Sources, licenses and notices

The CVE Database shows public data from third parties. This page lists where each piece comes from, the licenses it is used under and the notices its owners ask for.

Sources and data freshness

Records: CVE Program (https://www.cve.org), via the CVE Services API, refreshed at least every 75 minutes (15 minutes at the source plus a page copy of up to an hour; up to 24 hours if the service is unavailable).
Known exploited: CISA KEV catalog, refreshed every 6 hours.
Exploit prediction: FIRST EPSS, refreshed daily.
Weakness names: MITRE CWE, with the catalog version shown on each record.
Severity scores: CVSS by FIRST, shown with their vector strings.

Descriptions, references and affected products are shown as published in the CVE record by its CNA and other contributors. CubePath does not edit them.

CVE

Copyright © 1999-2026, The MITRE Corporation. CVE™ is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA).

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Source: https://www.cve.org/Legal/TermsOfUse

CWE

CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE's copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation.

Copyright © 2006-2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

Source: https://cwe.mitre.org/about/termsofuse.html

CVSS

CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at https://www.first.org/cvss/.

EPSS

EPSS (Exploit Prediction Scoring System) scores are maintained by the EPSS Special Interest Group at FIRST and generated by Empirical Security, and are published freely to the community. EPSS gives a probability (0 to 1) that exploitation activity will be observed in the next 30 days, and a percentile. It is an estimate, not a statement that a vulnerability is or is not exploited. Data from https://www.first.org/epss/. The model version and the date of the scores are shown on each record.

CISA Known Exploited Vulnerabilities

Known exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), distributed under the Creative Commons 0 1.0 License (license text). Catalog version 2026.11.09, fetched Nov 10, 2026, 18:26 UTC. CubePath does not use the CISA logo or the DHS seal, and this site is not endorsed by CISA or DHS.

Independence and disclaimer

CubePath is not affiliated with, sponsored by or endorsed by The MITRE Corporation, the CVE Program, CISA, the U.S. Department of Homeland Security, FIRST.Org, Inc., or Empirical Security. CVE, CWE, CVSS, EPSS and KEV are the work of their respective owners and are used under the terms listed on this page. The information is provided "as is", without warranty of any kind. It may be incomplete, delayed or wrong, and it is not security advice for your systems. Always check the vendor's advisory.