CIRCL CVE Search API

Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 19 Aug 2026

What is the CIRCL CVE Search API?

CIRCL CVE Search is a free, key-free API from the Computer Incident Response Center Luxembourg that aggregates vulnerability data from multiple sources, letting you query CVEs by id, vendor or product and fetch the most recent entries.

CIRCL's service is a practical alternative to querying NIST directly, chiefly because it has no meaningful rate limit and enables CORS — so unlike the NVD API you can call it straight from browser JavaScript.

It aggregates more than just CVE records: entries include advisories from GitHub Security Advisories, PySec and other sources, so a query can surface ecosystem-specific vulnerabilities that a plain CVE lookup would miss.

Quick facts

Base URL: https://cve.circl.lu/api
Authentication: No API key required.
Rate limit: No published hard limit; fair use expected.
Pricing: Free, run as a public service by CIRCL.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the CIRCL CVE Search API

Every request below was executed against the live API on 19 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Fetch the most recently published vulnerability

GET https://cve.circl.lu/api/last/1

curl

curl 'https://cve.circl.lu/api/last/1'

JavaScript (fetch)

const res = await fetch("https://cve.circl.lu/api/last/1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://cve.circl.lu/api/last/1", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

[
  {
    "id": "PYSEC-2025-19",
    "modified": "2027-07-09T15:54:00+00:00",
    "published": "2025-03-03T19:15:34+00:00",
    "aliases": [
      "CVE-2025-1889",
      "GHSA-769v-p64c-89pr"
    ],
    "details": "picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.",
    "affected": [
      {
        "package": {
          "ecosystem": "PyPI",
          "name": "picklescan",
          "purl": "pkg:pypi/picklescan"
        },
        "ranges": [
          {
            "type": "ECOSYSTEM",
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "0.0.22"
              }
            ]
          }
        ],
        "versions": [
          "0.0.1",
          "0.0.10",
          "0.0.11",
          "0.0.12",
          "0.0.13",
          "0.0.14",
          "0.0.15",
          "0.0.16",
          "0.0.17",
          "0.0.18",
          "0.0.19",
          "0.0.2",
          "0.0.20",
          "0.0.21",
          "0.0.3",
          "0.0.4",
          "0.0.5",
          "0.0.6",
          "0.0.7",
          "0.0.8",
          "0.0.9"
        ]
      }
    ],
    "severity": [
      {
        "type": "CVSS_V3",

Parameters

Parameter	Type	Required	Description
`last/<n>`	path	Optional	The n most recently published entries. `last/10`
`cve/<id>`	path	Optional	Look up one CVE by identifier. `cve/CVE-2021-44228`
`search/<vendor>/<product>`	path	Optional	All vulnerabilities for a vendor and product. `search/apache/http_server`
`browse/<vendor>`	path	Optional	List known products for a vendor. `browse/microsoft`

Response fields

idstring: Advisory identifier — a CVE, GHSA, PYSEC or similar.
aliasesarray: Other identifiers for the same issue, linking CVE and ecosystem advisories.
summary / detailsstring: Description of the vulnerability.
published / modifiedstring: Publication and last-modified timestamps.
affectedarray: Affected packages and version ranges, where known.

What you can build with the CIRCL CVE Search API

Add a vulnerability lookup to a browser-based security dashboard
Monitor newly published CVEs for a vendor or product
Cross-reference CVE ids with ecosystem advisories via aliases
Build security tooling without NVD's tight rate limit

Common errors and how to fix them

Empty result

No vulnerabilities matched that vendor/product pair.

Fix: Vendor and product names follow CPE conventions — use /browse to discover valid values.

Response shape varies

Entries come from several upstream sources with different schemas.

Fix: Code defensively; check for a field's presence rather than assuming the CVE schema.

CIRCL CVE Search API — frequently asked questions

Is the CIRCL CVE API free?

Yes, completely free with no API key, run as a public service by the Computer Incident Response Center Luxembourg.

How is this different from the NVD API?

CIRCL aggregates several vulnerability sources rather than just CVE, has no tight rate limit, and enables CORS — so it can be called directly from browser JavaScript, which NVD cannot.

Can I search by vendor and product?

Yes, /api/search/<vendor>/<product> returns all known vulnerabilities for that pair, using CPE-style vendor and product naming.

Why do some entries have GHSA or PYSEC ids instead of CVE?

The database includes ecosystem advisories alongside CVEs. The `aliases` array links them, so one issue may appear under several identifiers.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Validator

Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.

Alternatives to CIRCL CVE Search API

If CIRCL CVE Search does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
SSL Labs	Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.	No key	No	19 Aug 2026
CIRCL hashlookup	Free CIRCL hashlookup API with no key: check MD5, SHA-1 or SHA-256 file hashes against NSRL and other known-good datasets to filter out legitimate system files.	No key	No	21 Aug 2026
CISA Known Exploited Vulnerabilities	Free CISA Known Exploited Vulnerabilities catalogue as JSON, no key: every CVE with confirmed in-the-wild exploitation, with required remediation actions and due dates.	No key	No	21 Aug 2026

All Security & Auth APIs

CIRCL CVE Search is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 19 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.