National Vulnerability Database Developers

https://nvd.nist.gov/developers
Admin
The National Vulnerability Database (NVD) offers developer resources and data, including analyzed...
Tokens:35,796
Snippets:215
Trust Score:10
Update:2 days ago
Show doc for...
Tokens:
Raw
### Request Source Records with Pagination (First Page)

Source: https://nvd.nist.gov/developers/data-sources

Example request using resultsPerPage and startIndex to retrieve 20 source records starting at index 0.

```http
https://services.nvd.nist.gov/rest/json/source/2.0/?resultsPerPage=20&startIndex=0
```

--------------------------------

### Request Source Records with Pagination (Second Page)

Source: https://nvd.nist.gov/developers/data-sources

Example request using resultsPerPage and startIndex to retrieve the next 20 source records starting at index 20.

```http
https://services.nvd.nist.gov/rest/json/source/2.0/?resultsPerPage=20&startIndex=20
```

--------------------------------

### GET /rest/json/cves/2.0?kevStartDate={start}&kevEndDate={end}

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE records that were added to the CISA Known Exploited Vulnerabilities (KEV) catalog during the specified period. Both kevStartDate and kevEndDate are required.

```APIDOC
## [GET] /rest/json/cves/2.0?kevStartDate={start}&kevEndDate={end}

### Description
Requests all CVE records that were added to the CISA Known Exploited Vulnerabilities (KEV) catalog during the specified period.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0/?kevStartDate={start}&kevEndDate={end}

### Parameters
#### Query Parameters
- **kevStartDate** (string) - Required - Start date in extended ISO-8601 format (e.g., 2023-01-01T00:00:00.000Z).
- **kevEndDate** (string) - Required - End date in extended ISO-8601 format (e.g., 2023-04-30T23:59:59.000Z).

### Request Example
```
https://services.nvd.nist.gov/rest/json/cves/2.0/?kevStartDate=2023-01-01T00:00:00.000Z&kevEndDate=2023-04-30T23:59:59.000Z
```

### Response
#### Success Response (200)
- **vulnerabilities** (array) - List of CVE objects that were added to the KEV catalog within the specified date range.

#### Response Example
```json
{
  "vulnerabilities": []
}
```
```

--------------------------------

### Example of a valid request for which there exists no vulnerabilities

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using cvssV2Metrics that returns no vulnerabilities.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV2Metrics=AV:L/AC:H/Au:M/C:N/I:N/A:N 
```

--------------------------------

### CPE API JSON Response Example

Source: https://nvd.nist.gov/developers/products

Example JSON response from the CPE API showing the structure with resultsPerPage, startIndex, totalResults, format, version, timestamp, and products array. Includes both non-deprecated and deprecated CPE objects with fields like cpeName, cpeNameId, titles, refs, deprecatedBy, and deprecates.

```json
{
	"resultsPerPage": 2,
	"startIndex": 0,
	"totalResults": 2,
	"format": "NVD_CPE",
	"version": "2.0",
	"timestamp": "2023-01-10T19:46:53.290",
	"products": [
		{
			"cpe": {
				"deprecated": false,
				"cpeName": "cpe:2.3:a:3com:3cdaemon:-:*:*:*:*:*:*:*",
				"cpeNameId": "BAE41D20-D4AF-4AF0-AA7D-3BD04DA402A7",
				"lastModified": "2011-01-12T14:35:43.723",
				"created": "2007-08-23T21:05:57.937",
				"titles": [
					{
						"title": "3Com 3CDaemon",
						"lang": "en"
					},
					{
						"title": "スリーコム 3CDaemon",
						"lang": "ja"
					}
				]
			}
		},
		{
			"cpe": {
				"deprecated": true,
				"cpeName": "cpe:2.3:o:linux:linux_kernel:2.6.2:*:*:*:*:*:*:*",
				"cpeNameId": "DF3171C4-00E8-4B0F-97EB-2F3EC3394A87",
				"lastModified": "2021-06-01T14:14:47.707",
				"created": "2007-08-23T21:16:59.567",
				"titles": [
					{
						"title": "Linux Kernel 2.6.2",
						"lang": "en"
					}
				],
				"refs": [
					{
						"ref": "https://github.com/torvalds/linux",
						"type": "Version"
					}
				],
				"deprecatedBy": [
					{
						"cpeName": "cpe:2.3:o:linux:linux_kernel:2.6.2:-:*:*:*:*:*:*",
						"cpeNameId": "1B4C49FC-8606-45D7-94D1-19C5626D69C7"
					}
				],
				"deprecates": [
					{
						"cpeName": "cpe:2.3:o:linux:kernel:2.6.2:*:*:*:*:*:*:*",
						"cpeNameId": "B548E49E-BC95-4804-A2C2-D7ACC7F72095"
					}
				]
			}
		}
	]
}
```

--------------------------------

### CPE API Requests by cpeMatchString

Source: https://nvd.nist.gov/developers/products

Example requests to retrieve CPE names matching a CPE match string. The match string can be a partial CPE name or a full version. The third example uses a wildcard vendor pattern.

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?cpeMatchString=cpe:2.3:o:microsoft:windows_10
```

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?cpeMatchString=cpe:2.3:o:microsoft:windows_10:1511
```

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?cpeMatchString=cpe:2.3:*:Microsoft
```

--------------------------------

### Request all CVE matching the CVSSv2 vector string

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the cvssV2Metrics parameter with a full vector string.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV2Metrics=AV:N/AC:H/Au:N/C:C/I:C/A:C 
```

--------------------------------

### GET /rest/json/cves/2.0?lastModStartDate={start}&lastModEndDate={end}

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE records that were last modified during the specified period. Both lastModStartDate and lastModEndDate are required.

```APIDOC
## [GET] /rest/json/cves/2.0?lastModStartDate={start}&lastModEndDate={end}

### Description
Requests all CVE records that were last modified during the specified period.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate={start}&lastModEndDate={end}

### Parameters
#### Query Parameters
- **lastModStartDate** (string) - Required - Start date in extended ISO-8601 format.
- **lastModEndDate** (string) - Required - End date in extended ISO-8601 format.

### Request Example
```
https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2023-01-01T00:00:00.000Z&lastModEndDate=2023-04-30T23:59:59.000Z
```

### Response
#### Success Response (200)
- **vulnerabilities** (array) - List of CVE objects that were last modified within the specified date range.

#### Response Example
```json
{
  "vulnerabilities": []
}
```
```

--------------------------------

### Request CVEs using its CVE-ID

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the cveIds parameter with a comma-separated list of CVE IDs.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cveIds=CVE-2019-1010218,CVE-2019-1010
```

--------------------------------

### NVD Data Sources API JSON Response Example

Source: https://nvd.nist.gov/developers/data-sources

Example JSON response from the NVD Data Sources API showing the structure with resultsPerPage, startIndex, totalResults, format, version, timestamp, and sources array. The sources array includes objects with name, contactEmail, sourceIdentifiers, lastModified, created, and optional acceptance level objects.

```json
{ 
  "resultsPerPage": 2,
  	"startIndex": 0,
  	"totalResults": 215,
  	"format": "NVD_SOURCE",
  	"version": "2.0",
  	"timestamp": "2022-08-25T17:48:15.150",
  	"sources": [
  		{
  			"name": "MITRE",
  			"contactEmail": "cve@mitre.org",
  			"sourceIdentifiers": [
  				"cve@mitre.org",
  				"security-info@sgi.com",
  				"security@netgear.com"
  			],
  			"lastModified": "2019-09-09T16:18:45.930",
  			"created": "2019-09-09T16:18:45.930",
  			"v3AcceptanceLevel": {
  				"description": "Contributor",
  				"lastModified": "2022-08-18T00:00:05.690"
  			},
  			"cweAcceptanceLevel": {
  				"description": "Reference",
  				"lastModified": "2022-08-19T00:00:00.060"
  			}
  		},
  		{
  			"name": "DWF",
  			"contactEmail": "cve-assign@distributedweaknessfiling.org",
  			"sourceIdentifiers": [
  				"cve-assign@distributedweaknessfiling.org",
  				"josh@bress.net"
  			],
  			"lastModified": "2019-09-09T16:18:45.930",
  			"created": "2019-09-09T16:18:45.930",
  			"cweAcceptanceLevel": {
  				"description": "Reference",
  				"lastModified": "2020-10-01T00:00:00.070"
  			}
  		}
  	]
  }
```

--------------------------------

### CPE Match Criteria API with cveId Parameter

Source: https://nvd.nist.gov/developers/products

Example URL using the cveId parameter to return all non-deprecated CPE match strings for a specific CVE.

```url
https://services.nvd.nist.gov/rest/json/cpematch/2.0?cveId=CVE-2022-32223
```

--------------------------------

### CPE Match API JSON Response Example

Source: https://nvd.nist.gov/developers/products

Example JSON response from the CPE Match API showing the structure with resultsPerPage, startIndex, totalResults, format, version, timestamp, and matchStrings array. The matchStrings array contains matchString objects with matchCriteriaId, criteria, lastModified, cpeLastModified, created, status, and optionally matches array with cpeName and cpeNameId.

```json
{    
	"resultsPerPage": 2,
	"startIndex": 0,
	"totalResults": 413574,
	"format": "NVD_CPEMatchString",
	"version": "2.0",
	"timestamp": "2022-09-12T19:47:48.350",
	"matchStrings": [
		{
			"matchString": {
				"matchCriteriaId": "36FBCF0F-8CEE-474C-8A04-5075AF53FAF4",
				"criteria": "cpe:2.3:a:nmap:nmap:3.27:*:*:*:*:*:*:*",
				"lastModified": "2019-06-17T09:16:33.960",
				"cpeLastModified": "2019-07-22T16:37:38.133",
				"created": "2019-06-17T09:16:33.960",
				"status": "Active",
				"matches": [
					{
						"cpeName": "cpe:2.3:a:nmap:nmap:3.27:*:*:*:*:*:*:*",
						"cpeNameId": "4DAAA102-AB17-4491-B383-A1AAC764704C"                    
					}
				]
			}
		},
		{
			"matchString": {
				"matchCriteriaId": "D21D57EA-DF58-429B-9FBE-F0080085B62E",
				"criteria": "cpe:2.3:a:gnu:cfengine:2.0.7:p1:*:*:*:*:*:*",
				"lastModified": "2019-06-17T09:16:33.960",
				"cpeLastModified": "2019-07-22T16:37:38.133",
				"created": "2019-06-17T09:16:33.960",
				"status": "Active"
			}
		}
	]
} 	
```

--------------------------------

### Request a specific CVE using its CVE-ID

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the cveId parameter (deprecated, see cveIds).

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-1010218
```

--------------------------------

### GET /rest/json/cves/2.0?hasCertNotes

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE that contain a Vulnerability Note from CERT/CC. This parameter is provided without a parameter value.

```APIDOC
## GET /rest/json/cves/2.0?hasCertNotes

### Description
Requests all CVE that contain a Vulnerability Note from CERT/CC. This parameter is provided without a parameter value.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertNotes

### Parameters
#### Query Parameters
- **hasCertNotes** (boolean) - Optional - Indicates that the CVE contains a Vulnerability Note from CERT/CC. Provided without a parameter value.

### Request Example
https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertNotes

```

--------------------------------

### Request all CVE records that have the disputed CVE Tag

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the cveTag parameter to filter by the 'disputed' tag.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cveTag=disputed
```

--------------------------------

### Request CVEs with CVSSv3 vector string (no vulnerabilities)

Source: https://nvd.nist.gov/developers/vulnerabilities

Example of a valid request using a CVSSv3 vector string for which there exist no vulnerabilities.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Metrics=AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H 
```

--------------------------------

### GET /rest/json/cves/2.0?keywordSearch={keywords}

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE records where a word or phrase is found in the current description. Multiple keywords function like an AND statement.

```APIDOC
## [GET] /rest/json/cves/2.0?keywordSearch={keywords}

### Description
Requests all CVE records where a word or phrase is found in the current description.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch={keywords}

### Parameters
#### Query Parameters
- **keywordSearch** (string) - Required - The keyword(s) to search for. Multiple keywords are space-separated and function as an AND statement.

### Request Example
```
https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Microsoft
```

### Response
#### Success Response (200)
- **vulnerabilities** (array) - List of CVE objects whose current description contains all provided keywords.

#### Response Example
```json
{
  "vulnerabilities": []
}
```
```

--------------------------------

### Request Source Records by Source Identifier

Source: https://nvd.nist.gov/developers/data-sources

Example request using the sourceIdentifier parameter to retrieve all source records associated with the data source 'cve@mitre.org'.

```http
https://services.nvd.nist.gov/rest/json/source/2.0?sourceIdentifier=cve@mitre.org
```

--------------------------------

### GET /rest/json/cves/2.0?hasCertAlerts

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE that contain a Technical Alert from US-CERT. This parameter is provided without a parameter value.

```APIDOC
## GET /rest/json/cves/2.0?hasCertAlerts

### Description
Requests all CVE that contain a Technical Alert from US-CERT. This parameter is provided without a parameter value.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertAlerts

### Parameters
#### Query Parameters
- **hasCertAlerts** (boolean) - Optional - Indicates that the CVE contains a Technical Alert from US-CERT. Provided without a parameter value.

### Request Example
https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertAlerts

```

--------------------------------

### Request CVE associated with a specific CPE using an incomplete name

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using cpeName with an incomplete CPE name.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607 
```

--------------------------------

### Request CVE associated with a specific CPE

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the cpeName parameter to retrieve CVEs associated with a specific CPE.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
```

--------------------------------

### CVE Change History API JSON Response Example

Source: https://nvd.nist.gov/developers/vulnerabilities

Example JSON response from the CVE Change History API showing the structure with resultsPerPage, startIndex, totalResults, format, version, timestamp, and cveChanges. The cveChanges array contains a change object with cveId, eventName, cveChangeId, sourceIdentifier, created, and details array. The details array includes actions like Added and Changed with types such as CVSS V2, CVSS V3.1, Reference Type, CWE, and CPE Configuration.

```json
{
	"resultsPerPage": 1,
	"startIndex": 0,
	"totalResults": 558843,
	"format": "NVD_CVEHistory",
	"version": "2.0",
	"timestamp": "2022-10-24T12:30:00.000",
	"cveChanges": [
		{
			"change": {
				"cveId": "CVE-2020-12448",
				"eventName": "Initial Analysis",
				"cveChangeId": "5DEF54B9-7FF3-4436-9763-2958C5B78731",
				"sourceIdentifier": "nvd@nist.gov",
				"created": "2020-05-11T15:05:30.490",
				"details": [
					{
						"action": "Added",
						"type": "CVSS V2",
						"newValue": "NIST (AV:N/AC:L/Au:N/C:P/I:N/A:N)"
					},
					{
						"action": "Added",
						"type": "CVSS V3.1",
						"newValue": "NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
					},
					{
						"action": "Changed",
						"type": "Reference Type",
						"oldValue": "https://about.gitlab.com/blog/categories/releases/ No Types Assigned",
						"newValue": "https://about.gitlab.com/blog/categories/releases/ Product, Release Notes"
					},
					{
						"action": "Changed",
						"type": "Reference Type",
						"oldValue": "https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/ No Types Assigned",
						"newValue": "https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/ Release Notes, Vendor Advisory"
					},
					{
						"action": "Added",
						"type": "CWE",
						"newValue": "NIST CWE-22"
					},
					{
						"action": "Added",
						"type": "CPE Configuration",
						"newValue": "OR
     *cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* versions from (including) 12.8.0 up to (excluding) 12.8.10"
					}
				]
			}
		}
	]
}
```

--------------------------------

### Request any CVE mentioning "Windows", "MacOs", and "Debian"

Source: https://nvd.nist.gov/developers/vulnerabilities

Use keywordSearch with multiple keywords to return CVEs where all keywords appear somewhere in the description, though not necessarily together.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Windows MacOs Linux
```

--------------------------------

### Request 20 change events with pagination

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using resultsPerPage and startIndex parameters to retrieve a page of change events. The response includes pagination fields: resultsPerPage, startIndex, totalResults, and cveChanges.

```http
https://services.nvd.nist.gov/rest/json/cvehistory/2.0/?resultsPerPage=20&startIndex=0
```

--------------------------------

### Request all CVE rejected in a time frame

Source: https://nvd.nist.gov/developers/vulnerabilities

Example request using the eventName parameter with value 'CVE Rejected' (URL-encoded as %20) and date range parameters. Each request can contain only one eventName value.

```http
https://services.nvd.nist.gov/rest/json/cvehistory/2.0?eventName=CVE%20Rejected&changeStartDate=2021-08-04T13:00:00.000%2B01:00&changeEndDate=2021-10-22T13:36:00.000%2B01:00
```

--------------------------------

### Request any CVE mentioning "Microsoft"

Source: https://nvd.nist.gov/developers/vulnerabilities

Use keywordSearch to return CVEs where the keyword appears in the current description. Spaces should be encoded as %20, and multiple keywords act as an AND statement.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Microsoft
```

--------------------------------

### CPE API Requests with keywordSearch

Source: https://nvd.nist.gov/developers/products

Example requests that return CPE records where keywords appear in metadata title or reference links. Multiple keywords act as an AND statement, and keyword search operates with a trailing wildcard.

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordSearch=Red Hat
```

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordSearch=Java Oracle 
```

--------------------------------

### Request all CVE records added to the KEV catalog between start and end datetimes

Source: https://nvd.nist.gov/developers/vulnerabilities

Use kevStartDate and kevEndDate to filter CVEs added to the CISA KEV catalog during a specified period. Both parameters are required, and values must be in extended ISO-8601 format.

```http
https://services.nvd.nist.gov/rest/json/cves/2.0/?kevStartDate=2023-01-01T00:00:00.000Z&kevEndDate=2023-04-30T23:59:59.000Z
```

--------------------------------

### GET /rest/json/cves/2.0?hasOval

Source: https://nvd.nist.gov/developers/vulnerabilities

Requests all CVE records that contain an OVAL record. The hasOval parameter is provided without a value.

```APIDOC
## [GET] /rest/json/cves/2.0?hasOval

### Description
Requests all CVE records that contain an OVAL record.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?hasOval

### Parameters
#### Query Parameters
- **hasOval** (boolean) - Required - Indicates that only CVEs with an OVAL record should be returned. Provided without a parameter value.

### Request Example
```
https://services.nvd.nist.gov/rest/json/cves/2.0?hasOval
```

### Response
#### Success Response (200)
- **vulnerabilities** (array) - List of CVE objects that have an OVAL record.

#### Response Example
```json
{
  "vulnerabilities": []
}
```
```

--------------------------------

### GET /rest/json/cves/2.0?cvssV3Severity=LOW

Source: https://nvd.nist.gov/developers/vulnerabilities

Returns only the CVEs that match the provided CVSSv3 qualitative severity rating. This parameter cannot be used with cvssV2Severity or cvssv4Severity.

```APIDOC
## [GET] /rest/json/cves/2.0?cvssV3Severity=LOW

### Description
Returns only the CVEs that match the provided CVSSv3 qualitative severity rating. This parameter cannot be used with cvssV2Severity or cvssv4Severity.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Severity=LOW

### Parameters
#### Query Parameters
- **cvssV3Severity** (string) - Required - The CVSSv3 qualitative severity rating. Allowed values: LOW, MEDIUM, HIGH, CRITICAL. Cannot be used with cvssV2Severity or cvssv4Severity.

### Request Example
https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Severity=LOW

### Response
#### Success Response (200)
Returns a JSON object containing CVE records matching the filter.

#### Response Example
(Not provided in source)
```

--------------------------------

### CPE API Request with keywordExactMatch

Source: https://nvd.nist.gov/developers/products

Example request that returns only CPE records where the exact phrase 'Microsoft Windows' appears in metadata title or reference links. The keywordExactMatch parameter is provided without a value and requires keywordSearch.

```text
https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordSearch=Microsoft Windows&keywordExactMatch
```

--------------------------------

### GET /rest/json/cves/2.0?cweId={CWE-ID}

Source: https://nvd.nist.gov/developers/vulnerabilities

Returns only the CVEs that include a weakness identified by the provided Common Weakness Enumeration (CWE) ID.

```APIDOC
## [GET] /rest/json/cves/2.0?cweId={CWE-ID}

### Description
Returns only the CVEs that include a weakness identified by the provided Common Weakness Enumeration (CWE) ID.

### Method
GET

### Endpoint
https://services.nvd.nist.gov/rest/json/cves/2.0?cweId={CWE-ID}

### Parameters
#### Query Parameters
- **cweId** (string) - Required - The CWE ID to filter by.

### Request Example
(Not provided in source)

### Response
#### Success Response (200)
Returns a JSON object containing CVE records matching the filter.

#### Response Example
(Not provided in source)
```
Tokens:
Raw