Last updated August 20, 2026
These Terms of Service ("Terms") are a contract between you and KPWN IT-Services ("we," "us," "our"), reachable by post at c/o Werneburg Internet Marketing und Publikations-Service, Philipp-Kühner-Straße 2, 99817 Eisenach, Germany, and by email at support [at] cvecrowd (dot) com. Further company details are available in our Impressum.
These Terms govern your access to and use of https://cvecrowd.com and https://api.cvecrowd.com (together, the "Services"). By creating an account, subscribing to a paid plan, or otherwise using the Services, you agree to these Terms. If you do not agree, do not use the Services.
The Services are intended for users who are at least 18 years old.
CVE Crowd monitors public posts on the Fediverse (e.g. Mastodon) and on Bluesky for mentions of security vulnerabilities (CVEs). We only source posts from Fediverse accounts configured as "discoverable" and "indexable" and from public Bluesky profiles. We combine this with vulnerability metadata drawn from public sources such as the MITRE CVE Program, the National Vulnerability Database (NVD), CISA's Known Exploited Vulnerabilities (KEV) catalog, and FIRST's Exploit Prediction Scoring System (EPSS), and compute our own derived figures (such as our "weight" score) from this data.
Depending on whether you use the Services anonymously, with a free account, or with a paid subscription plan, the Services may include: a public dashboard of trending CVEs, keyword search, bookmarking of CVEs, keyword-based email alerts, and programmatic access via our API. Which of these features are available to you, and to what extent (e.g. search volume, alert count, feed retention, API quota), depends on your plan as shown on our pricing page.
The Services do not let you submit or publish content that is shown to other users. Features such as bookmarks, alerts, and account settings are private to your account. Content displayed within the Services (dashboard, search results) originates either from us or, as described in Section 8, from public posts on the Fediverse and Bluesky, never from submissions made by other users of the Services.
The Services are a discovery and prioritization aid for threat intelligence purposes. See Section 10 for important limitations.
We may temporarily close new registrations at our discretion (for example during periods of high load); this does not affect existing accounts.
Some features require an account. When you register, you must provide accurate information and keep it up to date. You are responsible for maintaining the confidentiality of your password and for all activity under your account. Notify us immediately at support [at] cvecrowd (dot) com if you suspect unauthorized use of your account.
Certain features (such as email alerts and API access) additionally require that you verify your email address. We may suspend access to these features until verification is complete.
You may delete your account at any time from your account settings. This deactivates your account; we retain limited data for a short period thereafter as described in our Privacy Policy (e.g. to prevent fraud or comply with legal obligations), after which it is deleted or anonymized.
We offer a free plan and paid subscription plans billed monthly or annually. Current plans, their features, and their prices are shown on our pricing page; prices are in US Dollars unless stated otherwise, and VAT or other taxes may be added where applicable law requires it.
Paid plans are processed through our payment processor, Stripe. By subscribing, you also agree to provide accurate billing information and authorize us, via Stripe, to charge your chosen payment method on a recurring basis for the plan you selected, until you cancel. Paid subscriptions renew automatically at the end of each billing period unless cancelled before that date. We may change subscription prices or plan features from time to time; where legally required, we will give you advance notice, and continuing to use a paid plan after a price change takes effect constitutes acceptance of the new price. If you do not agree to a price change, you may cancel before it takes effect as described in Section 4.
We may correct any errors or inaccuracies in prices or plan descriptions shown through the Services, including where caused by a technical or processing error. If such an error affects an order you have placed, we may cancel the order and refund any amount already paid, or, before fulfilling it, decline to accept it.
You can cancel your subscription at any time by logging into your account and using the subscription management portal linked there. Cancellation takes effect at the end of your current paid billing period; you keep access to your paid plan's features until then, and your account then reverts to the free plan.
Outside of the non-waivable right you may have under mandatory consumer protection law, payments already made are non-refundable, including for partially used billing periods. If you are unsatisfied with the Services, contact us at support [at] cvecrowd (dot) com.
Subscription plans that include API access let you generate personal API keys from your account and use them as Bearer tokens against https://api.cvecrowd.com. The following rules apply:
You agree not to:
We may suspend or terminate access for violations of this section, as described in Section 12.
We (or our licensors) own the Services, including their software, design, database structure, and the "CVE Crowd" name and logo. Subject to your compliance with these Terms, we grant you a personal, non-exclusive, non-transferable, revocable license to access and use the Services for your own internal or personal use, including via the API where your plan includes it. Except as expressly permitted here or agreed with us in writing, you may not copy, republish, sell, sublicense, or otherwise commercially exploit the Services, our software, or our compiled/derived data (such as computed weights or trend rankings) without our prior written permission. If you would like to use the Services or our data beyond what these Terms allow, contact us at support [at] cvecrowd (dot) com.
The underlying factual vulnerability data we display (e.g. CVE identifiers, CVSS scores, KEV status, EPSS scores) originates from public sources such as MITRE, NVD, CISA, and FIRST; your ability to reuse that underlying data is governed by those sources' own terms, not by us.
If you send us feedback, suggestions, or ideas about the Services, you grant us a worldwide, royalty-free, perpetual license to use them for any purpose related to operating or improving the Services, without further compensation to you.
Posts displayed on CVE Crowd are not submitted by our users; they are sourced from public, discoverable accounts on the Fediverse and Bluesky. Ownership of and rights to those posts remain with the original authors; we do not claim ownership and only facilitate access to content that is already publicly available on those networks. It is your responsibility to ensure that any further use you make of such posts complies with applicable law and the original platform's terms.
If you believe content displayed through the Services infringes your rights, contact us at support [at] cvecrowd (dot) com with enough detail to identify the content; we will review and act as appropriate.
The Services may link to or reference third-party websites, such as cve.org, nvd.nist.gov, or cisa.gov, or the Fediverse and Bluesky profiles referenced in Section 8. We do not operate, control, or vet these third-party websites, and we are not responsible for their content, accuracy, availability, or practices, including their own terms of use or privacy practices. If you visit a third-party website, whether via a link from the Services or otherwise, you do so at your own risk, and that website's own terms, not these Terms, apply to your use of it.
CVE Crowd is a discovery and prioritization aid, not an authoritative vulnerability database and not a substitute for official advisories, vendor patches, or your own security assessment process. We do not guarantee that the Services surface every relevant vulnerability or every relevant public discussion of it, that displayed data is complete, current, or error-free, or that a vulnerability's absence from our feed means it is not being actively discussed or exploited elsewhere. Figures we compute ourselves (such as "weight," mention counts, or trend rankings) are heuristic indicators based on public social media activity, not a measure of actual severity or exploitation risk.
Before making security, patching, disclosure, or other business decisions, verify relevant information against authoritative sources, such as cve.org, nvd.nist.gov, and cisa.gov. You use the Services, and act on information obtained through them, at your own risk.
We aim to keep the Services available but do not guarantee uninterrupted or error-free operation. We may change, suspend, or discontinue parts of the Services, including features tied to a specific plan, at any time; where such a change materially reduces a paid feature you rely on, we will make reasonable efforts to notify you in advance. We are not liable for reasonable interruptions related to maintenance, technical issues, or circumstances beyond our control.
You may stop using the Services and delete your account at any time as described in Section 2. We may suspend or terminate your access to the Services, in whole or in part, if you materially breach these Terms (for example by violating Section 6), if required by law, or to protect the security or integrity of the Services, in each case with notice where reasonably possible under the circumstances. Sections of these Terms that by their nature should survive termination (including intellectual property, disclaimers, limitation of liability, indemnification, and governing law) remain in effect after your account is terminated or deleted.
The Services are provided "as is" and "as available." To the extent permitted by law, we disclaim all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement, and we do not warrant that the Services will be uninterrupted, secure, or error-free, or that any data provided through them is accurate or complete. Nothing in this section limits any statutory rights you have as a consumer that cannot be excluded under applicable law.
We are liable without limitation for damages resulting from injury to life, body, or health caused by us, and for damages caused by intent or gross negligence. For damages caused by ordinary negligence, we are liable only for breach of a material contractual obligation (i.e. an obligation whose fulfillment is essential to the proper performance of the contract and on whose observance you may reasonably rely); in that case, our liability is limited to the loss that is typical and foreseeable for a service of this kind. Liability under mandatory statutory provisions, such as the German Product Liability Act (Produkthaftungsgesetz), and liability we have assumed under an express guarantee, remain unaffected by the above limitations.
If a third party brings a claim against us arising from your breach of these Terms, your violation of applicable law, or your infringement of a third party's rights through your use of the Services, you will indemnify us for reasonable costs and damages directly resulting from that claim, to the extent the claim is caused by your conduct. This does not apply where the underlying claim results from our own breach of these Terms or applicable law.
These Terms are governed by German law, excluding the UN Convention on Contracts for the International Sale of Goods. If you are a consumer with your habitual residence in the EU, you additionally keep the protection of any mandatory consumer-protection provisions of the law of your country of residence that cannot be contracted around, and you may bring proceedings before the courts of your own country of residence as well as before the courts described below.
For disputes not covered by the above, the courts of Cologne, Germany have jurisdiction, to the extent permitted by law.
We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board (Verbraucherschlichtungsstelle). If you have a complaint, please contact us directly at support [at] cvecrowd (dot) com first. We will try to resolve it informally.
We may update these Terms from time to time, for example to reflect changes to the Services or to legal requirements. We will post the updated Terms here with a new "Last updated" date and, for material changes, will make reasonable efforts to notify you (e.g. by email or a notice on the Services) before they take effect. Continued use of the Services after a change takes effect constitutes acceptance of the updated Terms; if you do not agree, you should stop using the Services and, if applicable, cancel your subscription before the change takes effect.
These Terms, together with our Privacy Policy, constitute the entire agreement between you and us regarding the Services. If any provision of these Terms is found unenforceable, the remaining provisions remain in effect and, where legally possible, the unenforceable provision will be replaced with one that most closely reflects its intended purpose. Our failure to enforce a provision is not a waiver of it. We may assign these Terms in connection with a merger, acquisition, or sale of assets; you may not assign your rights under these Terms without our consent. Nothing in these Terms creates a partnership, joint venture, employment, or agency relationship between you and us.
Questions about these Terms can be sent to:
KPWN IT-Services