CIRCL CVE Search API
Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.
Endpoint tested and returned HTTP 200 on 2026-08-19
What is the CIRCL CVE Search API?
CIRCL CVE Search is a free, key-free API from the Computer Incident Response Center Luxembourg that aggregates vulnerability data from multiple sources, letting you query CVEs by id, vendor or product and fetch the most recent entries.
CIRCL's service is a practical alternative to querying NIST directly, chiefly because it has no meaningful rate limit and enables CORS — so unlike the NVD API you can call it straight from browser JavaScript.
It aggregates more than just CVE records: entries include advisories from GitHub Security Advisories, PySec and other sources, so a query can surface ecosystem-specific vulnerabilities that a plain CVE lookup would miss.
Quick facts
- Base URL
https://cve.circl.lu/api- Authentication
- No API key required.
- Rate limit
- No published hard limit; fair use expected.
- Pricing
- Free, run as a public service by CIRCL.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the CIRCL CVE Search API
Every request below was executed against the live API on 2026-08-19, and the response shown is the real body it returned — not an illustration.
1. Fetch the most recently published vulnerability
GET https://cve.circl.lu/api/last/1
curl 'https://cve.circl.lu/api/last/1'const res = await fetch("https://cve.circl.lu/api/last/1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://cve.circl.lu/api/last/1", timeout=20)
res.raise_for_status()
print(res.json())[
{
"id": "PYSEC-2025-19",
"modified": "2027-07-09T15:54:00+00:00",
"published": "2025-03-03T19:15:34+00:00",
"aliases": [
"CVE-2025-1889",
"GHSA-769v-p64c-89pr"
],
"details": "picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.",
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan",
"purl": "pkg:pypi/picklescan"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.22"
}
]
}
],
"versions": [
"0.0.1",
"0.0.10",
"0.0.11",
"0.0.12",
"0.0.13",
"0.0.14",
"0.0.15",
"0.0.16",
"0.0.17",
"0.0.18",
"0.0.19",
"0.0.2",
"0.0.20",
"0.0.21",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9"
]
}
],
"severity": [
{
"type": "CVSS_V3",Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
last/<n> | path | Optional | The n most recently published entries. last/10 |
cve/<id> | path | Optional | Look up one CVE by identifier. cve/CVE-2021-44228 |
search/<vendor>/<product> | path | Optional | All vulnerabilities for a vendor and product. search/apache/http_server |
browse/<vendor> | path | Optional | List known products for a vendor. browse/microsoft |
Response fields
idstring- Advisory identifier — a CVE, GHSA, PYSEC or similar.
aliasesarray- Other identifiers for the same issue, linking CVE and ecosystem advisories.
summary / detailsstring- Description of the vulnerability.
published / modifiedstring- Publication and last-modified timestamps.
affectedarray- Affected packages and version ranges, where known.
What you can build with the CIRCL CVE Search API
- Add a vulnerability lookup to a browser-based security dashboard
- Monitor newly published CVEs for a vendor or product
- Cross-reference CVE ids with ecosystem advisories via aliases
- Build security tooling without NVD's tight rate limit
Common errors and how to fix them
Empty result
No vulnerabilities matched that vendor/product pair.
Fix: Vendor and product names follow CPE conventions — use /browse to discover valid values.
Response shape varies
Entries come from several upstream sources with different schemas.
Fix: Code defensively; check for a field's presence rather than assuming the CVE schema.
CIRCL CVE Search API — frequently asked questions
Is the CIRCL CVE API free?
Yes, completely free with no API key, run as a public service by the Computer Incident Response Center Luxembourg.
How is this different from the NVD API?
CIRCL aggregates several vulnerability sources rather than just CVE, has no tight rate limit, and enables CORS — so it can be called directly from browser JavaScript, which NVD cannot.
Can I search by vendor and product?
Yes, /api/search/<vendor>/<product> returns all known vulnerabilities for that pair, using CPE-style vendor and product naming.
Why do some entries have GHSA or PYSEC ids instead of CVE?
The database includes ecosystem advisories alongside CVEs. The `aliases` array links them, so one issue may appear under several identifiers.
Tools that pair with this API
JSON Formatter
Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.
JSON Validator
Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.
CIRCL CVE Search is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-19; always check the official documentation before relying on this API in production, as terms and limits can change.