• {name}

This parameter returns all CVE associated with a specific CPE. The exact value provided with cpeName is compared against the CPE Match Criteria within a CVE applicability statement. If the value of cpeName is considered to match, the CVE is included in the results.

A CPE Name is a string of characters comprised of 13 colon separated values that describe a product. In CPEv2.3 the first two values are always "cpe" and "2.3". The 11 values that follow are referred to as the CPE components. When filtering by cpeName the part, vendor, product, and version components are required to contain values other than "*".

CPE Match Criteria comes in two forms: CPE Match Strings and CPE Match String Ranges. Both are abstract concepts that are then correlated to CPE URIs in the Official CPE Dictionary. Unlike a CPE Name, match strings and match string ranges do not require a value in the part, vendor, product, or version components. The CVE API returns CPE Match Criteria within the configurations object.

https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*

https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607 

• {CVE-ID}

This parameter returns a specific vulnerability identified by its unique Common Vulnerabilities and Exposures identifier (the CVE ID). cveId will not accept {CVE-ID} for vulnerabilities not yet published in the NVD.

https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-1010218

• disputed
• unsupported-when-assigned
• exclusively-hosted-service

This parameter returns only the CVE records that include the provided cveTag.

https://services.nvd.nist.gov/rest/json/cves/2.0?cveTag=disputed

• {CVSSv2 vector string}

This parameter returns only the CVEs that match the provided {CVSSv2 vector string}. Either full or partial vector strings may be used. This parameter cannot be used in requests that include cvssV3Metrics or cvssv4Metrics.

Please note, as of July 2022, the NVD no longer generates new information for CVSS v2. Existing CVSS v2 information will remain in the database but the NVD will no longer actively populate CVSS v2 for new CVEs. NVD analysts will continue to use the reference information provided with the CVE and any publicly available information at the time of analysis to associate Reference Tags, information related to CVSS v3.1, CWE, and CPE Applicability statements.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV2Metrics=AV:N/AC:H/Au:N/C:C/I:C/A:C 

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV2Metrics=AV:L/AC:H/Au:M/C:N/I:N/A:N 

• LOW
• MEDIUM
• HIGH

This parameter returns only the CVEs that match the provided CVSSv2 qualitative severity rating. This parameter cannot be used in requests that include cvssV3Severity or cvssv4Severity.

Please note, as of July 2022, the NVD no longer generates new information for CVSS v2. Existing CVSS v2 information will remain in the database but the NVD will no longer actively populate CVSS v2 for new CVEs. NVD analysts will continue to use the reference information provided with the CVE and any publicly available information at the time of analysis to associate Reference Tags, information related to CVSS v3.1, CWE, and CPE Applicability statements.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV2Severity=LOW 

• {CVSSv3 vector string}

This parameter returns only the CVEs that match the provided {CVSSv3 vector string}. Either full or partial vector strings may be used. This parameter cannot be used in requests that include cvssV2Metrics or cvssv4Metrics.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Metrics=AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L 

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Metrics=AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H 

• LOW
• MEDIUM
• HIGH
• CRITICAL

This parameter returns only the CVEs that match the provided CVSSv3 qualitative severity rating. This parameter cannot be used in requests that include cvssV2Severity or cvssv4Severity.
Note: The NVD will not contain CVSS v3 vector strings with a severity of NONE. This is why that severity is not an included option.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Severity=LOW 

• {CVSSv4 vector string}

This parameter returns only the CVEs that match the provided {CVSSv4 vector string}. Either full or partial vector strings may be used. This parameter cannot be used in requests that include cvssV2Metrics or cvssV3Severity.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV4Metrics=AV:A/AC:H/PR:H/UI:N

• LOW
• MEDIUM
• HIGH
• CRITICAL

This parameter returns only the CVEs that match the provided CVSSv4 qualitative severity rating. This parameter cannot be used in requests that include cvssV2Severity or cvssV3Severity.
Note: The NVD enrichment data will not contain CVSS v4 vector strings with a severity of NONE. This is why that severity is not an included option.

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV4Severity=HIGH 

• {CWE-ID}

This parameter returns only the CVE that include a weakness identified by Common Weakness Enumeration using the provided {CWE-ID}.
Note: The NVD also makes use of two placeholder CWE-ID values NVD-CWE-Other and NVD-CWE-noinfo which can also be used.

https://services.nvd.nist.gov/rest/json/cves/2.0?cweId=CWE-287 

This parameter returns the CVE that contain a Technical Alert from US-CERT. Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertAlerts 

This parameter returns the CVE that contain a Vulnerability Note from CERT/CC. Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?hasCertNotes 

This parameter returns the CVE that appear in CISA's Known Exploited Vulnerabilities (KEV) Catalog. Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?hasKev 

This parameter returns the CVE that contain information from MITRE's Open Vulnerability and Assessment Language (OVAL) before this transitioned to the Center for Internet Security (CIS). Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?hasOval 

This parameter returns only CVE associated with a specific CPE, where the CPE is also considered vulnerable. The exact value provided with cpeName is compared against the CPE Match Criteria within a CVE applicability statement. If the value of cpeName is considered to match, and is also considered vulnerable the CVE is included in the results.

If filtering by isVulnerable, cpeName is required. Please note, virtualMatchString is not accepted in requests that use isVulnerable.

https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607&isVulnerable 

• {kevStartDate}
• {kevEndDate}

These parameters return only the CVEs that were added to the CISA Known Exploited Vulnerabilities (KEV) catalog during the specified period. If a CVE was added to the KEV catalog outside of the specified window, it will not be included. When filtering by KEV inclusion dates, both kevStartDate and kevEndDate are required.

A CVE's kevDate reflects the date it was added to the KEV catalog.

Values must be entered in the extended ISO-8601 date/time format:

The "T" separates the date from the time. The "Z" indicates optional offset-from-UTC. If a positive offset is used (e.g., +01:00 for CET), encode the "+" as "%2B". Most user agents will handle this automatically.

https://services.nvd.nist.gov/rest/json/cves/2.0/?kevStartDate=2023年01月01日T00:00:00.000Z&kevEndDate=2023年04月30日T23:59:59.000Z

By default, keywordSearch returns any CVE where a word or phrase is found in the current description.

If the value of keywordSearch is a phrase, i.e., contains more than one term, including keywordExactMatch returns only the CVEs matching the phrase exactly. Otherwise, the results will contain records having any of the terms. If filtering by keywordExactMatch, keywordSearch is required. Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Microsoft Outlook&keywordExactMatch

Please note, the example above would not return a CVE unless the exact phrase "Microsoft Outlook" appears in the current description.

• {keyword(s)}

This parameter returns only the CVEs where a word or phrase is found in the current description. Descriptions associated with CVE are maintained by the CVE Assignment Team through coordination with CVE Numbering Authorities (CNAs). The NVD has no control over CVE descriptions.

Please note, empty spaces in the URL should be encoded in the request as "%20". The user agent may handle this encoding automatically. Multiple {keywords} function like an 'AND' statement. This returns results where all keywords exist somewhere in the current description, though not necessarily together. Keyword search operates as though a wildcard is placed after each keyword provided. For example, providing "circle" will return results such as "circles" but not "encircle".

https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Microsoft 

https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Windows MacOs Linux 

• {start date}
• {end date}

These parameters return only the CVEs that were last modified during the specified period. If a CVE has been modified more recently than the specified period, it will not be included in the response. If filtering by the last modified date, both lastModStartDate and lastModEndDate are required. The maximum allowable range when using any date range parameters is 120 consecutive days.

A CVE's lastModified changes when any of the follow actions occur:

1. The NVD publishes the new CVE record
2. The NVD changes the status of a published CVE record after it has been analyzed
3. A source (CVE Primary CNA or another CNA) modifies a published CVE record

A CVE's lastModified does not change when any of the follow actions occur:

1. The NVD changes the status of a newly published CVE record to "Undergoing Analysis"
2. The NVD modifies a CPE record previously associated with the CVE record

Values must be entered in the extended ISO-8601 date/time format:

The "T" is a literal to separate the date from the time. The Z indicates an optional offset-from-UTC. Please note, if a positive Z value is used (such as +01:00 for Central European Time) then the "+" should be encoded in the request as "%2B". The user agent may handle this encoding automatically.

https://services.nvd.nist.gov/rest/json/cves/2.0/?lastModStartDate=2021年08月04日T13:00:00.000%2B01:00&lastModEndDate=2021年10月22日T13:36:00.000%2B01:00

By default, the CVE API includes CVE records with the REJECT or Rejected status. This parameter excludes CVE records with the REJECT or Rejected status from API response. Please note, this parameter is provided without a parameter value.

https://services.nvd.nist.gov/rest/json/cves/2.0?noRejected 

• {start date}
• {end date}

These parameters return only the CVEs that were added to the NVD (i.e., published) during the specified period. If filtering by the published date, both pubStartDate and pubEndDate are required. The maximum allowable range when using any date range parameters is 120 consecutive days.

Values must be entered in the extended ISO-8601 date/time format:

The "T" is a literal to separate the date from the time. The Z indicates an optional offset-from-UTC. Please note, if a positive Z value is used (such as +01:00 for Central European Time) then the "+" should be encoded in the request as "%2B". The user agent may handle this encoding automatically.

https://services.nvd.nist.gov/rest/json/cves/2.0/?pubStartDate=2021年08月04日T00:00:00.000&pubEndDate=2021年10月22日T00:00:00.000

https://services.nvd.nist.gov/rest/json/cves/2.0/?pubStartDate=2020年01月01日T00:00:00.000-05:00&pubEndDate=2020年01月14日T23:59:59.999-05:00

• {page limit}

This parameter specifies the maximum number of CVE records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 2,000.

It is recommended that users of the CVE API use the default resultsPerPage value. This value has been optimized to allow the greatest number of results over the fewest number of requests.

• {offset}

This parameter specifies the index of the first CVE to be returned in the response data. The index is zero-based, meaning the first CVE is at index zero.

The CVE API returns four primary objects in the response body that are used for pagination: resultsPerPage, startIndex, totalResults, and vulnerabilities. totalResults indicates the total number of CVE records that match the request parameters. If the value of totalResults is greater than the value of resultsPerPage, there are more records than could be returned by a single API response and additional requests must update the startIndex to get the remaining records.

The best, most efficient, practice for keeping up to date with the NVD is to use the date range parameters to request only the CVEs that have been modified since your last request.

https://services.nvd.nist.gov/rest/json/cves/2.0/?resultsPerPage=20&startIndex=0

https://services.nvd.nist.gov/rest/json/cves/2.0/?resultsPerPage=20&startIndex=20

• {sourceIdentifier}

This parameter returns CVE where the exact value of {sourceIdentifier} appears as a data source in the CVE record. The CVE API returns {sourceIdentifier} values within the descriptions object. The Source API returns detailed information on the organizations that provide the data contained in the NVD dataset, including every valid {sourceIdentifier} value.

https://services.nvd.nist.gov/rest/json/cves/[email protected] 

• {ending version}

• including
• excluding

The virtualMatchString parameter may be combined with versionEnd and versionEndType to return only the CVEs associated with CPEs in specific version ranges.

If filtering by the ending version, versionEnd, versionEndType, and virtualMatchString are required. Requests that include versionEnd cannot include a version component in the virtualMatchString.

https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:o:linux:linux_kernel&versionStart=2.6&versionStartType=including&versionEnd=2.7&versionEndType=excluding

• {starting version}

• including
• excluding

The virtualMatchString parameter may be combined with versionStart and versionStartType to return only the CVEs associated with CPEs in specific version ranges.

If filtering by the starting version, versionStart, versionStartType, and virtualMatchString are required. Requests that include versionStart cannot include a version component in the virtualMatchString.

https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:o:linux:linux_kernel&versionStart=2.2&versionStartType=including&versionEnd=2.6&versionEndType=excluding

• {cpe match string}

This parameter filters CVE more broadly than cpeName. The exact value of {cpe match string} is compared against the CPE Match Criteria present on CVE applicability statements.

CPE Match Criteria comes in two forms: CPE Match Strings and CPE Match String Ranges. Both are abstract concepts that are then correlated to CPE URIs in the Official CPE Dictionary. Unlike a CPE Name, match strings and match string ranges do not require a value in the part, vendor, product, or version components. The CVE API returns CPE Match Criteria within the configurations object.

CPE Match String Ranges are only supported for the version component and only when virtualMatchString is combined with versionStart, versionStartType, and/or versionEnd, both versionEndType.

cpeName is a simpler alternative for many use cases. When both cpeName and virtualMatchString are provided, only the cpeName is used.

https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:*:*:*:*:*:*:de

This object contains one or more tags that provide contextual information about the CVE.

source identifies the organization that provided the CVE Tag information and tags identifies each relevant CVE Tag.

"cveTags": [
	{
		"sourceIdentifier": "[email protected]",
		"tags": [
			"disputed"
		]
	}
],
							

This object contains a description of the CVE in one or more languages. ISO 639-1:2002's two-letter language identifiers indicate the language of the description. Spanish language translations are provided by the Spanish National Cybersecurity Institute (INCIBE).

"descriptions": [
	{
		"lang": "en",
		"value": "The debug command in Sendmail is enabled, allowing attackers to execute commands as root."
	},
	{
		"lang": "es",
		"value": "El comando de depuración de Sendmail está activado, permitiendo a atacantes ejecutar comandos como root."
	}
],
							

This object contains information on the CVE's impact. If the CVE has been analyzed, this object will contain any CVSSv2 or CVSSv3 information associated with the vulnerability.

source identifies the organization that provided the metrics information and type identifies whether the organization is a primary or secondary source. Primary sources include the NVD and CNA who have reached the provider level in CVMAP. 10% of provider level submissions are audited by the NVD. If a submission has been audited the NVD will appear as the primary source and the provider level CNA will appear as the secondary source.

"metrics": {
	"cvssMetricV2": [
		{
			"source": "[email protected]",
			"type": "Primary",
			"cvssData": {
				"version": "2.0",
				"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
				"accessVector": "NETWORK",
				"accessComplexity": "LOW",
				"authentication": "NONE",
				"confidentialityImpact": "COMPLETE",
				"integrityImpact": "COMPLETE",
				"availabilityImpact": "COMPLETE",
				"baseScore": 10.0				
			},
			"baseSeverity": "HIGH",
			"exploitabilityScore": 10.0,
			"impactScore": 10.0,
			"acInsufInfo": false,
			"obtainAllPrivilege": true,
			"obtainUserPrivilege": false,
			"obtainOtherPrivilege": false,
			"userInteractionRequired": false
		}
	]
},
							

This object contains information on specific weaknesses, considered the cause of the vulnerability. Please note, a CVE that is Awaiting Analysis, Undergoing Analysis, or Rejected may not include the weaknesses object.

source identifies the organization that provided the weakness information and type identifies whether the organization is a primary or secondary source. Primary sources include the NVD and CNA who have reached the provider level in CVMAP. 10% of provider level submissions are audited by the NVD. If a submission has been audited the NVD will appear as the primary source and the provider level CNA will appear as the secondary source.

"weaknesses": [
	{
		"source": "[email protected]",
		"type": "Primary",
		"description": [
			{
				"lang": "en",
				"value": "NVD-CWE-Other"
			}
		]
	}
],
							

This object contains the CVE applicability statements that convey which product, or products, are associated with the vulnerability according to the NVD analysis. Please note, a CVE that is Awaiting Analysis, Undergoing Analysis, or Rejected will not include the configurations object.

Like the JSON response, configurations are a hierarchical data structure that always contain one or more CPE match strings. Each object within configurations includes either an OR- or an AND-operator (and in rare cases a NEGATE flag) to covey the logical relationship of the CPE or child objects within. For example, if the vulnerability exists only when both CPE products are present, the operator is "AND". If the vulnerability exists if either CPE is present, then the operator is "OR".

The cpeMatch object contains the CPE Match Criteria, the criteria's unique identifier, and a statement of whether the criteria is vulnerable. The matchCriteriaId's corresponding {uuid} may be used with either the Match Criteria API's matchCriteriaId or the CPE API's matchCriteriaId parameters.

Toggle JSON

"configurations": [
	{
		"nodes": [
			{
				"operator": "OR",
				"negate": false,
				"cpeMatch": [
					{
						"vulnerable": true,
						"criteria": "cpe:2.3:a:eric_allman:sendmail:5.58:*:*:*:*:*:*:*",
						"matchCriteriaId": "1D07F493-9C8D-44A4-8652-F28B46CBA27C"
					}
				]
			}
		]
	}
],
							

This object contains supplemental information relevant to the vulnerability, and may include details that are not present in the CVE Description. Each reference within this object provides one or more resource tags (e.g., third-party advisory, vendor advisory, technical paper, press/media, VDB entries). Resource tags are designed to categorize the type of information each reference contains.

source identifies the organization that provided the reference information and type identifies whether the organization is a primary or secondary source. Primary sources include the NVD and CNA who have reached the provider level in CVMAP. 10% of provider level submissions are audited by the NVD. If a submission has been audited, the NVD will appear as the primary source and the provider level CNA will appear as the secondary source.

"references": [
	{
		"url": "http://seclists.org/fulldisclosure/2019/Jun/16",
		"source": "[email protected]"
	},
	{
		"url": "http://www.openwall.com/lists/oss-security/2019/06/05/4",
		"source": "[email protected]"
	},
	{
		"url": "http://www.openwall.com/lists/oss-security/2019/06/06/1",
		"source": "[email protected]"
	},
	{
		"url": "http://www.securityfocus.com/bid/1",
		"source": "[email protected]"
	}
]
							

This object contains any Official Vendor Comment for the CVE. NVD provides a service whereby organizations can submit Official Vendor Comments for CVE associated with their products. Organizations can use the service in a variety of ways. For example, they can provide configuration and remediation guidance, clarify vulnerability applicability, provide deeper vulnerability analysis, dispute third party vulnerability information, and explain vulnerability impact. Official Vendor Comments can be submitted to the NVD by email at [email protected]. More information is provided on the vendor comments page.

"vendorComments": [
	{
		"organization": "Red Hat",
		"comment": "Not vulnerable. This issue did not affect the versions of the util-linux packages (providing /bin/login), as shipped with Red Hat Enterprise Linux 2.1, 3, 4 or 5.",
		"lastModified": "2008-12-18T00:00:00"
	}
]
							

• {start date}
• {end date}

These parameters return any CVE that changed during the specified period. Please note, this is different from the last modified date parameters used with other APIs. If filtering by the change date, both changeStartDate and changeEndDate are required. The maximum allowable range when using any date range parameters is 120 consecutive days.

Values must be entered in the extended ISO-8601 date/time format:

The "T" is a literal to separate the date from the time. The Z indicates an optional offset-from-UTC. Please note, if a positive Z value is used (such as +01:00 for Central European Time) then the "+" should be encoded in the request as "%2B". The user agent may handle this encoding automatically.

https://services.nvd.nist.gov/rest/json/cvehistory/2.0/?changeStartDate=2021年08月04日T13:00:00.000%2B01:00&changeEndDate=2021年10月22日T13:36:00.000%2B01:00

• {CVE-ID}

This parameter returns the complete change history for a specific vulnerability identified by its unique Common Vulnerabilities and Exposures identifier (the CVE ID). cveId will not accept {CVE-ID} for vulnerabilities not yet published in the NVD.

https://services.nvd.nist.gov/rest/json/cvehistory/2.0?cveId=CVE-2019-1010218

This parameter returns all CVE associated with a specific type of change event. Please note, each request can contain only one value for the eventName parameter. Empty spaces in the URL should be encoded in the request as "%20". The user agent may handle this encoding automatically.

https://services.nvd.nist.gov/rest/json/cvehistory/2.0?eventName=CVE%20Rejected&changeStartDate=2021年08月04日T13:00:00.000%2B01:00&changeEndDate=2021年10月22日T13:36:00.000%2B01:00

• {page limit}

This parameter specifies the maximum number of change events to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 5,000.

• {offset}

This parameter specifies the index of the first change events to be returned in the response data. The index is zero-based, meaning the first change events is at index zero.

The CVE Change History API returns four primary objects in the response body that are used for pagination: resultsPerPage, startIndex, totalResults, and cveChanges. totalResults indicates the total number of change events that match the request parameters. If the value of totalResults is greater than the value of resultsPerPage, there are more events than could be returned by a single API response and additional requests must update the startIndex to get the remaining events.

https://services.nvd.nist.gov/rest/json/cvehistory/2.0/?resultsPerPage=20&startIndex=0