Terms of Use

What you may use it for

Use EVULNABLE to research vulnerabilities, prioritize your own patching, evaluate vendors, and generate reports for your own organization. Take the exports and use them in your own work — that is what they are for.

There is no account, no license key and nothing to sign. Using the site is your acceptance of these terms; if you do not accept them, do not use it.

What you may not do

• Submit data you are not authorized to submit — a client's scan you have no permission to share, a domain you have no relationship with.
• Use the DNS checker or any other tool here to probe systems you do not own or have written permission to test.
• Attempt to disrupt the service, evade its rate limits, or extract data by automated means beyond ordinary use.
• Present EVULNABLE's output as your own original analysis, or as an accredited assessment, audit or certification. It is none of those.

What you upload, and what happens to it

You are responsible for the legal basis on which you submit anything: that you have the right to hold it, the right to run it through a third-party service, and the right to whatever the file happens to contain. A scanner export can carry hostnames, addresses, asset names and comments written by people who did not expect them to leave the building.

An analysis lives in this server's memory and is released when it expires — 30 minutes — when you clear it, or when the service restarts. There is no account to look up and no stored copy to retrieve. Privacy and data handling sets out exactly what that means, what is logged separately, and where the limits of those statements are. Read it: it is more specific than this page, and where the two differ it is the more accurate.

If the data is regulated, contractually restricted, or would be damaging in the wrong hands, run the analysis somewhere you control instead.

What the output is and is not

The EVULNABLE Risk Score combines published severity, exploitation status and probability data into one ordering. It is a judgment about urgency given public evidence, made without any knowledge of your network, your compensating controls, your exposure, or what a given system is worth to you. A finding this site ranks low may be the most dangerous thing you have; one it ranks Immediate may be unreachable in your environment.

Nothing here is a penetration test, a vulnerability assessment, an audit, a certification, or a compliance attestation. It does not satisfy a regulatory testing requirement and does not claim to.

Third-party data

Most of what this site shows originates elsewhere — CISA, FIRST, NIST, Microsoft, Linux distributions and individual vendors, each named on the Third-party notices page and linked from the entries that use them. That data can be wrong, incomplete, delayed or withdrawn, and EVULNABLE reproduces it as published. Where a source says nothing, this site says so rather than filling the gap.

Vendor comparisons

The comparison pages are independent research, not endorsements, and this project has no commercial relationship with any vendor listed. Prices, accreditations and capabilities change; every figure carries the date it was checked and whether the vendor published it or this project estimated it. Confirm anything you intend to rely on directly with the vendor.

Who owns what

Facts are not owned. CVE identifiers, CISA KEV listings, EPSS probabilities, vendor advisories and lifecycle dates belong to whoever publishes them, under their own terms, and this site passes them through with attribution.

What this project created is its own: the EVULNABLE Risk Score and its methodology, the priority band vocabulary, the written summaries and explanations, the vendor comparisons and their research, the generated report layouts, and the name and marks.

You may quote and reference EVULNABLE-created content with attribution and a link. Reproducing it wholesale, reselling it, or building a competing product on the score is a different question — ask, and the answer will probably be yes for anything reasonable. It is better recorded than assumed.

No warranty, and the limits of liability

EVULNABLE is provided as is and as available, without warranty of any kind, express or implied — including any implied warranty of merchantability, fitness for a particular purpose, accuracy, or non-infringement. There is no service level, no uptime commitment, and no guarantee that the site will be available, correct, or current at any moment.

To the fullest extent the law allows, this project is not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data, profits, revenue or goodwill, arising from your use of the site or reliance on anything it says — including a vulnerability it ranked low, a source that was wrong, a report that was incomplete, or a period when it did not work.

Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, so parts of this may not apply to you. Nothing here limits liability that cannot lawfully be limited.

Suspension, changes, and law

Abuse. Access may be rate-limited or blocked where use threatens the service or other people using it. No notice is promised and none is practical — there are no accounts to notify.

Changes. These terms may change as the site does. The current version is always the one on this page, and material changes will be noted here rather than applied silently.

Availability. This is a free project run by one person. It may change, break, or stop.

Governing law. These terms are governed by the laws of the United States, without regard to conflict-of-laws rules.

Questions, corrections, disputes

If something here is wrong about you or your product, or you want to use EVULNABLE-created content in a way this page does not obviously cover, get in touch — that is a faster route than a legal one and the one this project would rather you take.

[email protected]