NVD CVE API

openapi: 3.1.0
info:
  title: NVD CPE CVE API
  description: 'The NVD CVE API provides programmatic access to CVE (Common Vulnerabilities and Exposures) records including CVSS severity scores, affected product lists, CWE classifications, and reference links. Without an API key: 5 requests per 30 seconds; with key: 50 requests per 30 seconds.'
  version: 2.0.0
  contact:
    name: NVD Support
    url: https://nvd.nist.gov/general/contact
  license:
    name: Public Domain (US Government)
    url: https://nvd.nist.gov/developers/terms-of-use
servers:
- url: https://services.nvd.nist.gov/rest/json
  description: NVD REST API v2
security:
- {}
- APIKey: []
tags:
- name: CVE
  description: Common Vulnerabilities and Exposures records
paths:
  /cves/2.0:
    get:
      operationId: getCVEs
      summary: Get CVE records
      description: Retrieve one or more CVE records. Use cveId to get a single CVE, or use filters to query a range. Maximum 2000 results per page. Use startIndex for pagination. Date ranges must not span more than 120 days.
      tags:
      - CVE
      parameters:
      - name: cveId
        in: query
        schema:
          type: string
          pattern: ^CVE-[0-9]{4}-[0-9]{4,}$
        description: Specific CVE ID (e.g., CVE-2021-44228)
      - name: keywordSearch
        in: query
        schema:
          type: string
        description: Free text search across CVE description
      - name: keywordExactMatch
        in: query
        schema:
          type: boolean
        description: Require exact keyword match when true
      - name: cvssV3Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
        description: Filter by CVSS v3.x base severity
      - name: cvssV2Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
        description: Filter by CVSS v2.0 base severity
      - name: cvssV3Metrics
        in: query
        schema:
          type: string
        description: Filter by CVSS v3 vector string
      - name: cweId
        in: query
        schema:
          type: string
          pattern: ^CWE-[0-9]+$
        description: CWE weakness ID (e.g., CWE-79)
      - name: cpeName
        in: query
        schema:
          type: string
        description: CPE 2.3 formatted string to find CVEs affecting a specific product
      - name: isVulnerable
        in: query
        schema:
          type: boolean
        description: When true, only return CVEs where the CPE match is vulnerable (must use cpeName)
      - name: virtualMatchString
        in: query
        schema:
          type: string
        description: CPE match string with wildcards
      - name: pubStartDate
        in: query
        schema:
          type: string
          format: date-time
        description: CVE publication start date (ISO 8601, max 120-day range)
      - name: pubEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: lastModStartDate
        in: query
        schema:
          type: string
          format: date-time
        description: Last modification start date
      - name: lastModEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: sourceIdentifier
        in: query
        schema:
          type: string
        description: CVE source organization identifier
      - name: hasKev
        in: query
        schema:
          type: boolean
        description: When true, only return CVEs in CISA's Known Exploited Vulnerabilities catalog
      - name: hasCertAlerts
        in: query
        schema:
          type: boolean
      - name: hasCertNotes
        in: query
        schema:
          type: boolean
      - name: hasOval
        in: query
        schema:
          type: boolean
      - name: noRejected
        in: query
        schema:
          type: boolean
        description: Exclude CVEs with REJECTED status
      - name: resultsPerPage
        in: query
        schema:
          type: integer
          default: 2000
          maximum: 2000
        description: Number of results per page (max 2000)
      - name: startIndex
        in: query
        schema:
          type: integer
          default: 0
        description: Zero-based start index for pagination
      responses:
        '200':
          description: CVE results
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Rate limit (5 without key, 50 with key, per 30 seconds)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CVEResponse'
        '400':
          description: Bad request — invalid parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: API key required or invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CVE:
      type: object
      description: A CVE vulnerability record
      properties:
        id:
          type: string
          description: CVE identifier
          pattern: ^CVE-[0-9]{4}-[0-9]{4,}$
        sourceIdentifier:
          type: string
          description: Assigning CNA (CVE Numbering Authority) identifier
        published:
          type: string
          format: date-time
          description: Date the CVE was published in NVD
        lastModified:
          type: string
          format: date-time
        vulnStatus:
          type: string
          enum:
          - Analyzed
          - Awaiting Analysis
          - Undergoing Analysis
          - Modified
          - Deferred
          - Rejected
          - Received
        descriptions:
          type: array
          items:
            type: object
            properties:
              lang:
                type: string
                description: ISO 639-1 language code
              value:
                type: string
                description: CVE description text
        metrics:
          type: object
          properties:
            cvssMetricV31:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV3'
            cvssMetricV30:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV3'
            cvssMetricV2:
              type: array
              items:
                $ref: '#/components/schemas/CVSSMetricV2'
        weaknesses:
          type: array
          items:
            type: object
            properties:
              source:
                type: string
              type:
                type: string
              description:
                type: array
                items:
                  type: object
                  properties:
                    lang:
                      type: string
                    value:
                      type: string
        configurations:
          type: array
          items:
            $ref: '#/components/schemas/CVEConfiguration'
        references:
          type: array
          items:
            type: object
            properties:
              url:
                type: string
                format: uri
              source:
                type: string
              tags:
                type: array
                items:
                  type: string
        cisaExploitAdd:
          type: string
          format: date
          description: Date added to CISA KEV catalog
        cisaActionDue:
          type: string
          format: date
        cisaRequiredAction:
          type: string
        cisaVulnerabilityName:
          type: string
    CVEResponse:
      type: object
      properties:
        resultsPerPage:
          type: integer
        startIndex:
          type: integer
        totalResults:
          type: integer
        format:
          type: string
        version:
          type: string
        timestamp:
          type: string
          format: date-time
        vulnerabilities:
          type: array
          items:
            type: object
            properties:
              cve:
                $ref: '#/components/schemas/CVE'
    ErrorResponse:
      type: object
      properties:
        message:
          type: string
    CVSSMetricV3:
      type: object
      properties:
        source:
          type: string
        type:
          type: string
          enum:
          - Primary
          - Secondary
        cvssData:
          type: object
          properties:
            version:
              type: string
              enum:
              - '3.0'
              - '3.1'
            vectorString:
              type: string
              pattern: ^CVSS:3\.[01]/
            attackVector:
              type: string
              enum:
              - NETWORK
              - ADJACENT_NETWORK
              - LOCAL
              - PHYSICAL
            attackComplexity:
              type: string
              enum:
              - LOW
              - HIGH
            privilegesRequired:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            userInteraction:
              type: string
              enum:
              - NONE
              - REQUIRED
            scope:
              type: string
              enum:
              - UNCHANGED
              - CHANGED
            confidentialityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            integrityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            availabilityImpact:
              type: string
              enum:
              - NONE
              - LOW
              - HIGH
            baseScore:
              type: number
              minimum: 0
              maximum: 10
            baseSeverity:
              type: string
              enum:
              - NONE
              - LOW
              - MEDIUM
              - HIGH
              - CRITICAL
        exploitabilityScore:
          type: number
        impactScore:
          type: number
    CVEConfiguration:
      type: object
      properties:
        nodes:
          type: array
          items:
            type: object
            properties:
              operator:
                type: string
                enum:
                - AND
                - OR
              negate:
                type: boolean
              cpeMatch:
                type: array
                items:
                  type: object
                  properties:
                    vulnerable:
                      type: boolean
                    criteria:
                      type: string
                      description: CPE 2.3 match string
                    matchCriteriaId:
                      type: string
                      format: uuid
                    versionStartIncluding:
                      type: string
                    versionStartExcluding:
                      type: string
                    versionEndIncluding:
                      type: string
                    versionEndExcluding:
                      type: string
    CVSSMetricV2:
      type: object
      properties:
        source:
          type: string
        type:
          type: string
          enum:
          - Primary
          - Secondary
        cvssData:
          type: object
          properties:
            version:
              type: string
              enum:
              - '2.0'
            vectorString:
              type: string
            baseScore:
              type: number
              minimum: 0
              maximum: 10
        baseSeverity:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
  securitySchemes:
    APIKey:
      type: apiKey
      in: header
      name: apiKey
      description: 'NVD API key (optional but recommended). Without a key: 5 requests/30s. With a key: 50 requests/30s. Request at https://nvd.nist.gov/developers/request-an-api-key'
externalDocs:
  description: NVD Developer Documentation
  url: https://nvd.nist.gov/developers/vulnerabilities