NVD CPE Dictionary Software Product Search Scraper API

Search the authoritative public NIST National Vulnerability Database CPE 2.0 API for CPE 2.3 product-configuration names. Use it to normalize software inventory labels and build reference inputs for later vulnerability matching.

Fast start

Empty input uses the deterministic Microsoft Office match and returns at most 5 rows:

{}

Focused search:

{"cpeMatchString":"cpe:2.3:a:microsoft:office","vendor":"microsoft","product":"office","deprecated":"false","maxResults":5}

You can also use exactCpeName, NVD keyword, part (a, o, h), exact local vendor/product/version, deprecation state, and a paired modified date range. maxCandidates (up to 5,000) and maxPages (up to 20) strictly bound pagination and local filtering.

Output

Each found row includes the CPE name and NVD ID, all stable CPE 2.3 components, multilingual titles, references, creation/modification timestamps, deprecation status and replacement mappings, retrieval time, query bounds, and source semantics. NO_MATCH and SOURCE_UNAVAILABLE are explicit dataset outcomes.

Evidence limits

A CPE name identifies a standardized product configuration. It does not prove that software is installed, exposed, vulnerable, supported, safe, or affected by a CVE. NVD records and deprecation mappings can change; bounded results are not a complete dictionary export. Confirm inventory and CVE applicability independently.

Pricing and runtime

Pay per event: $0.0001 per start + $0.002 per dataset item. The empty-input run emits at most 5 paid rows (maximum $0.0101). Buyer charge limits reduce maxResults before source work. Defaults target 128-256 MB and a 300-second run ceiling.

Source: https://nvd.nist.gov/products/cpe · API: https://services.nvd.nist.gov/rest/json/cpes/2.0