Pricing

A single, actionable label per CVE — one of ACTIVELY_EXPLOITED, WEAPONIZED, POC_AVAILABLE, THEORETICAL, or NOT_APPLICABLE — derived deterministically from public threat-intel signals (CISA KEV, EPSS, Metasploit, Nuclei, ExploitDB, GitHub PoCs). Every verdict ships with a 0–100 exploitability score and the list of sources used.

No. 7-Day Pass costs USD 4.99 once for 7 days and 20 distinct CVEs. Analyst costs USD 24.99 per month for 150 distinct CVEs and 30 days of history. Reopening a CVE within the same paid period does not consume another slot. Invalid identifiers, missing CVEs, and pending analyses do not consume the allowance. Both plans are web only, with no API, webhooks or CSV uploads. No Telegram account is required.

All API calls from any of the 3 seats count against one org-wide pool of 150,000 / day. The counter resets at UTC midnight. Enterprise is different — each seat has its own 200,000 / day pool, so a 10-seat Enterprise org has 2,000,000 / day in aggregate without any one seat being able to starve another.

Contact support@realexploit.io to change an existing plan. We confirm the effective date and any charge or credit before applying it. You can cancel renewal from Billing and keep the period already paid.

No. Pass includes 20 distinct CVEs for its 7-day period. Analyst includes 150 distinct CVEs for each paid monthly period. Unused allowance does not carry over. Pro, Team and Enterprise API quotas reset daily at UTC midnight.

There are no overage charges or automatic upgrades. Pass and Analyst can reopen CVEs already counted in the current paid period; new CVEs require a new paid period or a plan change. API quota errors return HTTP 429 with rate-limit headers; daily API quotas reset at UTC midnight.

The file limit is the largest batch shape accepted by your plan; quota is the number of lookups you still have available. A batch must fit both. We reject the complete request before processing if it exceeds either limit, so there is no ambiguous partial result or automatic overage charge. To protect shared capacity, CSV creation across sync and async modes is also limited to 100 persisted upload attempts per rolling 24 hours: per user on Pro and Enterprise, and shared by a Team organization. Idempotent retries do not consume another slot; completed, cancelled, failed, and quota-rejected attempts remain in the window. A separate, non-refundable creation budget counts unique CVEs submitted to asynchronous jobs in the same rolling window: 150,000 per Team organization and 200,000 per Enterprise seat. Quota-rejected, cancelled, and failed attempts remain in this abuse-control budget, although normal lookup-quota refunds still apply. Exact idempotent retries do not consume this creation budget.

None. The price you see is the only price — Creem handles global tax and VAT inclusive of the listed amount.

Contact us for educational and non-profit pricing — case-by-case basis. Email support@realexploit.io with proof of affiliation.

All signals come from public, commercially-usable feeds: CISA KEV (public domain), NVD (US government work), FIRST.org EPSS (CC BY 4.0), ExploitDB, Rapid7's Metasploit Framework (BSD-3), ProjectDiscovery's Nuclei templates (MIT), and curated GitHub PoC indexes (we link out, never redistribute exploit code). Attribution and license details ship in every response's meta.sources field.

7-Day Pass is a one-time purchase and never auto-renews. Analyst, Pro, Team and Enterprise renew monthly until canceled. Cancel renewal from Billing; access remains available through the period already paid.

Account and job data are protected by encrypted HTTPS connections with TLS 1.3 support, access controls, and private storage for temporary exports. See the Privacy Policy for hosting regions, international transfers, and retention.

Creem (Armitage Labs OÜ) acts as Merchant of Record. They handle global tax collection (VAT, GST, sales tax), receipts, dunning, and chargebacks. We never see your card number.

No. Pro is single-seat by design and the web console enforces single active session per user — a new login revokes the prior session. For multi-person use, choose Team (3 seats) or Enterprise (10 seats).

Yes — 14-day money-back guarantee for first-time customers. Full details on the Refund Policy.