How it works
Pick a real CVE from the live feed and launch a Solana coin on it. Every coin is filed under its CVE.
How filing works
- 01 of 03
Pick a CVE
Choose a vulnerability from the live feed, or paste any CVE ID, old or new. Its record comes from NVD, word for word.
- 02 of 03
Launch the coin
Give it a picture, a name and a ticker. Your wallet approves one plain SOL payment. Nothing else.
- 03 of 03
It is filed under the CVE
The coin is created on pump.fun with its fee split locked, and listed on the CVE’s record for anyone to find and trade.
What it costs
- pump.fun creation, network fees and a small buffer
- 0.025 SOL
- Dev buy (optional, up to 20 SOL)
- what you choose
- A launch fee to Patch Day
- none
What isn't used comes back to your wallet when the launch finishes. The exact amount is shown before your wallet opens.
What your wallet signs
One plain SOL payment, to a wallet made only for your launch. Nothing else: no approvals, no second signature, nothing signed for you in advance.
Creating a coin needs a second signature, from the new coin itself. Wallets warn about transactions with two signers, so the launch wallet signs on our side, launches the coin, and sends the tokens from your dev buy and everything left back to you. If the launch fails, all of it comes back.
Where the fees go
pump.fun pays a creator fee on every trade of a coin. Patch Day locks how that fee is split in the launch transaction itself:
80% to the launcher20% to the Patch Day treasury
Locked at launch on pump.fun. Nobody can change it later, including us. The coin's creator on pump.fun is the launch wallet, which signs the creation, so the coin is created on chain from the first moment.
Where the data comes from
Every record comes from the US National Vulnerability Database (NVD), through its public API, read about once an hour. The feed holds the newest 300; any older record opens by its ID. The description, score, vector, affected software and dates are NVD's, word for word. When NVD is slow or down, the site shows its last saved copy, and the feed says so.
Only the public record. No exploit code, no proofs of concept: every record links to NVD and the vendor’s own advisory.
CVE data from NVD. This product uses data from the NVD API but is not endorsed or certified by the NVD. Not affiliated with MITRE, NIST, CISA or the vendors named. CVE is a trademark of MITRE.
Questions
What is a CVE?
A CVE is a public ID for one known security flaw, like CVE-2021-44228. NVD, run by the US National Institute of Standards and Technology, publishes each one with a description and, usually, a severity score from 0 to 10.
Where does the feed come from?
From NVD’s public API, read about once an hour. If NVD is slow or down, the site shows its last saved copy and says so at the top of the feed.
Does a coin say anything about the vulnerability?
No. A coin is filed under a CVE so people can find it there. Its price says nothing about how dangerous the flaw is, whether it is fixed, or who is affected.
Can there be more than one coin per CVE?
Yes. Every coin filed under a CVE is listed on its record, with its trading.
What does my wallet sign?
One plain SOL payment to a wallet made just for your launch. Nothing else: no approvals, no second signature.
Why not sign the coin creation myself?
Creating a coin needs a second signature, from the new coin itself. Wallets warn about transactions that need two signers, so the launch wallet signs both on our side, and you only ever sign the payment.
What if the launch fails?
Everything you paid goes back to the wallet that paid it.
Can the fee split change later?
No. It is locked on pump.fun in the launch transaction. Nobody can change it, including us.
Do you publish exploits?
No. Patch Day shows the public record only, and drops references NVD tags as exploits. If you found a flaw yourself, report it to the vendor first.
Risks, plainly
- Memecoins can go to zero. Nothing here is financial advice.
- A coin filed under a CVE has nothing to do with the software’s maker, and says nothing about the flaw.
- Scores and descriptions change as NVD analyses a record. The record shown is the latest we read, with its date.
- You are trusting Patch Day to run each launch as described, and pump.fun to run the coin.