CVE Lookup: NVD vulnerabilities with CVSS, CWE and KEV
Pricing
from $0.90 / 1,000 cve returneds
CVE Lookup: NVD vulnerabilities with CVSS, CWE and KEV
Looks up CVEs in the NVD by id, keyword, product (CPE) or published date range, and returns CVSS v4, v3.1, v3.0 and v2 scores, CWE weaknesses, references, CISA KEV status and affected products. Your own NVD API key is optional.
Pricing
from $0.90 / 1,000 cve returneds
Rating
0.0
(0)
Developer
Ed Rayyis
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Share
Look up vulnerabilities in the U.S. National Vulnerability Database by CVE id, keyword, product or publication date, and get one clean row per CVE with every score and the facts a triage needs.
For each CVE you get:
- Description, NVD status, published and last modified dates
- A headline
baseScoreandbaseSeverity: NVD's own score, newest CVSS version first, or the newest score available when NVD has not scored it - Every CVSS block NVD holds (v4.0, v3.1, v3.0, v2) with score, severity, vector and who scored it
- CWE weakness ids
- Whether it is in the CISA Known Exploited Vulnerabilities catalog, with the date added, the action due date and the required action
- References with their tags, such as Patch, Exploit or Vendor Advisory
- Affected products as CPE strings with version ranges, and their count
- A link to the NVD page
Input
- CVE ids: any number. They are fetched 100 to a request.
- Keyword searches: words to find in descriptions. Several words must all appear; turn on exact match for phrases.
- Products: a CPE 2.3 match string such as
cpe:2.3:a:apache:log4j, with a version if you want one, or the short formapache:log4j. - Published from and to (YYYY-MM-DD): on its own it lists every CVE NVD published in that range; with keywords or products it narrows them. Ranges longer than the API's 120 day limit are split for you.
- Filters: CVSS v3 severity, CWE id, only CISA KEV entries, and leave out rejected CVEs (on by default).
- Maximum results per search (default 200).
- Your own NVD API key, optional, stored as a secret.
Output
One dataset item per CVE, with query and queryType showing which input found it, then cveId, published, lastModified, status, description, baseScore, baseSeverity, cvssVersion, cvssV40, cvssV31, cvssV30, cvssV2, cwes, inCisaKev, cisaKev, tags, references, affectedProducts (first 500), affectedProductCount, sourceIdentifier, nvdUrl and notice. An id that is not a CVE id, a CVE NVD does not hold, a product string it cannot read, a search with no matches and a rejected API key each give an item with error.
Speed and your API key
NVD allows 5 requests in a rolling 30 second window without a key and recommends six seconds between requests, so the actor waits six seconds between requests. With your own free NVD key the limit is 50 requests in 30 seconds and the actor waits two seconds. One request returns up to 2,000 CVEs, or up to 100 CVEs by id. Keys are personal to the person who requested them under NVD's terms, so use your own.
Pricing
Pay per event: one cve-returned event per CVE returned. Errors and empty searches are not charged. The run stops when it reaches the maximum charge you set.
Notice
This product uses the NVD API but is not endorsed or certified by the NVD. Every row carries this notice in notice.
Support
Questions and problems: the Issues tab on this page. Replies are written by an AI assistant on behalf of the developer and reviewed by the developer.
