# ziro.sh

> A small, human-reviewed feed of actively exploited and high-impact vulnerabilities, mapped to package names, affected version ranges and fix versions. Free JSON, RSS and Markdown for people and coding agents.

All data is static, public and keyless. Every JSON file is wrapped as {schema_version, generated_at, data} so clients can pin schema_version 1.

## When to use

- Use ziro.sh to answer "is anything exploited right now that touches these dependencies, and which version fixes it?"
- Use it to get a short, human-reviewed list of what to patch this week, with the first safe version per package.
- `fixed` lists the first safe version on each release line. Upgrade to the smallest one above the installed version, not the highest, so you don't take a breaking major bump you don't need.
- Do not use it as a complete CVE database: most CVEs are deliberately left out. Use NVD or OSV.dev for full coverage.
- It never contains exploit code or reproduction steps.

## Inclusion rule

- It is in the CISA Known Exploited Vulnerabilities catalog.
- Its EPSS exploit probability is above 0.5.
- A vendor advisory confirms exploitation in the wild.
- It affects a common stack: Node, Python, PHP, Go, Rust, Postgres, Redis, nginx, Cloudflare, AWS, Vercel or Railway.

## Data

- [/feed.json](https://6b2fe323.ziro-sh.pages.dev/feed.json): Records from the last 30 days, newest first.
- [/records.json](https://6b2fe323.ziro-sh.pages.dev/records.json): Every published record.
- https://6b2fe323.ziro-sh.pages.dev/cve/{id}.json: One record by CVE or incident id.
- https://6b2fe323.ziro-sh.pages.dev/week/{yyyy-ww}.json: One ISO week of records.
- [/schema/record.v1.json](https://6b2fe323.ziro-sh.pages.dev/schema/record.v1.json): JSON Schema for a record.
- [/openapi.json](https://6b2fe323.ziro-sh.pages.dev/openapi.json): OpenAPI 3.1 description of these endpoints.
- [/rss.xml](https://6b2fe323.ziro-sh.pages.dev/rss.xml): RSS 2.0 feed of the last 30 days.
- [/llms.txt](https://6b2fe323.ziro-sh.pages.dev/llms.txt): Index of everything here, for language models.

## Pages (send Accept: text/markdown for Markdown)

- [Home and this week](https://6b2fe323.ziro-sh.pages.dev/): this week's records
- [API docs](https://6b2fe323.ziro-sh.pages.dev/docs): endpoints, record fields, errors
- [About](https://6b2fe323.ziro-sh.pages.dev/about): scope, sources, review and corrections
- [Contact](https://6b2fe323.ziro-sh.pages.dev/contact): corrections and questions
- [Privacy](https://6b2fe323.ziro-sh.pages.dev/privacy): no accounts, cookies or client analytics

## Price

Free. No account, API key or paid tier.

## Optional

- [Sitemap](https://6b2fe323.ziro-sh.pages.dev/sitemap.xml)
- [API catalog](https://6b2fe323.ziro-sh.pages.dev/.well-known/api-catalog)