the exploit table is excluded and the cve row carries counts only.

Usage

Parquet files read directly in DuckDB, pandas, Polars, Spark and R (arrow), and can be queried over HTTP without downloading.

-- DuckDB: indirmeden, HTTP üzerinden
INSTALL httpfs; LOAD httpfs;
SELECT primary_vendor, count(*) n
FROM read_parquet('https://data.noroxi.com/latest/cve.parquet')
WHERE kev AND tags LIKE '%pre-auth%' AND tags LIKE '%rce%'
GROUP BY 1 ORDER BY n DESC LIMIT 20;
# Python / pandas
import pandas as pd
cve = pd.read_parquet("https://data.noroxi.com/latest/cve.parquet")
fix = pd.read_parquet("https://data.noroxi.com/latest/fix.parquet")
cve[cve.kev & cve.tags.str.contains("pre-auth")].merge(fix, left_on="id", right_on="cve_id")
# Tam anlık görüntü (sürüm sabit, atıf için)
curl -O https://data.noroxi.com/2026-09-29/manifest.json
for t in cve product product_version fix package_affected; do curl -O https://data.noroxi.com/2026-09-29/$t.parquet; done
sha256sum -c <(jq -r '.tables[] | "\(.parquet.sha256)  \(.parquet.file)"' manifest.json)

Citation

Cite with the version date; manifest.json carries the source watermarks (cvelistV5 tag, NVD lastModified, KEV catalog version, EPSS date) needed to reproduce the same data.

Noroxi. (2026). Noroxi CVE Database, snapshot 2026-09-29 [data set]. https://noroxi.com/cve/data
@misc{noroxi_cve_20260929,
  title   = {Noroxi CVE Database, snapshot 2026-09-29},
  author  = {{Noroxi}},
  year    = {2026},
  url     = {https://noroxi.com/cve/data},
  note    = {Version 2026-09-29; sources: CVE.org, NVD, CISA KEV/Vulnrichment, FIRST EPSS, OSV/GHSA, MSRC, EUVD, BDU, MITRE}
}

License and sources

Fields derived by Noroxi — tags, action_score, exploit_maturity, primary_vendor/product, has_patch_ref, cve_related, *_facet, bounty_scope — are CC BY 4.0. Attribution is enough.

Source fields remain under their own terms; read the relevant one before commercial use: