CVE Program Records — The Authoritative Vulnerability Entry

Look up a CVE and get a flat row — state, assigner, dates, description, vendor, product and CVSS.

Source: the CVE Program's own registry. Free, no key.

What you get

state, assigner, dateReserved, datePublished, dateUpdated, description, vendor, product, cvssScore, cvssSeverity, cvssVector, referenceUrl, url, id.

Sample output

{ "id": "cveorg:CVE-2024-0001", "state": "PUBLISHED", "assigner": "PureStorage",
  "cvssScore": 7.5, "cvssSeverity": "HIGH", "vendor": "Pure Storage" }

Limitations — read before buying

• This is the UPSTREAM record, and it can differ from NVD's. NVD re-scores and re-describes; actor 206 returns NVD's version.
• state is REJECTED for a withdrawn CVE — a rejected record has no useful description and must not be counted as a vulnerability.
• Only the FIRST affected vendor and product are mapped. One CVE often covers several, and they are in the response but not in the row.
• cvssScore may be absent — the assigning CNA is not obliged to score it, and NVD may score it later.
• CVSS v4 records are not mapped, only v3.1; the field path returns null rather than a wrong number.

Pricing

Pay per result.

Fields

Field	Type	What it holds
state	string	State, province or region name.
assigner	string	The CNA that assigned the CVE id. It is the organisation that took the report, not the vendor.
dateReserved	string	Date the CVE id was reserved. Reservation can precede disclosure by a long time.
datePublished	string	Date the CVE record was published. This is the DISCLOSURE date, and the one to sort by.
dateUpdated	string	Date the CVE record was last revised.
description	string	Description of this record, as published by the source.
vendor	string	Vendor this record relates to.
product	string	Product name or identifier as the source records it.
cvssScore	number	CVSS base score, from 0 to 10. Higher is more severe.
cvssSeverity	string	Severity band derived from the CVSS score, e.g. HIGH. Derived, and only as good as the underlying score.
cvssVector	string	The full CVSS vector string for the score.
referenceUrl	string	A reference link the record cites. There are usually several, and they do not all carry equal weight.
url	string	The URL this row describes.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• CVE Program Records — The Authoritative Vulnerability Entry declares all 13 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of CVE Program Records include state, assigner, dateReserved, datePublished, dateUpdated and description.
• CVE Program Records needs no API key, login or account of any kind before its first run.
• Every one of CVE Program Records's 3 inputs is optional, so it runs with no configuration at all.
• CVE Program Records documents assigner as: The CNA that assigned the CVE id. It is the organisation that took the report, not the vendor.
• Every number published about CVE Program Records is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• CVE Program Records is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

FAQ

What does CVE Program Records return?

It returns 13 documented output fields — state, assigner, dateReserved, datePublished, dateUpdated, description, vendor and product — each with a declared type and a written description. The full schema is below.

What does CVE Program Records require to run?

Nothing. All 3 inputs are optional and ship with working defaults.

Does CVE Program Records need an API key?

No. It reads only public data and asks for no account.

How is CVE Program Records billed?

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.