openapi: 3.1.0 info: title: NVD CPE CVE API description: 'The NVD CVE API provides programmatic access to CVE (Common Vulnerabilities and Exposures) records including CVSS severity scores, affected product lists, CWE classifications, and reference links. Without an API key: 5 requests per 30 seconds; with key: 50 requests per 30 seconds.' version: 2.0.0 contact: name: NVD Support url: https://nvd.nist.gov/general/contact license: name: Public Domain (US Government) url: https://nvd.nist.gov/developers/terms-of-use servers: - url: https://services.nvd.nist.gov/rest/json description: NVD REST API v2 security: - {} - APIKey: [] tags: - name: CVE description: Common Vulnerabilities and Exposures records paths: /cves/2.0: get: operationId: getCVEs summary: Get CVE records description: Retrieve one or more CVE records. Use cveId to get a single CVE, or use filters to query a range. Maximum 2000 results per page. Use startIndex for pagination. Date ranges must not span more than 120 days. tags: - CVE parameters: - name: cveId in: query schema: type: string pattern: ^CVE-[0-9]{4}-[0-9]{4,}$ description: Specific CVE ID (e.g., CVE-2021-44228) - name: keywordSearch in: query schema: type: string description: Free text search across CVE description - name: keywordExactMatch in: query schema: type: boolean description: Require exact keyword match when true - name: cvssV3Severity in: query schema: type: string enum: - LOW - MEDIUM - HIGH - CRITICAL description: Filter by CVSS v3.x base severity - name: cvssV2Severity in: query schema: type: string enum: - LOW - MEDIUM - HIGH description: Filter by CVSS v2.0 base severity - name: cvssV3Metrics in: query schema: type: string description: Filter by CVSS v3 vector string - name: cweId in: query schema: type: string pattern: ^CWE-[0-9]+$ description: CWE weakness ID (e.g., CWE-79) - name: cpeName in: query schema: type: string description: CPE 2.3 formatted string to find CVEs affecting a specific product - name: isVulnerable in: query schema: type: boolean description: When true, only return CVEs where the CPE match is vulnerable (must use cpeName) - name: virtualMatchString in: query schema: type: string description: CPE match string with wildcards - name: pubStartDate in: query schema: type: string format: date-time description: CVE publication start date (ISO 8601, max 120-day range) - name: pubEndDate in: query schema: type: string format: date-time - name: lastModStartDate in: query schema: type: string format: date-time description: Last modification start date - name: lastModEndDate in: query schema: type: string format: date-time - name: sourceIdentifier in: query schema: type: string description: CVE source organization identifier - name: hasKev in: query schema: type: boolean description: When true, only return CVEs in CISA's Known Exploited Vulnerabilities catalog - name: hasCertAlerts in: query schema: type: boolean - name: hasCertNotes in: query schema: type: boolean - name: hasOval in: query schema: type: boolean - name: noRejected in: query schema: type: boolean description: Exclude CVEs with REJECTED status - name: resultsPerPage in: query schema: type: integer default: 2000 maximum: 2000 description: Number of results per page (max 2000) - name: startIndex in: query schema: type: integer default: 0 description: Zero-based start index for pagination responses: '200': description: CVE results headers: X-RateLimit-Limit: schema: type: integer description: Rate limit (5 without key, 50 with key, per 30 seconds) content: application/json: schema: $ref: '#/components/schemas/CVEResponse' '400': description: Bad request — invalid parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: API key required or invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: CVE: type: object description: A CVE vulnerability record properties: id: type: string description: CVE identifier pattern: ^CVE-[0-9]{4}-[0-9]{4,}$ sourceIdentifier: type: string description: Assigning CNA (CVE Numbering Authority) identifier published: type: string format: date-time description: Date the CVE was published in NVD lastModified: type: string format: date-time vulnStatus: type: string enum: - Analyzed - Awaiting Analysis - Undergoing Analysis - Modified - Deferred - Rejected - Received descriptions: type: array items: type: object properties: lang: type: string description: ISO 639-1 language code value: type: string description: CVE description text metrics: type: object properties: cvssMetricV31: type: array items: $ref: '#/components/schemas/CVSSMetricV3' cvssMetricV30: type: array items: $ref: '#/components/schemas/CVSSMetricV3' cvssMetricV2: type: array items: $ref: '#/components/schemas/CVSSMetricV2' weaknesses: type: array items: type: object properties: source: type: string type: type: string description: type: array items: type: object properties: lang: type: string value: type: string configurations: type: array items: $ref: '#/components/schemas/CVEConfiguration' references: type: array items: type: object properties: url: type: string format: uri source: type: string tags: type: array items: type: string cisaExploitAdd: type: string format: date description: Date added to CISA KEV catalog cisaActionDue: type: string format: date cisaRequiredAction: type: string cisaVulnerabilityName: type: string CVEResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer format: type: string version: type: string timestamp: type: string format: date-time vulnerabilities: type: array items: type: object properties: cve: $ref: '#/components/schemas/CVE' ErrorResponse: type: object properties: message: type: string CVSSMetricV3: type: object properties: source: type: string type: type: string enum: - Primary - Secondary cvssData: type: object properties: version: type: string enum: - '3.0' - '3.1' vectorString: type: string pattern: ^CVSS:3\.[01]/ attackVector: type: string enum: - NETWORK - ADJACENT_NETWORK - LOCAL - PHYSICAL attackComplexity: type: string enum: - LOW - HIGH privilegesRequired: type: string enum: - NONE - LOW - HIGH userInteraction: type: string enum: - NONE - REQUIRED scope: type: string enum: - UNCHANGED - CHANGED confidentialityImpact: type: string enum: - NONE - LOW - HIGH integrityImpact: type: string enum: - NONE - LOW - HIGH availabilityImpact: type: string enum: - NONE - LOW - HIGH baseScore: type: number minimum: 0 maximum: 10 baseSeverity: type: string enum: - NONE - LOW - MEDIUM - HIGH - CRITICAL exploitabilityScore: type: number impactScore: type: number CVEConfiguration: type: object properties: nodes: type: array items: type: object properties: operator: type: string enum: - AND - OR negate: type: boolean cpeMatch: type: array items: type: object properties: vulnerable: type: boolean criteria: type: string description: CPE 2.3 match string matchCriteriaId: type: string format: uuid versionStartIncluding: type: string versionStartExcluding: type: string versionEndIncluding: type: string versionEndExcluding: type: string CVSSMetricV2: type: object properties: source: type: string type: type: string enum: - Primary - Secondary cvssData: type: object properties: version: type: string enum: - '2.0' vectorString: type: string baseScore: type: number minimum: 0 maximum: 10 baseSeverity: type: string enum: - LOW - MEDIUM - HIGH securitySchemes: APIKey: type: apiKey in: header name: apiKey description: 'NVD API key (optional but recommended). Without a key: 5 requests/30s. With a key: 50 requests/30s. Request at https://nvd.nist.gov/developers/request-an-api-key' externalDocs: description: NVD Developer Documentation url: https://nvd.nist.gov/developers/vulnerabilities