openapi: 3.0.3
info:
  title: NIST National Vulnerability Database (NVD) CPE CVE API
  description: The National Vulnerability Database (NVD) API, operated by the National Institute of Standards and Technology, provides programmatic access to Common Vulnerabilities and Exposures (CVE) records, CVE change history, and Common Platform Enumeration (CPE) records. The API supports pagination, filtering, and date-range queries for vulnerability and product data.
  version: 2.0.0
  contact:
    name: NIST NVD
    url: https://nvd.nist.gov/developers
servers:
- url: https://services.nvd.nist.gov
  description: NVD production services
tags:
- name: CVE
  description: Common Vulnerabilities and Exposures
paths:
  /rest/json/cves/2.0:
    get:
      tags:
      - CVE
      summary: Search CVE records
      description: Retrieve CVE records with optional filters by CPE name, CVSS metrics, CWE ID, keyword, KEV catalog membership, source, version range, and publication or modification date ranges.
      operationId: getCves
      parameters:
      - name: cpeName
        in: query
        description: Filter by specific CPE name.
        schema:
          type: string
      - name: cveId
        in: query
        description: Retrieve a specific CVE by its identifier.
        schema:
          type: string
      - name: cveTag
        in: query
        description: Filter by CVE tag (disputed, unsupported-when-assigned, exclusively-hosted-service).
        schema:
          type: string
      - name: cvssV2Metrics
        in: query
        schema:
          type: string
      - name: cvssV2Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
      - name: cvssV3Metrics
        in: query
        schema:
          type: string
      - name: cvssV3Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
      - name: cvssV4Metrics
        in: query
        schema:
          type: string
      - name: cvssV4Severity
        in: query
        schema:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
      - name: cweId
        in: query
        description: Filter by Common Weakness Enumeration identifier.
        schema:
          type: string
      - name: hasCertAlerts
        in: query
        schema:
          type: boolean
      - name: hasCertNotes
        in: query
        schema:
          type: boolean
      - name: hasKev
        in: query
        schema:
          type: boolean
      - name: hasOval
        in: query
        schema:
          type: boolean
      - name: isVulnerable
        in: query
        schema:
          type: boolean
      - name: kevStartDate
        in: query
        schema:
          type: string
          format: date-time
      - name: kevEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: keywordSearch
        in: query
        description: Search description text for keywords.
        schema:
          type: string
      - name: keywordExactMatch
        in: query
        schema:
          type: boolean
      - name: lastModStartDate
        in: query
        description: Last modified start date (max 120-day range).
        schema:
          type: string
          format: date-time
      - name: lastModEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: pubStartDate
        in: query
        description: Published start date (max 120-day range).
        schema:
          type: string
          format: date-time
      - name: pubEndDate
        in: query
        schema:
          type: string
          format: date-time
      - name: resultsPerPage
        in: query
        description: Maximum results per page (max 2000).
        schema:
          type: integer
          maximum: 2000
      - name: startIndex
        in: query
        description: Zero-based pagination offset.
        schema:
          type: integer
      - name: sourceIdentifier
        in: query
        schema:
          type: string
      - name: virtualMatchString
        in: query
        schema:
          type: string
      - name: versionStart
        in: query
        schema:
          type: string
      - name: versionStartType
        in: query
        schema:
          type: string
          enum:
          - including
          - excluding
      - name: versionEnd
        in: query
        schema:
          type: string
      - name: versionEndType
        in: query
        schema:
          type: string
          enum:
          - including
          - excluding
      - name: noRejected
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: A paginated CVE results envelope with vulnerabilities array.