Terms of Service

VulnSea aggregates publicly available CVE and vulnerability information — NVD, CVE.org, the GitHub Advisory Database, OSV.dev, vendor CSAF advisories (such as Red Hat and Cisco), FIRST.org EPSS, the CISA KEV catalog and public exploit indexes — and presents it for humans and automated agents, together with fields we derive from it (the depth score and zones, tags, aggregations and analyst notes). The content is informational only. Always verify against the official advisory before acting on it. We do not warrant that the data is complete, accurate, or current.

Some features require signing in via a third-party OAuth provider. You are responsible for activity under your account and for keeping your API keys secret. Notify us at [email protected] if you believe a key has been compromised; you can revoke keys yourself from your account page.

The full corpus is available without an account. You may use the API for lawful purposes, including automated/agentic workflows, subject to these Terms.

Rate limits apply and may be enforced at the edge and in the application: anonymous callers are limited per IP (60 requests per minute); an API key or signed-in session raises that limit (600 requests per minute). Do not attempt to circumvent rate limits or access controls (e.g. by rotating keys or IPs).

The Service is free and ad-supported. We do not charge for access to the data or the API. Advertising is served on the website only (never in API, markdown, or feed responses) and is subject to the Privacy Policy. Features and limits may change; material changes are announced on the blog.

PoC requests. Where offered, proof-of-concept requests are fulfilled on a best-effort basis. We do not guarantee that a PoC can or will be produced for any given item, and a request may be marked unavailable. PoC material is provided for lawful, authorized security testing only and is subject to the acceptable-use terms below.

You agree not to:

• Break the law or use the Service to harm others.
• Disrupt, overload, or attempt to gain unauthorized access to the Service or its infrastructure.
• Circumvent authentication or rate limits.
• Misrepresent the data as an official advisory, strip the attribution the data licence requires (section 6), or pass off VulnSea's derived fields as your own measurements.
• Use the Service to develop or operate anything that facilitates unlawful exploitation of vulnerabilities.

We may suspend, rate-limit, ban, or delete accounts and revoke API keys that violate these Terms or threaten the Service, with or without notice.

Data you take from the Service. The corpus is open, including in bulk (/api/dump), through the API and through the MCP server, and you may reuse and redistribute it, commercially or not, under two layers of terms:

• Source data (descriptions, CVSS vectors, references, affected versions, EPSS, KEV status and the like) originates with its publishers and stays under their terms — NVD (public domain), CVE.org (CVE Terms of Use), the GitHub Advisory Database (CC BY 4.0), OSV.dev (per source), vendor CSAF feeds, FIRST.org EPSS and the CISA KEV catalog.
• VulnSea's own fields — the depth score and zones, tags, per-source score comparisons, aggregations, digests, analyst notes and the way records are assembled — are licensed under Creative Commons Attribution 4.0 (CC BY 4.0). Credit "VulnSea" with a link to https://beta.vulnsea.com wherever the data is shown or shipped; that is the only condition.

The VulnSea site, design, and software are ours or our licensors'. These Terms do not grant you rights to our trademarks.

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. You use the data at your own risk.

To the maximum extent permitted by law, VulnSea and its operators will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss arising from your use of or reliance on the Service or its data.

You agree to indemnify and hold harmless VulnSea and its operators from claims arising out of your use of the Service or your violation of these Terms.

You may stop using the Service at any time and request account deletion (see the Privacy Policy). We may suspend or terminate access at our discretion, including for violations of these Terms.

These Terms are governed by the laws of the operator's principal place of business, without regard to conflict-of-laws rules. Disputes will be handled in the courts of that jurisdiction.

We may update these Terms as the Service evolves. Continued use after changes take effect constitutes acceptance. Material changes will be reflected by a new effective date above.

Questions: [email protected].