openapi: 3.1.0 info: title: NVD CVE API description: >- The NVD CVE API provides programmatic access to CVE (Common Vulnerabilities and Exposures) records including CVSS severity scores, affected product lists, CWE classifications, and reference links. Without an API key: 5 requests per 30 seconds; with key: 50 requests per 30 seconds. version: 2.0.0 contact: name: NVD Support url: https://nvd.nist.gov/general/contact license: name: Public Domain (US Government) url: https://nvd.nist.gov/developers/terms-of-use externalDocs: description: NVD Developer Documentation url: https://nvd.nist.gov/developers/vulnerabilities servers: - url: https://services.nvd.nist.gov/rest/json description: NVD REST API v2 security: - {} - APIKey: [] paths: /cves/2.0: get: operationId: getCVEs summary: Get CVE records description: >- Retrieve one or more CVE records. Use cveId to get a single CVE, or use filters to query a range. Maximum 2000 results per page. Use startIndex for pagination. Date ranges must not span more than 120 days. tags: - CVE parameters: - name: cveId in: query schema: type: string pattern: '^CVE-[0-9]{4}-[0-9]{4,}$' description: Specific CVE ID (e.g., CVE-2021-44228) - name: keywordSearch in: query schema: type: string description: Free text search across CVE description - name: keywordExactMatch in: query schema: type: boolean description: Require exact keyword match when true - name: cvssV3Severity in: query schema: type: string enum: [LOW, MEDIUM, HIGH, CRITICAL] description: Filter by CVSS v3.x base severity - name: cvssV2Severity in: query schema: type: string enum: [LOW, MEDIUM, HIGH] description: Filter by CVSS v2.0 base severity - name: cvssV3Metrics in: query schema: type: string description: Filter by CVSS v3 vector string - name: cweId in: query schema: type: string pattern: '^CWE-[0-9]+$' description: CWE weakness ID (e.g., CWE-79) - name: cpeName in: query schema: type: string description: CPE 2.3 formatted string to find CVEs affecting a specific product - name: isVulnerable in: query schema: type: boolean description: When true, only return CVEs where the CPE match is vulnerable (must use cpeName) - name: virtualMatchString in: query schema: type: string description: CPE match string with wildcards - name: pubStartDate in: query schema: type: string format: date-time description: CVE publication start date (ISO 8601, max 120-day range) - name: pubEndDate in: query schema: type: string format: date-time - name: lastModStartDate in: query schema: type: string format: date-time description: Last modification start date - name: lastModEndDate in: query schema: type: string format: date-time - name: sourceIdentifier in: query schema: type: string description: CVE source organization identifier - name: hasKev in: query schema: type: boolean description: When true, only return CVEs in CISA's Known Exploited Vulnerabilities catalog - name: hasCertAlerts in: query schema: type: boolean - name: hasCertNotes in: query schema: type: boolean - name: hasOval in: query schema: type: boolean - name: noRejected in: query schema: type: boolean description: Exclude CVEs with REJECTED status - name: resultsPerPage in: query schema: type: integer default: 2000 maximum: 2000 description: Number of results per page (max 2000) - name: startIndex in: query schema: type: integer default: 0 description: Zero-based start index for pagination responses: '200': description: CVE results headers: X-RateLimit-Limit: schema: type: integer description: Rate limit (5 without key, 50 with key, per 30 seconds) content: application/json: schema: $ref: '#/components/schemas/CVEResponse' '400': description: Bad request — invalid parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: API key required or invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' /cvehistory/2.0: get: operationId: getCVEChangeHistory summary: Get CVE change history description: >- Track modifications to CVE records over time. Useful for incremental synchronization of local databases. Date ranges must not span more than 120 days. Returns up to 5000 changes per page. tags: - CVE Change History parameters: - name: cveId in: query schema: type: string pattern: '^CVE-[0-9]{4}-[0-9]{4,}$' - name: changeStartDate in: query required: true schema: type: string format: date-time - name: changeEndDate in: query required: true schema: type: string format: date-time - name: eventName in: query schema: type: string enum: [Initial Analysis, Reanalysis, CVE Modified, Modified Analysis, CVE Translated, Vendor Comment, CVE Source Update, CVSS Score Update, CWE Remap, CPE Deprecation Remap, CVE Rejected, CVE Unrejected] - name: resultsPerPage in: query schema: type: integer default: 5000 maximum: 5000 - name: startIndex in: query schema: type: integer default: 0 responses: '200': description: CVE change history results content: application/json: schema: $ref: '#/components/schemas/CVEHistoryResponse' /cpes/2.0: get: operationId: getCPEs summary: Get CPE (Common Platform Enumeration) records description: >- Query the NVD CPE dictionary for software and hardware product identifiers. Supports filtering by CPE name, keyword, and modification date. Returns up to 10,000 results per page. tags: - CPE parameters: - name: cpeNameId in: query schema: type: string format: uuid description: CPE UUID identifier - name: cpeMatchString in: query schema: type: string description: CPE 2.3 match string (wildcards supported) - name: keywordSearch in: query schema: type: string - name: keywordExactMatch in: query schema: type: boolean - name: lastModStartDate in: query schema: type: string format: date-time - name: lastModEndDate in: query schema: type: string format: date-time - name: matchCriteriaId in: query schema: type: string format: uuid - name: resultsPerPage in: query schema: type: integer default: 10000 maximum: 10000 - name: startIndex in: query schema: type: integer default: 0 responses: '200': description: CPE records content: application/json: schema: $ref: '#/components/schemas/CPEResponse' /cpematch/2.0: get: operationId: getCPEMatch summary: Get CPE match criteria description: >- Retrieve CPE match strings associated with CVE records, enabling detailed product-to-vulnerability mapping. Returns up to 500 results per page. tags: - CPE Match parameters: - name: cveId in: query schema: type: string - name: matchCriteriaId in: query schema: type: string format: uuid - name: lastModStartDate in: query schema: type: string format: date-time - name: lastModEndDate in: query schema: type: string format: date-time - name: resultsPerPage in: query schema: type: integer default: 500 maximum: 500 - name: startIndex in: query schema: type: integer default: 0 responses: '200': description: CPE match criteria content: application/json: schema: $ref: '#/components/schemas/CPEMatchResponse' /source/2.0: get: operationId: getSources summary: Get NVD data sources description: >- Retrieve information about organizations that contribute vulnerability data to the NVD. Returns up to 1,000 source records per page. tags: - Sources parameters: - name: sourceIdentifier in: query schema: type: string - name: lastModStartDate in: query schema: type: string format: date-time - name: lastModEndDate in: query schema: type: string format: date-time - name: resultsPerPage in: query schema: type: integer default: 1000 maximum: 1000 - name: startIndex in: query schema: type: integer default: 0 responses: '200': description: Source records content: application/json: schema: $ref: '#/components/schemas/SourceResponse' components: securitySchemes: APIKey: type: apiKey in: header name: apiKey description: >- NVD API key (optional but recommended). Without a key: 5 requests/30s. With a key: 50 requests/30s. Request at https://nvd.nist.gov/developers/request-an-api-key schemas: CVE: type: object description: A CVE vulnerability record properties: id: type: string description: CVE identifier pattern: '^CVE-[0-9]{4}-[0-9]{4,}$' sourceIdentifier: type: string description: Assigning CNA (CVE Numbering Authority) identifier published: type: string format: date-time description: Date the CVE was published in NVD lastModified: type: string format: date-time vulnStatus: type: string enum: [Analyzed, Awaiting Analysis, Undergoing Analysis, Modified, Deferred, Rejected, Received] descriptions: type: array items: type: object properties: lang: type: string description: ISO 639-1 language code value: type: string description: CVE description text metrics: type: object properties: cvssMetricV31: type: array items: $ref: '#/components/schemas/CVSSMetricV3' cvssMetricV30: type: array items: $ref: '#/components/schemas/CVSSMetricV3' cvssMetricV2: type: array items: $ref: '#/components/schemas/CVSSMetricV2' weaknesses: type: array items: type: object properties: source: {type: string} type: {type: string} description: type: array items: type: object properties: lang: {type: string} value: {type: string} configurations: type: array items: $ref: '#/components/schemas/CVEConfiguration' references: type: array items: type: object properties: url: type: string format: uri source: type: string tags: type: array items: type: string cisaExploitAdd: type: string format: date description: Date added to CISA KEV catalog cisaActionDue: type: string format: date cisaRequiredAction: type: string cisaVulnerabilityName: type: string CVSSMetricV3: type: object properties: source: type: string type: type: string enum: [Primary, Secondary] cvssData: type: object properties: version: type: string enum: ['3.0', '3.1'] vectorString: type: string pattern: '^CVSS:3\.[01]/' attackVector: type: string enum: [NETWORK, ADJACENT_NETWORK, LOCAL, PHYSICAL] attackComplexity: type: string enum: [LOW, HIGH] privilegesRequired: type: string enum: [NONE, LOW, HIGH] userInteraction: type: string enum: [NONE, REQUIRED] scope: type: string enum: [UNCHANGED, CHANGED] confidentialityImpact: type: string enum: [NONE, LOW, HIGH] integrityImpact: type: string enum: [NONE, LOW, HIGH] availabilityImpact: type: string enum: [NONE, LOW, HIGH] baseScore: type: number minimum: 0 maximum: 10 baseSeverity: type: string enum: [NONE, LOW, MEDIUM, HIGH, CRITICAL] exploitabilityScore: type: number impactScore: type: number CVSSMetricV2: type: object properties: source: type: string type: type: string enum: [Primary, Secondary] cvssData: type: object properties: version: type: string enum: ['2.0'] vectorString: type: string baseScore: type: number minimum: 0 maximum: 10 baseSeverity: type: string enum: [LOW, MEDIUM, HIGH] CVEConfiguration: type: object properties: nodes: type: array items: type: object properties: operator: type: string enum: [AND, OR] negate: type: boolean cpeMatch: type: array items: type: object properties: vulnerable: type: boolean criteria: type: string description: CPE 2.3 match string matchCriteriaId: type: string format: uuid versionStartIncluding: type: string versionStartExcluding: type: string versionEndIncluding: type: string versionEndExcluding: type: string CVEResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer format: type: string version: type: string timestamp: type: string format: date-time vulnerabilities: type: array items: type: object properties: cve: $ref: '#/components/schemas/CVE' CVEHistoryResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer format: type: string version: type: string timestamp: type: string format: date-time cveChanges: type: array items: type: object properties: change: type: object properties: cveId: type: string eventName: type: string cveChangeId: type: string format: uuid sourceIdentifier: type: string created: type: string format: date-time details: type: array items: type: object properties: action: type: string enum: [Added, Changed, Removed] type: type: string oldValue: type: string newValue: type: string CPE: type: object properties: deprecated: type: boolean cpeName: type: string description: CPE 2.3 formatted string cpeNameId: type: string format: uuid lastModified: type: string format: date-time created: type: string format: date-time titles: type: array items: type: object properties: title: {type: string} lang: {type: string} refs: type: array items: type: object properties: ref: {type: string, format: uri} type: {type: string} CPEResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer format: type: string version: type: string timestamp: type: string format: date-time products: type: array items: type: object properties: cpe: $ref: '#/components/schemas/CPE' CPEMatchResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer timestamp: type: string format: date-time matchStrings: type: array items: type: object properties: matchString: type: object properties: matchCriteriaId: {type: string, format: uuid} criteria: {type: string} lastModified: {type: string, format: date-time} cpeLastModified: {type: string, format: date-time} created: {type: string, format: date-time} status: {type: string, enum: [Active, Inactive]} matches: type: array items: type: object properties: cpeName: {type: string} cpeNameId: {type: string, format: uuid} SourceResponse: type: object properties: resultsPerPage: type: integer startIndex: type: integer totalResults: type: integer timestamp: type: string format: date-time sources: type: array items: type: object properties: sourceIdentifier: {type: string} name: {type: string} contactEmail: {type: string} lastModified: {type: string, format: date-time} created: {type: string, format: date-time} ErrorResponse: type: object properties: message: type: string tags: - name: CPE description: Common Platform Enumeration product dictionary - name: CPE Match description: CVE-to-product match criteria - name: CVE description: Common Vulnerabilities and Exposures records - name: CVE Change History description: CVE record modification tracking - name: Sources description: NVD data source organizations