🐛 Online Vulnerability Databases & References
Below is a curated list of the most useful and reputable online vulnerability databases, exploit repositories, and security references.
1. 🐞 Official & Standardized Databases
| Name | URL | What It’s For |
|---|---|---|
| NVD (National Vulnerability Database) | https://nvd.nist.gov | Official U.S. government database of CVEs with CVSS scoring, searchable by vendor/product. |
| MITRE CVE | https://cve.mitre.org | Master index of CVE IDs (Common Vulnerabilities and Exposures) with references to vendor advisories and databases. |
| CWE (Common Weakness Enumeration) | https://cwe.mitre.org | Catalog of types of software weaknesses (e.g., SQL Injection, Buffer Overflow). |
| CAPEC (Common Attack Pattern Enumeration and Classification) | https://capec.mitre.org | Database of known attack patterns, tactics, and techniques. |
2. 🪲 Exploit & Proof-of-Concept Repositories
| Name | URL | What It’s For |
|---|---|---|
| Exploit Database (Exploit-DB) | https://www.exploit-db.com | Exploits, PoCs, and vulnerable software for practice (includes Offensive Security’s archives). |
| Packet Storm Security | https://packetstormsecurity.com | Security advisories, exploits, and tools. |
| 0day.today | https://0day.today | Exploits, PoCs, zero-day listings (registration required). |
| Vulners | https://vulners.com | Search engine for vulnerabilities across CVE, exploit-db, advisories, etc. |
3. 🐜 Vendor & Project Advisories
| Vendor | URL |
|---|---|
| Microsoft Security Advisories | https://msrc.microsoft.com/update-guide |
| Cisco Security Advisories | https://tools.cisco.com/security/center/publicationListing.x |
| Apache HTTP Server Security Reports | https://httpd.apache.org/security/vulnerabilities_24.html |
| WordPress Vulnerability Database | https://wpscan.com/vulnerability-database |
4. 🐝 Community-Driven Databases
| Name | URL | Notes |
|---|---|---|
| VulDB | https://vuldb.com | Crowdsourced vuln tracking with timelines and threat intelligence. |
| CXSecurity | https://cxsecurity.com | Community posts about vulnerabilities and exploits. |
| HackerOne Hacktivity | https://hackerone.com/hacktivity | Public reports from bug bounty programs. |
| Open Bug Bounty | https://www.openbugbounty.org | Coordinated disclosure platform for web vulnerabilities. |
5. 🦋 Aggregators & Search Engines
| Name | URL | Features |
|---|---|---|
| Shodan | https://www.shodan.io | Search for internet-connected devices and see known vulnerabilities. |
| Censys | https://censys.io | Similar to Shodan but more research-focused. |
| SecurityFocus (Bugtraq) | https://www.securityfocus.com/vulnerabilities | Vulnerability database with mailing list archives. |
💡 Tip: Combine multiple of these sources for deeper vulnerability research. Tools like Vulners API or custom scripts can automate multi-source lookups.
Favorites: Xxxxxx