Three CVSS sources per CVE, Chrome in-the-wild flags and license lookup

Released September 30, 2026

CVE records keep CVSS scores from NVD, the CNA and CISA, and the top score is the highest of the three. Chrome CVEs that Google reports as exploited in the wild are flagged automatically, and the Package Metadata API is documented.

CVSS from NVD, the CNA and CISA

Vulners keeps CVSS scores from NVD, from the CNA that assigned the CVE and from CISA’s ADP enrichment, with the origin of each. The top score is the highest of them, and on a tie NVD wins. A CVE that neither NVD nor its CNA has scored, but CISA has, now gets a score instead of none. As a result, the top score of some CVEs changes. If you alert on score thresholds, review them after this update.

Exploited-in-the-wild flags for Chrome

Chrome security releases often cover dozens of CVEs and say, in one line, that an exploit for one of them exists in the wild. An AI model reads the release notes and flags the CVEs named in that line, with the release as the source. Only CVEs listed in the release qualify, and flags are never removed automatically.

Package Metadata API

POST /api/v4/audit/metadata returns the license Vulners has on record for a package version, and the range of versions that record covers. It takes packages from PyPI, npm, Maven, Go, Rust (Cargo), Debian, RPM and other registries, works on every plan, and has its own section in the audit docs.

Docs: Package metadata

CPE coverage

CVE records from 20 more CNAs, among them AMD, Schneider Electric, SUSE, Debian and the Go project, now come with CPE configurations derived from what each CNA published. That brings the number of CNAs added since December to 56.