# Fencer Vulns

> A free, public vulnerability feed. Fencer Vulns merges the CVE List, the GitHub Advisory Database, maintainers' GitHub repository advisories, OSV, NVD, CISA's Known Exploited Vulnerabilities catalog (KEV), ENISA's EU Vulnerability Database, FIRST EPSS scores, public exploits from Exploit-DB and Metasploit, Nuclei detection checks, distro advisories (Debian, Ubuntu, Red Hat, SUSE, openSUSE, AlmaLinux, Rocky Linux, Alpine, Azure Linux, Arch Linux), vendor CSAF advisories and VEX statements (CISA ICS and IT, Red Hat) and Anchore's NVD corrections into one deduplicated entry per vulnerability. Entries also carry ATT&CK techniques for KEV vulnerabilities (MITRE CTID Mappings Explorer), ransomware groups known to use them (BushidoUK Ransomware Vulnerability Matrix, CC BY 4.0) and Project Zero's zero-day listing; lockfile reports flag versions out of support per endoflife.date. No account, no API key.

## MCP server (preferred for agents)

Streamable HTTP, stateless, no auth: https://vulns.fencer.dev/mcp

Tools: search, get_vulnerability, list_feed, check_stack.

- Before adding or upgrading a dependency, call check_stack with the lockfile contents (or packages at exact versions). A GitHub Actions workflow file works too, and so does a container SBOM (CycloneDX, SPDX or Syft JSON), whose OS packages are checked against the distro advisories.
- For any CVE, GHSA or OSV id, call get_vulnerability: it says whether the entry is in CISA KEV, its EPSS score and when it first reached 10%, public exploits and fixed versions, and where known its ATT&CK techniques (attack), ransomware groups (ransomware) and Project Zero zero-day listing (zeroDay), and the vendors' own CSAF statements per product (vendorAdvisories: affected, fixed or not affected, remediation, link). Keep the credit object of attack and ransomware with that data, and the license object of fixes.distros with Ubuntu and Alpine fixes (CC BY-SA 4.0) and Azure Linux fixes (MIT).
- check_stack also lists package versions endoflife.date marks as out of support (eol).
- No matches means Fencer Vulns found none, not that the packages are safe.

## Feeds

https://vulns.fencer.dev/feed — RSS by default; format=atom or format=json.
Filters combine: filter=critical|kev, tech=<slug>, ecosystem=<name>, vendor=<vendor or product substring, e.g. fortinet>. filter, tech and ecosystem each take a comma list or repeat; vendor takes one value. An entry must match any value of a field and every field given; at most 16 combinations.
"critical" = in CISA KEV, or rated "active exploitation" by CISA SSVC, or CVSS 9+ in a listed technology (WordPress plugins and themes excepted; WordPress itself counts), or CVSS 7+ with EPSS >= 0.1.

Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget, github-actions, pub, swift, hackage, ghc, cran, opam, julia, bitnami
Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel

## JSON API (CORS: *)

- GET https://vulns.fencer.dev/api/v1/entries/<id> — one entry (aliases redirect to the canonical id; follow redirects)
- GET https://vulns.fencer.dev/api/v1/entries?filter=&tech=&ecosystem=&vendor=&limit=&cursor= — newest first, paginated by next_cursor
- GET https://vulns.fencer.dev/api/v1/search?q=&severity=&kev=&exploited=&tech=&ecosystem=&vendor=&package=&published=&type=&limit=&offset= — results carry "matched" reasons; facet counts; "broader" suggests relaxed queries when nothing matches. published: 2024 | 2024-05 | 2024-01-01..2024-03-31 | >=2024-01-01 | <2024-01-01 | 30d. exploited = in CISA KEV or with an Exploit-DB or Metasploit exploit
- POST https://vulns.fencer.dev/api/v1/stack — {"filename":"package-lock.json","content":"..."} or {"packages":"npm:lodash@4.17.20,pypi:django@4.2.0"} → report with findings, unsupported versions (eol), a report URL and an RSS feed. Lockfiles: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, Gemfile.lock, composer.lock, mix.lock, packages.lock.json, gradle.lockfile, .github/workflows/*.yml, action.yml, pubspec.lock, Package.resolved, renv.lock, Manifest.toml, cabal.project.freeze, *.opam.locked. An SBOM (CycloneDX, SPDX 2 or Syft JSON, e.g. from syft <image> -o cyclonedx-json) works as content too: its deb, apk, rpm and Arch packages are matched against the distro advisories for their release and returned under "os". An "os" finding or package with possible: true comes from Arch Linux's tracker, which gives no introduced version: the package may predate the bug, so report it as "may be affected". Arch-based distros (Manjaro, EndeavourOS, Garuda) are unchecked with reason "derivative". GitHub Actions workflows (.github/workflows/*.yml, action.yml) work as lockfiles: each uses: owner/repo@ref is matched against the advisory ranges, a floating tag (v4) as the newest release of its line; actions pinned to a commit SHA (without a "# v1.2.3" comment) or a branch come back under "unchecked" with the advisories on file.
- GET https://vulns.fencer.dev/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0 — RSS of entries affecting exactly those versions
- GET https://vulns.fencer.dev/api/v1/status — source sync health and counts

## Pages

- https://vulns.fencer.dev/<id> — entry page for a CVE, GHSA or OSV id
- https://vulns.fencer.dev/search?q=… — search
- https://vulns.fencer.dev/check — upload a lockfile