BYTETOOLS

NVD CVE API

Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-19

What is the NVD CVE API?

The NVD API is NIST's free interface to the National Vulnerability Database, providing every published CVE with descriptions, CVSS severity scores, affected product identifiers and reference links. No API key is required, though one raises the rate limit.

This is the authoritative source for CVE data in the United States, maintained by NIST. Every record carries CVSS v3 severity scoring, CPE identifiers for affected products, and links to advisories and patches.

The rate limit deserves attention before you build: without a key you get roughly 5 requests per 30-second window, which is very restrictive. A free key raises that to 50, so request one before doing anything at scale.

Quick facts

Base URL
https://services.nvd.nist.gov/rest/json
Authentication
Works with no key at a low rate limit. A free API key raises the limit substantially and is recommended.
Rate limit
About 5 requests per 30 seconds without a key; 50 per 30 seconds with a free key.
Pricing
Free public domain US government data.
CORS
Enabled — callable directly from browser JavaScript
Official docs
Read the docs

How to use the NVD CVE API

Every request below was executed against the live API on 2026-08-19, and the response shown is the real body it returned — not an illustration.

1. Fetch the most recent CVE record

GET https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1

curl
curl 'https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1'
JavaScript (fetch)
const res = await fetch("https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200 (truncated)
{
  "resultsPerPage": 1,
  "startIndex": 0,
  "totalResults": 380643,
  "format": "NVD_CVE",
  "version": "2.0",
  "timestamp": "2026-08-19T20:28:22.038",
  "vulnerabilities": [
    {
      "cve": {
        "id": "CVE-1999-0095",
        "sourceIdentifier": "cve@mitre.org",
        "published": "1988-10-01T04:00:00.000",
        "lastModified": "2026-06-16T21:47:34.460",
        "vulnStatus": "Modified",
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root."
          },
          {
            "lang": "es",
            "value": "El comando de depuración de Sendmail está activado, permitiendo a atacantes ejecutar comandos como root."
          }
        ],
        "affected": [
          {
            "source": "cve@mitre.org",
            "affectedData": [
              {
                "vendor": "n/a",
                "product": "n/a",
                "versions": [
                  {
                    "version": "n/a",
                    "status": "affected"
                  }
                ]
              }
            ]
          }
        ],
        "metrics": {
          "cvssMetricV2": [
            {
              "source": "nvd@nist.gov",
              "type": "Primary",
              "cvssData": {
                "version": "2.0",
                "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                "baseScore": 10.0,
                "accessVector": "NETWORK",
                "accessComplexity": "LOW",

Parameters

ParameterTypeRequiredDescription
resultsPerPageintegerOptionalResults per page, up to 2000. 20
startIndexintegerOptionalPagination offset. 20
cveIdstringOptionalFetch one specific CVE. CVE-2021-44228
keywordSearchstringOptionalFull-text search of CVE descriptions. log4j
cvssV3SeveritystringOptionalLOW, MEDIUM, HIGH or CRITICAL. CRITICAL
pubStartDate / pubEndDatestringOptionalISO-8601 publication date range. 2026-01-01T00:00:00.000

Response fields

totalResultsinteger
Total CVEs matching the query.
vulnerabilities[].cve.idstring
CVE identifier.
vulnerabilities[].cve.descriptionsarray
Description text, usually with an English entry.
vulnerabilities[].cve.metricsobject
CVSS v2/v3/v4 scores and severity ratings where assigned.
vulnerabilities[].cve.referencesarray
Advisory, patch and exploit links.
vulnerabilities[].cve.configurationsarray
CPE match rules describing affected products and versions.

What you can build with the NVD CVE API

  • Monitor new critical vulnerabilities affecting your stack
  • Enrich a software inventory with known CVEs by CPE match
  • Build security dashboards and patch prioritisation tooling
  • Research the history and severity of a specific vulnerability

Common errors and how to fix them

403

Rate limit exceeded — very easy without a key.

Fix: Request a free API key and send it in the `apiKey` header; also add a delay between calls.

404

Unknown CVE id.

Fix: CVE ids are case-sensitive in the form CVE-YYYY-NNNNN.

Empty metrics object

Not every CVE has been scored yet.

Fix: Newly published CVEs often lack CVSS scores for days. Handle the missing case rather than assuming a severity.

NVD CVE API — frequently asked questions

Is the NVD CVE API free?

Yes, it is free US government data with no key required, but the unauthenticated rate limit is low. A free API key raises it from about 5 to 50 requests per 30 seconds.

Why am I getting 403 errors?

You are hitting the rate limit. Without a key you get roughly 5 requests per 30-second window — request a free key and add delays between calls.

How do I find CVEs affecting a specific product?

Use keywordSearch for a quick text match, or the CPE-based parameters for precise product and version matching, which is what vulnerability scanners use.

Why does a new CVE have no severity score?

Scoring is done after publication and can lag by days. The metrics object will be empty until NIST completes analysis, so always handle that case.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Validator

Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.

NVD CVE is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-19; always check the official documentation before relying on this API in production, as terms and limits can change.