NVD CVE API

Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 19 Aug 2026

What is the NVD CVE API?

The NVD API is NIST's free interface to the National Vulnerability Database, providing every published CVE with descriptions, CVSS severity scores, affected product identifiers and reference links. No API key is required, though one raises the rate limit.

This is the authoritative source for CVE data in the United States, maintained by NIST. Every record carries CVSS v3 severity scoring, CPE identifiers for affected products, and links to advisories and patches.

The rate limit deserves attention before you build: without a key you get roughly 5 requests per 30-second window, which is very restrictive. A free key raises that to 50, so request one before doing anything at scale.

Quick facts

Base URL: https://services.nvd.nist.gov/rest/json
Authentication: Works with no key at a low rate limit. A free API key raises the limit substantially and is recommended.
Rate limit: About 5 requests per 30 seconds without a key; 50 per 30 seconds with a free key.
Pricing: Free public domain US government data.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the NVD CVE API

Every request below was executed against the live API on 19 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Fetch the most recent CVE record

GET https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1

curl

curl 'https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1'

JavaScript (fetch)

const res = await fetch("https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "resultsPerPage": 1,
  "startIndex": 0,
  "totalResults": 380643,
  "format": "NVD_CVE",
  "version": "2.0",
  "timestamp": "2026-08-19T20:28:22.038",
  "vulnerabilities": [
    {
      "cve": {
        "id": "CVE-1999-0095",
        "sourceIdentifier": "cve@mitre.org",
        "published": "1988-10-01T04:00:00.000",
        "lastModified": "2026-06-16T21:47:34.460",
        "vulnStatus": "Modified",
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root."
          },
          {
            "lang": "es",
            "value": "El comando de depuración de Sendmail está activado, permitiendo a atacantes ejecutar comandos como root."
          }
        ],
        "affected": [
          {
            "source": "cve@mitre.org",
            "affectedData": [
              {
                "vendor": "n/a",
                "product": "n/a",
                "versions": [
                  {
                    "version": "n/a",
                    "status": "affected"
                  }
                ]
              }
            ]
          }
        ],
        "metrics": {
          "cvssMetricV2": [
            {
              "source": "nvd@nist.gov",
              "type": "Primary",
              "cvssData": {
                "version": "2.0",
                "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                "baseScore": 10.0,
                "accessVector": "NETWORK",
                "accessComplexity": "LOW",

Parameters

Parameter	Type	Required	Description
`resultsPerPage`	integer	Optional	Results per page, up to 2000. `20`
`startIndex`	integer	Optional	Pagination offset. `20`
`cveId`	string	Optional	Fetch one specific CVE. `CVE-2021-44228`
`keywordSearch`	string	Optional	Full-text search of CVE descriptions. `log4j`
`cvssV3Severity`	string	Optional	LOW, MEDIUM, HIGH or CRITICAL. `CRITICAL`
`pubStartDate / pubEndDate`	string	Optional	ISO-8601 publication date range. `2026-01-01T00:00:00.000`

Response fields

totalResultsinteger: Total CVEs matching the query.
vulnerabilities[].cve.idstring: CVE identifier.
vulnerabilities[].cve.descriptionsarray: Description text, usually with an English entry.
vulnerabilities[].cve.metricsobject: CVSS v2/v3/v4 scores and severity ratings where assigned.
vulnerabilities[].cve.referencesarray: Advisory, patch and exploit links.
vulnerabilities[].cve.configurationsarray: CPE match rules describing affected products and versions.

What you can build with the NVD CVE API

Monitor new critical vulnerabilities affecting your stack
Enrich a software inventory with known CVEs by CPE match
Build security dashboards and patch prioritisation tooling
Research the history and severity of a specific vulnerability

Common errors and how to fix them

403

Rate limit exceeded — very easy without a key.

Fix: Request a free API key and send it in the `apiKey` header; also add a delay between calls.

404

Unknown CVE id.

Fix: CVE ids are case-sensitive in the form CVE-YYYY-NNNNN.

Empty metrics object

Not every CVE has been scored yet.

Fix: Newly published CVEs often lack CVSS scores for days. Handle the missing case rather than assuming a severity.

NVD CVE API — frequently asked questions

Is the NVD CVE API free?

Yes, it is free US government data with no key required, but the unauthenticated rate limit is low. A free API key raises it from about 5 to 50 requests per 30 seconds.

Why am I getting 403 errors?

You are hitting the rate limit. Without a key you get roughly 5 requests per 30-second window — request a free key and add delays between calls.

How do I find CVEs affecting a specific product?

Use keywordSearch for a quick text match, or the CPE-based parameters for precise product and version matching, which is what vulnerability scanners use.

Why does a new CVE have no severity score?

Scoring is done after publication and can lag by days. The metrics object will be empty until NIST completes analysis, so always handle that case.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Validator

Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.

Alternatives to NVD CVE API

If NVD CVE does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
SSL Labs	Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.	No key	No	19 Aug 2026
OpenPhish Community Feed	Free OpenPhish community feed with no key: a live plain-text list of active phishing URLs, refreshed continuously. One URL per line, ready for blocklists and enrichment.	No key	Yes	21 Aug 2026
OpenSSF Scorecard	Free OpenSSF Scorecard API with no key: automated supply-chain security scores for open source repositories across 18 checks, with reasons and evidence for each.	No key	Yes	21 Aug 2026

All Security & Auth APIs

NVD CVE is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 19 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.