NVD

NVD CVE API

Common Vulnerabilities and Exposures records

GitHub OpenAPI

Operations 1

GET /cves/2.0 Get CVE records #

Documentation

📖
Documentation
https://nvd.nist.gov/developers/vulnerabilities
📖
GettingStarted
https://nvd.nist.gov/developers/start-here
📖
Authentication
https://nvd.nist.gov/developers/request-an-api-key
📖
RateLimits
https://nvd.nist.gov/developers/start-here
📖
Documentation
https://nvd.nist.gov/developers/products
📖
Documentation
https://nvd.nist.gov/developers/data-sources

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/nvd/refs/heads/main/openapi/nvd-cve-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/nvd/refs/heads/main/json-schema/nvd-cve-schema.json

Other Resources

🔗
JSONLDContext
https://raw.githubusercontent.com/api-evangelist/nvd/refs/heads/main/json-ld/nvd-context.jsonld

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/nvd-cve-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

nvd-cve-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: NVD CPE CVE API
  description: 'The NVD CVE API provides programmatic access to CVE (Common Vulnerabilities and Exposures) records including CVSS severity scores, affected product lists, CWE classifications, and reference links. Without an API key: 5 requests per 30 seconds; with key: 50 requests per 30 seconds.'
  version: 2.0.0
  contact:
    name: NVD Support
    url: https://nvd.nist.gov/general/contact
  license:
    name: Public Domain (US Government)
    url: https://nvd.nist.gov/developers/terms-of-use
servers:
- url: https://services.nvd.nist.gov/rest/json
  description: NVD REST API v2
security:
- {}
- APIKey: []
tags:
- name: CVE
  description: Common Vulnerabilities and Exposures records
paths:
  /cves/2.0:
    get:
      operationId: getCVEs
      summary: Get CVE records
      description: Retrieve one or more CVE records. Use cveId to get a single CVE, or use filters to query a range. Maximum 2000 results per page. Use startIndex for pagination. Date ranges must not span more than 120 days.
      tags:
      - CVE
      parameters:
      - name: cveId
        in: query
        schema:
          type: string
          pattern: ^CVE-[0-9]{4}-[0-9]{4,}$
        description: Specific CVE ID (e.g., CVE-2021-44228)
      - name: keywordSearch
        in: query
        schema:
          type: string
        description: Free text search across CVE description
      - name: keywordExactMatch
        in: query
        schema:
          type: boolean
        description: Require exact keyword match when true
      - name: cvssV3Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
        description: Filter by CVSS v3.x base severity
      - name: cvssV2Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
        description: Filter by CVSS v2.0 base severity
      - name: cvssV3Metrics
        in: query
        schema:
          type: string
        description: Filter by CVSS v3 vector string
      - name: cweId
        in: query
        schema:
          type: string
          pattern: ^CWE-[0-9]+$
        description: CWE weakness ID (e.g., CWE-79)
      - name: cpeName
        in: query
        schema:
          type: string
        description: CPE 2.3 formatted string to find CVEs affecting a specific product
      - name: isVulnerable
        in: query
        schema:
          type: boolean
        description: When true, only return CVEs where the CPE match is vulnerable (must use cpeName)
      - name: virtualMatchString
        in: query
        schema:
          type: string
        description: CPE match string with wildcards
      - name: pubStartDate
        in: query
        schema:
          type: string
          format: date-time
        description: CVE publication start date (ISO 8601, max 120-day range)
      - name: pubEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: lastModStartDate
        in: query
        schema:
          type: string
          format: date-time
        description: Last modification start date
      - name: lastModEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: sourceIdentifier
        in: query
        schema:
          type: string
        description: CVE source organization identifier
      - name: hasKev
        in: query
        schema:
          type: boolean
        description: When true, only return CVEs in CISA's Known Exploited Vulnerabilities catalog
      - name: hasCertAlerts
        in: query
        schema:
          type: boolean
      - name: hasCertNotes
        in: query
        schema:
          type: boolean
      - name: hasOval
        in: query
        schema:
          type: boolean
      - name: noRejected
        in: query
        schema:
          type: boolean
        description: Exclude CVEs with REJECTED status
      - name: resultsPerPage
        in: query
        schema:
          type: integer
          default: 2000
          maximum: 2000
        description: Number of results per page (max 2000)
      - name: startIndex
        in: query
        schema:
          type: integer
          default: 0
        description: Zero-based start index for pagination
      responses:
        '200':
          description: CVE results
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Rate limit (5 without key, 50 with key, per 30 seconds)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CVEResponse'
        '400':
          description: Bad request — invalid parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: API key required or invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CVEConfiguration:
      type: object
      properties:
        nodes:
          type: array
          items:
            type: object
            properties:
              operator:
                type: string
                enum:
                - AND
                - OR
              negate:
                type: boolean
              cpeMatch:
                type: array
                items:
                  type: object
                  properties:
                    vulnerable:
                      type: boolean
                    criteria:
                      type: string
                      description: CPE 2.3 match string
                    matchCriteriaId:
                      type: string
                      format: uuid
                    versionStartIncluding:
                      type: string
                    versionStartExcluding:
                      type: string
                    versionEndIncluding:
                      type: string
                    versionEndExcluding:
                      type: string
    CVE:
      type: object
      description: A CVE vulnerability record
      properties:
        id:
          type: string
          description: CVE identifier
          pattern: ^CVE-[0-9]{4}-[0-9]{4,}$
        sourceIdentifier:
          type: string
          description: Assigning CNA (CVE Numbering Authority) identifier
        published:
          type: string
          format: date-time
          description: Date the CVE was published in NVD
        lastModified:
          type: string
          format: date-time
        vulnStatus:
          type: string
          enum:
          - Analyzed
          - Awaiting Analysis
          - Undergoing Analysis
          - Modified
          - Deferred
          - Rejected
          - Received
        descriptions:
          type: array
          items:
            type: object
            properties:
              lang:
                type: string
                description: ISO 639-1 language code
              value:
                type: string
                description: CVE description text
        metrics:
          type: object
          properties:
            cvssMetricV31:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV3'
            cvssMetricV30:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV3'
            cvssMetricV2:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV2'
        weaknesses:
          type: array
          items:
            type: object
            properties:
              source:
                type: string
              type:
                type: string
              description:
                type: array
                items:
                  type: object
                  properties:
                    lang:
                      type: string
                    value:
                      type: string
        configurations:
          type: array
          items:
            $ref: '#/components/schemas/CVEConfiguration'
        references:
          type: array
          items:
            type: object
            properties:
              url:
                type: string
                format: uri
              source:
                type: string
              tags:
                type: array
                items:
                  type: string
        cisaExploitAdd:
          type: string
          format: date
          description: Date added to CISA KEV catalog
        cisaActionDue:
          type: string
          format: date
        cisaRequiredAction:
          type: string
        cisaVulnerabilityName:
          type: string
    ErrorResponse:
      type: object
      properties:
        message:
          type: string
    CVEResponse:
      type: object
      properties:
        resultsPerPage:
          type: integer
        startIndex:
          type: integer
        totalResults:
          type: integer
        format:
          type: string
        version:
          type: string
        timestamp:
          type: string
          format: date-time
        vulnerabilities:
          type: array
          items:
            type: object
            properties:
              cve:
                $ref: '#/components/schemas/CVE'
    CVSSMetricV3:
      type: object
      properties:
        source:
          type: string
        type:
          type: string
          enum:
          - Primary
          - Secondary
        cvssData:
          type: object
          properties:
            version:
              type: string
              enum:
              - '3.0'
              - '3.1'
            vectorString:
              type: string
              pattern: ^CVSS:3\.[01]/
            attackVector:
              type: string
              enum:
              - NETWORK
              - ADJACENT_NETWORK
              - LOCAL
              - PHYSICAL
            attackComplexity:
              type: string
              enum:
              - LOW
              - HIGH
            privilegesRequired:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            userInteraction:
              type: string
              enum:
              - NONE
              - REQUIRED
            scope:
              type: string
              enum:
              - UNCHANGED
              - CHANGED
            confidentialityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            integrityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            availabilityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            baseScore:
              type: number
              minimum: 0
              maximum: 10
            baseSeverity:
              type: string
              enum:
              - NONE
              - LOW
              - MEDIUM
              - HIGH
              - CRITICAL
        exploitabilityScore:
          type: number
        impactScore:
          type: number
    CVSSMetricV2:
      type: object
      properties:
        source:
          type: string
        type:
          type: string
          enum:
          - Primary
          - Secondary
        cvssData:
          type: object
          properties:
            version:
              type: string
              enum:
              - '2.0'
            vectorString:
              type: string
            baseScore:
              type: number
              minimum: 0
              maximum: 10
        baseSeverity:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
  securitySchemes:
    APIKey:
      type: apiKey
      in: header
      name: apiKey
      description: 'NVD API key (optional but recommended). Without a key: 5 requests/30s. With a key: 50 requests/30s. Request at https://nvd.nist.gov/developers/request-an-api-key'
externalDocs:
  description: NVD Developer Documentation
  url: https://nvd.nist.gov/developers/vulnerabilities