Skip to content
Noroxi

Open data

The whole database as a daily snapshot: CSV and Parquet, version = date, reproducible from source watermarks. For academic work, your own pipeline or offline use.

Snapshots

Generated daily at 05:30 UTC. The last 7 days and the first snapshot of each month are kept; older versions stay citable through their manifest.

Snapshot files are not published yet; they will be listed here once they are. The table schema below shows how the files will be laid out. Available today: API for single lookups · Subdomain takeover signatures

Tables and columns

Every table ships as <name>.csv.gz (UTF-8, header row) and <name>.parquet (Snappy). Empty cell = NULL. Timestamps are ISO 8601 UTC. cve.tags is '|'-separated.

  • cve

    Main record: scores, KEV, EPSS, CNA, SSVC, tags, exploit counts (no identifiers)

    id, source, title, summary, published, updated, cvss_score, cvss_vector, cvss_version, cvss_source, cvss_cna_score, cvss_cna_vector, cvss_cna_version, severity, cwe_id, cwe_name, kev, kev_added, kev_due, kev_ransomware, epss, epss_pct, exploit_maturity, action_score, primary_vendor, primary_product, cna, ssvc_exploitation, ssvc_automatable, ssvc_impact, fix_available, has_patch_ref, tags, exploitdb, metasploit, nuclei, github_poc, sources

  • product

    NVD CPE products

    cve_id, vendor, product, cpe

  • product_version

    NVD version ranges (vsi/vse/vei/vee = start/end, incl./excl.)

    cve_id, vendor, product, version, vsi, vse, vei, vee

  • cna_affected

    Affected product/version rows reported by the CNA

    cve_id, vendor, product, version, less_than, less_than_eq, status, version_type, default_status, changes

  • fix

    Fix versions (CNA, OSV, MSRC)

    cve_id, source, product, fixed_version, url, note

  • package_affected

    OSV/GHSA package ranges (17 ecosystems)

    cve_id, osv_id, ecosystem, package, purl, introduced, fixed, last_affected

  • alias

    Aliases: GHSA, OSV, EUVD, BDU

    cve_id, scheme, alias, url

  • credit

    CNA credits (finder, reporter, analyst)

    cve_id, name, name_l, org, kind

  • reference_link

    References; Exploit-tagged rows excluded

    cve_id, url, tags

  • cve_related

    Variant and chain candidates (nightly)

    cve_id, related_id, kind, days

  • cwe

    MITRE CWE names

    id, name, abstraction

  • capec

    MITRE CAPEC patterns

    id, name, abstraction, likelihood, severity, summary

  • cwe_capec

    CWE → CAPEC

    cwe_id, capec_id

  • capec_attack

    CAPEC → ATT&CK technique

    capec_id, technique_id, technique_name

  • bounty_program

    Public bug bounty programs

    platform, handle, name, url, bounty, max_payout, updated_at

  • bounty_scope

    Program ↔ vendor mapping (probable)

    platform, handle, vendor, product, via

  • wp_component

    WordPress plugin/theme ↔ CVE: who can exploit it (role, via: text|cvss, ui = user click required), fixed version, whether the latest wordpress.org release is still affected (unpatched); basis: url (address in the record's references) | source (the CNA's own record: WPScan record page or Wordfence canonical address)

    kind, slug, cve_id, role, via, ui, fixed_in, affected_through, ranged, unpatched, basis

  • wp_coverage

    WordPress CNA coverage (Wordfence, Patchstack, WPScan): total valid records, records mapped to a plugin/theme, records mapped through the CNA source when the address has no slug (by_name), and reasons for unmapped records

    cna, total, mapped, by_name, reasons, at

  • wp_component_facet

    Per WordPress component summary: record counts, unauthenticated and officially unpatched record counts, wordpress.org status

    kind, slug, name, n, kev, critical, high, exploited, last_published, unauth, unpatched, status, installs, latest, closed_date

  • wp_org

    wordpress.org status (active | closed | missing), latest version, last update, active installs, closure date and reason

    kind, slug, status, name, version, last_updated, added, active_installs, tested, requires_php, closed_date, closed_reason, checked_at

  • wp_core_version

    WordPress.org verdict for WordPress core versions (stable-check): latest | outdated | insecure

    version, status

  • tag_facet

    Tag counts

    tag, n, n_year

  • vendor_facet

    Vendor counts

    vendor, n

  • product_facet

    Product counts

    vendor, product, n, src

  • credit_facet

    Researcher counts

    name_l, name, org, n, n_year, kev, last_at

The dump contains no exploit code or links: the exploit table is excluded and the cve row carries counts only.

Subdomain takeover signatures 168 providers

The exact provider list the Subdomain finder uses: per provider the CNAME/NS pattern, fingerprint (body, header, HTTP status), NXDOMAIN rule, nuclei template equivalent and one of three risk classes (vulnerable · edge · protected). A union of six public corpora; the count is read from the list, nothing invented. Noroxi-derived fields are CC BY 4.0.

vulnerable = documented takeover · edge = conditional on the provider side · protected = the provider requires domain verification

JSON CSV Subdomain finder

Usage

Parquet files read directly in DuckDB, pandas, Polars, Spark and R (arrow), and can be queried over HTTP without downloading.

-- DuckDB: over HTTP, without downloading
INSTALL httpfs; LOAD httpfs;
SELECT primary_vendor, count(*) n
FROM read_parquet('https://data.noroxi.com/latest/cve.parquet')
WHERE kev AND tags LIKE '%pre-auth%' AND tags LIKE '%rce%'
GROUP BY 1 ORDER BY n DESC LIMIT 20;
# Python / pandas
import pandas as pd
cve = pd.read_parquet("https://data.noroxi.com/latest/cve.parquet")
fix = pd.read_parquet("https://data.noroxi.com/latest/fix.parquet")
cve[cve.kev & cve.tags.str.contains("pre-auth")].merge(fix, left_on="id", right_on="cve_id")
# Full snapshot (pinned version, for citation)
curl -O https://data.noroxi.com/2026-11-15/manifest.json
for t in cve product product_version fix package_affected; do curl -O https://data.noroxi.com/2026-11-15/$t.parquet; done
sha256sum -c <(jq -r '.tables[] | "\(.parquet.sha256)  \(.parquet.file)"' manifest.json)

Citation

Cite with the version date; manifest.json carries the source watermarks (cvelistV5 tag, NVD lastModified, KEV catalog version, EPSS date); other sources such as OSV and vendor advisories have no watermark there, so it does not always suffice to reproduce exactly the same data.

Noroxi. (2026). Noroxi CVE Database, snapshot 2026-11-15 [data set]. https://noroxi.com/cve/data
@misc{noroxi_cve_20261115,
  title   = {Noroxi CVE Database, snapshot 2026-11-15},
  author  = {{Noroxi}},
  year    = {2026},
  url     = {https://noroxi.com/en/cve/data},
  note    = {Version 2026-11-15; sources: CVE.org, NVD, CISA KEV/Vulnrichment, FIRST EPSS, OSV/GHSA, MSRC, EUVD, BDU, MITRE}
}

License and sources

Fields derived by Noroxi — tags, action_score, exploit_maturity, primary_vendor/product, has_patch_ref, cve_related, *_facet, bounty_scope, wp_component (slug ↔ CVE, role, unpatched) — are CC BY 4.0. Attribution is enough.

Source fields remain under their own terms; read the relevant one before commercial use: