NVD CVE Feed — CVSS v4/v3, CISA KEV, CWE, Affected Products

Get CVE records from the official NIST National Vulnerability Database (NVD) API 2.0 as clean, flat rows: CVSS v4.0 / v3.x / v2 scores and vectors, CWE, the CISA Known Exploited Vulnerabilities (KEV) flag and dates, CISA SSVC exploitation status, affected vendors / products / version ranges (from the NVD's CPE data and the vendor's own CNA data), and the key references. Or get the change history: every change the NVD recorded (new CVE, CVSS added, KEV update, rejection, re-analysis).

This product uses the NVD API but is not endorsed or certified by the NVD.

Unofficial tool — not affiliated with NIST, the NVD, MITRE, the CVE Program or CISA.

What you get

• One row per CVE (or one row per change event) — no nested API structures to unpack.
• CVSS done for you: the preferred score per version (NVD first, then the CNA), plus maxCvssScore / maxCvssSeverity = the highest v3.x or v4.0 base score from any source, so you can filter "CRITICAL" without missing CVEs that only have a v4.0 score.
• Known exploited? isKev, kevDateAdded, kevDueDate, kevRequiredAction (CISA KEV), and ssvcExploitation (active / poc / none, from CISA's SSVC assessment), ssvcAutomatable, ssvcTechnicalImpact.
• Affected products, flattened: vendors, products and affectedProducts (vendor, product, version, version range, CPE) from the NVD's CPE applicability statements and from the CVE's own "affected" data published by the CNA. Most new CVEs wait weeks for NVD analysis (status Received / Awaiting Analysis / Deferred, no CPE) — this Actor still tells you which products they affect.
• Vendor / product filter that also finds not-yet-analysed CVEs (matched against both sources).
• Changes feed: dateType: "lastModified" returns CVEs updated in the window; mode: "changes" returns the change events themselves (what changed, old and new values).
• No silent gaps: long windows are split automatically (the API allows 120 days per query), every page is read until the API's total is covered, and the run summary says whether more rows matched than maxItems.
• Works without an API key (stays under the NVD's public rate limit). Add your own free NVD API key to make it faster.

Quick start — verified input

{
  "daysBack": 7,
  "maxItems": 100
}

Returns the 100 newest CVEs published in the last 7 days (newest first), in about 15 seconds. An empty input {} does the same.

More examples:

{ "dateType": "kevAdded", "daysBack": 30, "maxItems": 500 }

CVEs added to the CISA KEV catalog in the last 30 days.

{ "vendor": "microsoft", "severities": ["CRITICAL", "HIGH"], "daysBack": 14, "maxItems": 1000 }

High and critical Microsoft CVEs published in the last 14 days (including ones the NVD has not analysed yet).

{ "cveIds": ["CVE-2021-44228", "CVE-2024-3400", "CVE-2023-4863"] }

Look up specific CVEs (up to 2,000 per run).

{ "dateType": "lastModified", "daysBack": 1, "maxItems": 10000 }

Everything that changed in the last 24 hours — the NVD's recommended way to keep a local copy up to date.

{ "mode": "changes", "daysBack": 2, "eventNames": ["CVE CISA KEV Update", "Initial Analysis"], "maxItems": 1000 }

Change events of the last 2 days: KEV updates and first NVD analyses.

Input

Field	What it does
mode	cves (CVE records, default) or changes (change-history events).
daysBack	Window = the last N days (default 7). Long windows are split automatically.
dateType	published (new CVEs, default), lastModified (updated CVEs) or kevAdded (added to CISA KEV).
startDate / endDate	Optional explicit window, YYYY-MM-DD or ISO date-time, UTC.
keyword / exactPhrase	Words that must appear in the description (the API's keyword search).
minCvssScore	Minimum of the highest CVSS v3.x/v4.0 base score, e.g. 7.
severities	Any of LOW, MEDIUM, HIGH, CRITICAL.
cweIds	e.g. CWE-79, CWE-89 (or 79). Several = any of them.
vendor / product	Names, e.g. apache / log4j. Matched against NVD CPE and CNA data.
cpeMatchString	Advanced: a CPE 2.3 match string the NVD filters on (fast for multi-year history; analysed CVEs only).
kevOnly	Only CVEs in CISA KEV.
excludeRejected	Leave out rejected CVE IDs (default on).
cveIds	Look up these CVEs (the window is ignored).
eventNames	changes mode: keep only these events (e.g. CVE Received, Initial Analysis, CVE Rejected).
sortOrder	newest (default) or oldest.
maxItems	Max rows (default 100).
maxApiRequests	Hard cap on API requests (default 100; each reads up to 500 CVEs or 1,000 events).
apiKey	Optional, your own NVD API key (request one free).

Output example (one CVE row, shortened)

{
  "recordType": "cve",
  "cveId": "CVE-2021-44228",
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "publishedAt": "2021-12-10T10:15:09.143Z",
  "lastModifiedAt": "2025-10-27T17:29:54.990Z",
  "analysisStatus": "Analyzed",
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features ...",
  "maxCvssScore": 10,
  "maxCvssSeverity": "CRITICAL",
  "cvssV3Score": 10,
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssV3Source": "NVD",
  "cweIds": ["CWE-917", "CWE-20", "CWE-400", "CWE-502"],
  "isKev": true,
  "kevDateAdded": "2021-12-10",
  "kevDueDate": "2021-12-24",
  "kevVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "ssvcExploitation": "active",
  "ssvcAutomatable": "yes",
  "vendors": ["apache", "siemens", "...", "Apache Software Foundation"],
  "affectedProducts": [
    { "origin": "nvd-cpe", "part": "application", "vendor": "apache", "product": "log4j",
      "versionStartIncluding": "2.0.1", "versionEndExcluding": "2.3.1", "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*" },
    { "origin": "cna", "vendor": "Apache Software Foundation", "product": "Apache Log4j2", "version": "2.0-beta9", "lessThan": "log4j-core*" }
  ],
  "referenceCount": 103,
  "keyReferences": [{ "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": ["Release Notes", "Vendor Advisory"] }],
  "hasExploitReference": true,
  "hasPatchReference": true,
  "assigner": "apache.org",
  "source": "NIST National Vulnerability Database (NVD) - CVE API 2.0 / CVE Change History API 2.0",
  "sourceUrl": "https://nvd.nist.gov/",
  "license": "This product uses the NVD API but is not endorsed or certified by the NVD. ...",
  "retrievedAt": "2026-10-13T07:30:00.000Z"
}

A change row (mode: "changes") has cveId, eventName, changeId, changedAt, assigner, changeTypes (e.g. ["CVSS V3.1", "CWE", "Reference"]), detailCount and details (action, type, oldValue, newValue).

Field notes:

• analysisStatus is the NVD status: Received, Awaiting Analysis, Undergoing Analysis, Analyzed, Modified, Deferred, Rejected.
• cvssV3* / cvssV40* prefer the NVD's own score (Primary) and fall back to the CNA's; every published score is in cvssMetrics. CVSS v2 is legacy (the NVD stopped adding it in 2022) and is not part of maxCvss*.
• affectedProducts[].origin: nvd-cpe (NVD analysis), cna (the vendor/CNA that published the CVE), adp (CISA). Only versions marked affected are listed; at most 500 entries per CVE (affectedProductsTotal tells the full count).
• assigner and score sources are given as the organisation's domain (e.g. redhat.com), NVD, CISA-ADP, CNA (a CNA that the NVD identifies by a UUID, scoring its own CVE) or that UUID — never as an e-mail address.
• affectedProducts[] from CPE data also carry softwareEdition and targetSoftware when the CPE names them (e.g. fips, wordpress).
• Dates are UTC (ISO 8601 with Z); KEV dates are YYYY-MM-DD as published.

Common input mistakes

You wrote	Write instead
"vendor": "cpe:2.3:a:apache:log4j"	"vendor": "apache", "product": "log4j" or "cpeMatchString": "cpe:2.3:a:apache:log4j"
"cveIds": ["log4shell"]	"cveIds": ["CVE-2021-44228"] (or "keyword": "log4j")
"minCvssScore": 75	"minCvssScore": 7.5 (CVSS scores go from 0 to 10)
"severities": ["urgent"]	"severities": ["CRITICAL"]
"startDate": "03/04/2026"	"startDate": "2026-03-04" (day/month order is ambiguous)
"kevOnly": true with "daysBack": 3	KEV additions are a few per week: use "dateType": "kevAdded", "daysBack": 30

Empty results?

A run that finds nothing succeeds with 0 rows and a warning. Typical causes:

• a short window with strict filters (e.g. kevOnly over 3 days);
• a keyword that is not in any description in the window (the keyword searches the English description only);
• a vendor / product spelled differently from the NVD and CNA data — try one distinctive word ("product": "exchange");
• a CVE ID the NVD does not have yet (listed in RUN_SUMMARY.lookups.notFound);
• mode: "changes" with an event name that did not occur in the window.

Speed and limits

• Without an API key the Actor sends one request every 6.5 seconds (the NVD's public limit is 5 requests per rolling 30 seconds). Each request reads up to 500 CVEs, so 10,000 CVEs take about 3–4 minutes.
• With your own NVD API key requests are 3 seconds apart (the keyed limit is 50 per 30 seconds; the NVD recommends sleeping a few seconds between requests anyway), and you no longer share the public per-IP limit with other clients. The NVD terms say keys must not be shared, so the Actor has no built-in key — use your own.
• Vendor / product filters read every CVE in the window (about 450 new CVEs per day in 2026). Keep the window to weeks, or use cpeMatchString for multi-year history.
• If the NVD answers HTTP 403 (usually its rate limit), the Actor waits 35 seconds and retries twice. If it keeps refusing, the run stops: rows already collected are kept (complete: false in RUN_SUMMARY).
• Each run stores RUN_SUMMARY (window, totals, pages read, stop reason, IDs not found) and LICENSE in its key-value store.

Data source, attribution and licence

• Source: NIST National Vulnerability Database, CVE API 2.0 and CVE Change History API 2.0, services.nvd.nist.gov. Only these two documented endpoints are called.

• NVD notice (as the NVD API Terms of Use ask): This product uses the NVD API but is not endorsed or certified by the NVD. NVD data are a U.S. Government work: "All NIST publications are available in the public domain according to Title 17 of the United States Code". The NVD "Getting Started" page asks for the same notice in these words: This product uses data from the NVD API but is not endorsed or certified by the NVD.

• CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Reproduced under the CVE Terms of Use licence:

  CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

  ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

  Every row's license field carries the NVD notice, MITRE's copyright designation and the CVE Usage licence above, word for word, so every copy of the data you export includes them. For runs in 2026 the field reads:

  This product uses the NVD API but is not endorsed or certified by the NVD. NVD data: U.S. Government work (NIST), public domain in the U.S. under Title 17 U.S.C. CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. [CVE Terms of Use: https://www.cve.org/Legal/TermsOfUse] Field values are as published by the NVD; derived fields (maxCvss*, vendors, products, affectedProducts, keyReferences, has*Reference, referenceCount) are computed by this Actor. Unofficial tool, not affiliated with NIST, the NVD, MITRE or CISA.

  The year in the designation is the year of the run. The licence, the disclaimer and the links are also saved with every run (LICENSE record).

• Values are passed through as published. Fields computed by this Actor: maxCvssScore, maxCvssSeverity, maxCvssVersion, vendors, products, affectedProducts (a flattened view of the CPE and CNA data), affectedProductsTotal, affectedProductsTruncated, hasNvdCpe, keyReferences, referenceCount, referencesWithheld, has*Reference, changeTypes, detailCount, assigner. Dates are re-written with a Z (the API returns UTC without an offset).

• The API is provided "as is"; the NVD makes no warranty that it will be error free or uninterrupted. NVD analysis lags behind publication for many new CVEs.

Legal and privacy

• Public data only. The Actor uses the NVD's public, documented API at its published rate limits. No login, no scraping of web pages.
• Unofficial / not affiliated with NIST, the NVD, MITRE, the CVE Program or CISA. "NVD", "CVE" and "KEV" name the data source only.
• You are responsible for using the data in line with the NVD Terms of Use, the CVE Terms of Use and the laws that apply to you.
• GDPR / personal data: CVE records describe software. The Actor never outputs e-mail addresses: CNA identifiers are reduced to the organisation's domain, and a description, reference URL or change value that contains an e-mail address is withheld (descriptionWithheld, referencesWithheld, valueWithheld), never edited. Contact and credit data are not part of the API. Note that for open-source projects the "vendor" in CVE data can be the developer's own account name (for example a GitHub user who publishes the project) — it is output as published because it identifies the affected software.