A working directory of free, publicly available threat intelligence feeds — exploited-vulnerability catalogues, exploit-probability scores, malware and phishing infrastructure, blocklists and community platforms — with what each one contains, how it is accessed, and what it is genuinely useful for.
Most security teams do not need a paid intelligence subscription to start. The public sources below cover the two questions that matter most day to day: which vulnerabilities are being exploited right now, and which addresses, domains and files should be blocked. Each entry lists the publisher, the data format and the access model so you can judge fit before you wire anything into a SIEM or firewall. Access terms and rate limits change — always read the publisher's own current terms before production or commercial use.
The sources that answer “which vulnerabilities matter”. These are the highest-value free feeds for anyone running a vulnerability management or exposure programme, and all four are free without a commercial agreement. CISA Known Exploited Vulnerabilities (KEV) catalog (CISA (US Cybersecurity and Infrastructure Security Agency)): Vulnerabilities with reliable evidence of active exploitation in the wild, each with the vendor, product, required action and — for US federal agencies — a binding remediation due date under BOD 22-01. Format: JSON and CSV, published at a stable URL and updated as entries are added. Access: Free, no registration, US government work with no licence fee. Use it for: The single best free prioritisation signal. Treat KEV membership as an escalation trigger rather than one score among many. EPSS — Exploit Prediction Scoring System (FIRST (EPSS Special Interest Group)): A daily probability, between 0 and 1, that a given CVE will be exploited in the wild in the next 30 days, plus the percentile of that score across all scored CVEs. Format: Daily CSV for bulk download, plus a lookup API intended for single CVEs or small batches rather than bulk pulls. Access: Published daily, free of charge, with no registration required. Use the CSV for bulk work and the API for lookups. Use it for: Ranking the long tail that KEV does not cover. Pair it with exposure and asset context — EPSS is not a complete risk score and says nothing about your environment. NVD — National Vulnerability Database (NIST): The enriched CVE record: descriptions, CVSS vectors and severities, CPE product identifiers, references and change history. Format: REST API (version 2.0) with JSON responses and incremental change feeds. Access: Free. Request a free API key to get a materially higher rate limit, and respect the published request pacing on bulk syncs. Use it for: The descriptive backbone for everything else — product matching via CPE, severity vectors, and vendor references. CVE List (CVE Program) (CVE Program / MITRE): The authoritative record of CVE identifiers themselves, published by CVE Numbering Authorities in the CVE Record Format. Format: JSON 5.x records, downloadable in bulk from the CVE Program's public repositories. Access: Free under the CVE Program's terms of use, which require attribution. Use it for: Getting new identifiers earlier than downstream enrichment, and reconciling records when a downstream database lags. EUVD — European Vulnerability Database (ENISA): ENISA's vulnerability database, established under NIS2, aggregating advisory and vulnerability information relevant to the EU, including exploited-vulnerability views. Format: Web interface with a public API. Access: Free public access. Use it for: EU-facing programmes that need a European reference alongside US sources, and cross-checking advisory coverage. Exploit Database (OffSec): An archive of public exploits and proof-of-concept code, cross-referenced to CVE identifiers where available. Format: Searchable web archive plus a public Git repository with a CSV index. Access: Free. Use it for: Evidence that weaponised code is public for a given CVE — a useful qualifier on top of severity, and one many teams use as a triage tiebreaker.
Indicator feeds for enforcement points: distribution URLs, command-and-control hosts, malware samples and brute-force sources. Check each publisher's current terms — several distinguish community use from commercial use. URLhaus (abuse.ch): Malware distribution URLs shared by the community, with payload family and status, plus bulk lists of active URLs, hosts and payload hashes. Format: CSV, JSON and plain-text lists, with a documented bulk and lookup API. Access: Community API is free under fair-use principles and now uses an abuse.ch account key; commercial or for-profit use may require their paid enhanced API. Use it for: Web proxy, DNS and mail-gateway blocking of live malware distribution infrastructure. MalwareBazaar (abuse.ch): Shared malware samples with hashes, family labels, tags and YARA matches. Format: API and bulk hash exports; samples downloadable for research. Access: Free community access with an abuse.ch account key; review their terms for commercial use. Use it for: Hash-based detection and retro-hunting in EDR, and enriching an alert with a family label. ThreatFox (abuse.ch): Indicators of compromise associated with named malware families — IPs, domains, URLs and hashes with confidence levels. Format: API and downloadable IOC exports in several formats. Access: Free community access with an abuse.ch account key. Use it for: SIEM correlation and detection content tied to a specific family. Feodo Tracker (abuse.ch): Botnet command-and-control servers for banking-trojan and loader families, with an aggressive and a conservative list. Format: Plain-text IP blocklists and JSON. Access: Free. Use it for: Firewall egress blocking of known C2 infrastructure — start with the conservative list. Blocklist.de (Blocklist.de): IP addresses reported by participating operators for SSH, FTP, mail and web attacks, refreshed continuously. Format: Plain-text lists segmented by attacked service. Access: Free. Use it for: Perimeter blocking of brute-force sources. Expect churn, so expire entries rather than blocking permanently. Emerging Threats Open rules (Proofpoint): An open ruleset for Suricata and Snort covering malware, C2, exploit and policy detections. Format: Downloadable rule tarballs, versioned per engine. Access: Free open ruleset under its published licence. Use it for: Network detection where you already run Suricata or Snort — the fastest way to get from a feed to an actual alert.
Feeds aimed at mail security, DNS filtering and browser protection. These are the ones most likely to cause user-visible breakage, so stage them before enforcing. OpenPhish (OpenPhish): A continuously updated stream of verified phishing URLs. Format: Plain-text URL feed; richer commercial tiers available. Access: A free community feed is published for non-commercial use; commercial use is covered by their paid tiers. Use it for: Mail gateway and browser-level phishing blocking. PhishTank (Cisco Talos): Community-submitted and community-verified phishing URLs. Format: Downloadable data and a lookup API. Access: Free with a registered account; review their current terms and availability. Use it for: Cross-checking a reported phishing URL before you act on a user report. Spamhaus DNS blocklists (The Spamhaus Project): DNS-based blocklists covering spam sources, hijacked and misused address space, malicious domains and botnet C2. Format: DNSBL and DBL lookups over DNS; rsync and API access on paid terms. Access: Free for low-volume, non-commercial use through public DNS mirrors; higher volume and commercial use needs their data service. Use it for: Mail filtering and resolver-level blocking — one of the highest-signal free reputation sources available. Tor exit node list (The Tor Project): The current list of Tor exit relays. Format: Plain-text and structured exports. Access: Free. Use it for: Context, not blocking: knowing a login came from an exit node changes how you weigh it. Blocking Tor outright has legitimate-user consequences.
Places where indicators are shared, discussed and packaged — useful when you have an analyst to work them, less useful as an unattended firehose. Open Threat Exchange (OTX) (LevelBlue Labs (formerly AlienVault)): Crowdsourced 'pulses' bundling indicators, adversary context and references, contributed by a large practitioner community. Format: Web platform with a documented REST API and SDKs. Access: Free account required for API access. Use it for: Enriching an indicator with community context during triage, and subscribing to specific contributors rather than everything. MISP default feeds (MISP Project / CIRCL and contributors): A curated list of open feeds that MISP can ingest out of the box, including CIRCL's own OSINT feed and many community sources. Format: MISP JSON and CSV feed definitions, ingested by a MISP instance. Access: Free; individual feeds carry their own publisher terms. Use it for: Running your own aggregation and deduplication layer instead of wiring a dozen feeds into a SIEM directly. CISA advisories and ICS advisories (CISA): Government advisories including joint threat advisories and dedicated industrial control system advisories with affected products and mitigations. Format: Web, RSS and structured advisory formats. Access: Free, no registration. Use it for: OT and critical-infrastructure estates, where vendor advisories arrive here before they reach vulnerability databases.
For completeness, here is what VulnTrek publishes free and without an account. These are read-only views over the public sources above — they are not a separate intelligence source, and they carry no licence beyond the upstream publishers' own. CISA KEV checker (VulnTrek): Paste a CVE identifier and see whether it is in the KEV catalog, with the date added, the required action, the US remediation due date and its EPSS score. Format: Browser tool. Access: Free, no account, no key. Use it for: Settling a single 'is this being exploited?' question in seconds during triage. Threat intelligence explorer (VulnTrek): Search the mirrored KEV catalogue, ENISA EUVD records and IT/OT vendor advisories in one place, with per-CVE detail pages. Format: Browser interface over the mirrored public corpus. Access: Free, no account. Use it for: Browsing exploited-vulnerability data without building an ingestion pipeline first. Threat intelligence MCP server (VulnTrek): The same read-only lookups exposed as Model Context Protocol tools, so an assistant such as Claude or Cursor can query KEV, EUVD and advisory data directly. Format: MCP server with read-only tools. Access: Free, no key. Use it for: Letting an assistant fetch exploitation facts instead of guessing them.
Start with the vulnerability and exploitation sources: CISA KEV tells you what is confirmed exploited, EPSS tells you what is likely to be, and NVD or the CVE List supplies the descriptive record behind both. Those three answer prioritisation questions and cost nothing. Add malware and phishing infrastructure feeds only where you have somewhere to enforce them — a firewall, DNS resolver, mail gateway or SIEM detection. Community platforms and rule sets are worth it once you have an analyst who can triage a false positive; without that, a high-volume indicator feed creates work rather than reducing it.
A feed is raw input, not a decision. Public indicator lists carry false positives, differ in refresh cadence, and rarely tell you whether the indicator touches an asset you actually own. Blocking straight from a community list without an exception path will eventually break something legitimate. Exploitation data has the same limit in the other direction: KEV membership and a high EPSS score describe the world, not your estate — they say nothing about whether the affected version is deployed, reachable, or already compensated for. The value appears when feed data is correlated against your own inventory and ownership, which is the work VulnTrek does after ingestion.
Pick the decision first: Name the decision the feed should change — block at the perimeter, raise a detection, escalate a CVE. A feed with no attached decision is a subscription, not a control. Respect the publisher's pacing: Use bulk files for bulk work and lookup APIs for single items. Polling a lookup API in a loop is the fastest way to get rate-limited or blocked, and it is explicitly discouraged by several publishers. Normalise before you correlate: Different feeds name the same thing differently. Reduce indicators to a common shape and deduplicate on identity before anything downstream sees them, or you will count the same host four times. Match against your own inventory: An indicator or CVE only becomes actionable once it lands on an asset you own, with someone accountable for it. This is the step most feed integrations skip and the reason feed volume rarely converts into fixes. Stage enforcement: Run new indicator feeds in alert-only mode first and keep an exception path. Community lists carry false positives, and a blocked payment provider costs more than the blocked malware saved. Expire entries: Attacker infrastructure is rented and recycled. Age indicators out on a schedule instead of accumulating a blocklist that only ever grows.