A calm, curated record of what’s broken.
Vulnary is an editorial publication about critical vulnerabilities, not a hacker dashboard. Every hour it ingests newly published and newly exploited critical security flaws, distills each one, and surfaces the remediation the source itself provides.
The four questions
Every entry answers the same four things: what is it, who is affected, how bad is it, and what do you do about it.
Where the data comes from
The National Vulnerability Database is our primary source for CVE data: descriptions, CVSS scores, CWE weaknesses, and affected products. Vulnary syncs it incrementally on every run.
The Known Exploited Vulnerabilities catalog flags flaws under active attack, with an authoritative required action and due date. When a CVE is in KEV, its remediation comes straight from CISA.
A public archive of exploits. When an entry mentions a CVE, Vulnary flags that a public exploit exists. We treat this as a helpful signal, not a primary source.
How often it updates
An ingest pass runs every hour, on the hour (UTC). Each pass pulls only what changed since the last run, so entries appear and update throughout the day. The digests page groups each batch. Once an official fix is available, an entry is kept for 30 days and then removed automatically.
On the AI, plainly
A language model writes the summaries, and it only works from the source data we give it: the NVD description, CVSS metrics, CWE weaknesses, CISA KEV required actions, and any referenced advisories. It is told never to invent facts or a fix. When there is no official fix yet, it says so plainly instead of guessing.
Think of the summary as a translation, not the last word. For anything you actually act on, the official NVD or vendor advisory (linked on every entry) is what counts.
Who made this
Vulnary is built and maintained by Sudeep Nag Vemulapati. It’s a free, open project, given to anyone who wants to keep up with the vulnerabilities that actually matter, at no cost.