vulntracker.io
Product UpdatesVulnerability IntelligenceVTDBVulnerability

We Built Our Own CVE Database: Introducing VTDB

72,812 CVEs were published in the first nine months of 2026, not counting rejected ones, already more than in all of 2025. At that pace, the question that matters most gets harder to answer quickly: does this CVE affect something I run, and in which versions? We wanted to answer it ourselves, from the vendor's own record, the moment a CVE is published. So we built VTDB, VulnTracker's own vulnerability database. It is the biggest change we have made to the product since we started. What is VT

By Ali Dak··2 min read
We Built Our Own CVE Database: Introducing VTDB

72,812 CVEs were published in the first nine months of 2026, not counting rejected ones, already more than in all of 2025.

At that pace, the question that matters most gets harder to answer quickly: does this CVE affect something I run, and in which versions?

We wanted to answer it ourselves, from the vendor's own record, the moment a CVE is published. So we built VTDB, VulnTracker's own vulnerability database. It is the biggest change we have made to the product since we started.

What is VTDB?

VTDB is a catalog of the software CVEs affect, built from scratch:

  • about 55,000 vendors
  • more than 215,000 products
  • more than 650,000 versions

CVEs in VulnTracker are resolved against it as they arrive, so a CVE page tells you which vendor, which product and which versions are affected, and which version fixes it.

Built from 400,000 CVE records and 4 million statements

We processed every public CVE record, more than 400,000 of them, together with NVD's product data. Inside them were more than 4 million individual statements about which vendor, product and version a CVE affects, written by hundreds of reporting organisations, each in its own spellings and formats.

The same product can appear under a dozen names across those records. In VTDB each one lives under a single record, and the original spellings stay visible on its page under "Why is it called this?", so you can see exactly what was merged.

Matched to new CVEs every few minutes

VTDB is not a one-off export. It updates continuously:

  1. New CVE records are pulled every few minutes, and changed records are read again.
  2. Each CVE is matched to the vendors and products already in the catalog, straight from the vendor's own record.
  3. Names that don't match exactly are matched with AI (Jev, by TypeSafe), asynchronously in the background.

What you see on every CVE page

Our answer, next to the sources. Each CVE shows VTDB's answer beside the vendor's record as published and NVD's data. You don't have to trust us. You can check us.

Versions, not just product names. Ranges read as one expression, such as 1.24.0 ≤ v < 1.24.4, and every version has its own page.

Less noise. Platforms a flaw only runs on are listed separately and don't count as affected. A Chrome bug that only hits Android stops showing up as a Windows problem.

Honest fix versions. Every fix version says whether the vendor stated it or we inferred it from the affected range, before you schedule the upgrade.

Track the product, not the CVE. Follow a vendor, product or version, and every new CVE that affects it comes to you.

FAQ

Is VTDB free to browse? Yes. The CVE database, vendors and products are open without an account at vulntracker.io/cves. An account is for tracking, alerts and the board.

Does VulnTracker still use NVD? Yes, as one of two sources, alongside the CVE records themselves. Each source adds something: the CVE record carries the vendor's own statement, and NVD adds structured product data and scores.

How often is it updated? New and changed CVE records are pulled every few minutes.

See what affects the software you run

Search for a product you use at vulntracker.io/cves. No account needed.