Get a CVELook up one vulnerability by its CVE ID and get everything the NVD holds on it: the description, CVSS scores and severity, CWE weakness types, affected products, references, and whether CISA lists it as actively exploited. A pasted nvd.nist.gov link works in place of the ID.
Get several CVEsLook up as many as 100 CVEs in a single request instead of one step each. Any ID the NVD does not know is listed under 'not found' rather than failing the step, so a list pulled from a scanner report can be resolved in one go.
Search CVEsSearch by keyword and by the flags on a record: weakness type, assigning source, analysis status, tag, and whether it is in CISA's Known Exploited Vulnerabilities catalog. The keyword is matched against the CVE descriptions, and every word given has to appear.
Find CVEs by severityFind vulnerabilities by how bad they are: a CVSS severity band, a full or partial CVSS vector (AV:N/PR:N for anything reachable over the network with no privileges), or both, on CVSS v2.0, v3.x or v4.0.
Find CVEs affecting a productFind every vulnerability that affects a piece of software or hardware, named by its CPE. Give an exact CPE name for one version, or a match string with a version range to ask about everything between two releases.
List CVEs published in a date rangeList the vulnerabilities first published inside a window of up to 120 days. Run it on a schedule to see what is new.
List CVEs changed in a date rangeList the vulnerabilities whose records changed inside a window of up to 120 days, including old ones that were rescored or reanalyzed. This is what NIST asks you to poll to keep a local copy in step.
List actively exploited CVEs (CISA KEV)List the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, the ones confirmed to be under attack in the wild, either the whole catalog or just what was added in a date range.
Get a CVE's change historyList every change ever made to one CVE record: when it was received, analyzed, rescored, retagged or rejected, who made each change, and exactly which values moved.
List CVE changes in a date rangeList changes made across all CVEs inside a window of up to 120 days, optionally only one kind of change, so a workflow can watch for rescorings or KEV updates as they happen.
Search productsSearch the NVD's product dictionary for the CPE name of a piece of software or hardware. Run this first when you know a product by name and need the CPE the vulnerability search takes.
Get a productGet one product record from the CPE dictionary by its ID, including its titles, vendor references, and whether it has been deprecated in favour of another CPE.
List products changed in a date rangeList the CPE product records added or changed inside a window of up to 120 days, to keep a local copy of the product dictionary in step.
List the products a match criterion coversExpand one match criterion into the product versions it resolves to. A CVE says 'log4j from 2.0 up to 2.15.0'; this turns that into the list of concrete CPE names.
Get a match criterionGet one match criterion by its ID, with its version bounds and every CPE name it resolves to.
List a CVE's match criteriaList the product ranges one CVE is tied to, each with the CPE names it covers: the full, expanded answer to 'exactly which versions does this vulnerability affect?'.
Search match criteriaFind the match criteria whose CPE fits a match string, for example every criterion that mentions log4j. Each one names the version range and the products inside it.
List match criteria changed in a date rangeList the match criteria added or changed inside a window of up to 120 days. A criterion changing is how the set of versions a CVE applies to gets corrected.
List data sourcesList the organizations that supply the NVD its data, with the identifiers their CVE records are published under and how far NVD trusts each one's scores.
Get a data sourceLook up one data-supplying organization and get its contact address, every identifier it publishes under, and its CVSS and CWE acceptance levels.
List data sources changed in a date rangeList the data-supplying organizations whose records changed inside a window of up to 120 days, which is how a new CVE Numbering Authority or a changed acceptance level shows up.
