This policy explains how CVEs Live (cves.live), operated by CVEs Live, handles personal data. It is written to meet the GDPR, UK GDPR and Brazil's LGPD.
1. What you type stays on your device
The tools on this site run in your browser. Values you enter are not sent to or stored on our servers. When the site remembers preferences or drafts it uses your browser's local storage, which you can clear at any time.
2. Consent (Google Consent Mode v2)
Until you choose, all measurement and advertising signals are denied by default (ad_storage, ad_user_data, ad_personalization, analytics_storage). Your choice is stored locally and can be changed anytime in (also in the footer). This site currently uses nothing that requires consent, so no cookie notice is shown.
3. Audience measurement
If we enable audience measurement, we will use Cloudflare Web Analytics, which measures visits in aggregate, without cookies and without identifying you.
4. Advertising
This site does not show ads at the moment. If we start showing Google AdSense ads, they will respect your consent choice and this policy will be updated first.
5. Hosting and technical logs
The site is served by Cloudflare, which processes technical connection data (IP address, browser, time) to deliver pages and prevent abuse. We do not use it to identify you.
6. Your rights
You may request access, correction or deletion of personal data and withdraw consent at any time. Since we do not store what you type, clearing your browser storage removes it. Contact: the contact channel listed on this site.
7. Site-specific information
The "My stack" filter is saved in this browser (localStorage, key "cves:stack") and written to the page address when you filter, so the view can be shared as a link. It is not sent to us.
The CVE lookup and the EPSS lookup send the CVE identifiers you type straight from your browser to api.first.org (FIRST) and cveawg.mitre.org (CVE Program). Those services receive your IP address like any website you visit; we do not see or store the identifiers.
The lists are read from a catalog file on this same site (/data/kev.json). No account exists and nothing you do on the pages is recorded on a server of ours.