Docs
Open Lodol
DocumentationIntegrationsAPI

NVD

App · Compliance & Security · 21 actions

Search the US government's National Vulnerability Database, run by NIST. Look up a CVE and get its description, CVSS scores, CWE weakness types, affected product versions and references; find every vulnerability in a product by its CPE; filter by severity, weakness or CVSS vector; list what was published or rescored in a date range; and pull the CVEs CISA confirms are being exploited right now. Also covers the CPE product dictionary, the match criteria behind a CVE's affected-version ranges, every recorded change to a CVE record, and the organizations that supply the data. No account is needed; a free NIST API key raises the rate limit.

Actions

ActionWhat it does
Find CVEs affecting a productFind every vulnerability that affects a piece of software or hardware, named by its CPE.
Find CVEs by severityFind vulnerabilities by how bad they are: a CVSS severity band, a CVSS vector (whole or partial, e.g. AV:N for network reachable), or both.
Get a CVELook up one vulnerability by its CVE ID and get everything the NVD holds on it: the description, CVSS scores and severity, CWE weakness types, affected products, references, and whether CISA lists it as actively exploited.
Get a CVE's change historyList every change ever made to one CVE record, oldest first: when it was received, analyzed, rescored, retagged or rejected, who made each change and exactly which values moved.
Get a data sourceLook up one data-supplying organization and get its contact address, every identifier it publishes under, and its CVSS and CWE acceptance levels.
Get a match criterionGet one match criterion by its ID, with its version bounds and every CPE name it resolves to.
Get a productGet one product record from the CPE dictionary by its ID, including its titles, vendor references, and whether it has been deprecated in favour of another CPE.
Get several CVEsLook up as many as 100 CVEs in a single request, instead of one step each.
List a CVE's match criteriaList the product ranges one CVE is tied to, each with the CPE names it covers.
List actively exploited CVEs (CISA KEV)List the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, the ones confirmed to be under attack in the wild.
List CVE changes in a date rangeList changes made across all CVEs inside a window of up to 120 days, optionally only one kind of change.
List CVEs changed in a date rangeList the vulnerabilities whose records changed inside a window of up to 120 days, including ones published long ago that were rescored or reanalyzed.
List CVEs published in a date rangeList the vulnerabilities first published inside a window of up to 120 days.
List data sourcesList the organizations that supply the NVD its data, with the identifiers their CVE records are published under and how far NVD trusts each one's scores.
List data sources changed in a date rangeList the data-supplying organizations whose records changed inside a window of up to 120 days, which is how a new CVE Numbering Authority or a changed acceptance level shows up.
List match criteria changed in a date rangeList the match criteria added or changed inside a window of up to 120 days.
List products changed in a date rangeList the CPE product records added or changed inside a window of up to 120 days.
List the products a match criterion coversExpand one match criterion into the actual product versions it resolves to.
Search CVEsSearch the NVD by keyword and by the flags on a record: weakness type, assigning source, analysis status, tag, and whether it is in CISA's Known Exploited Vulnerabilities catalog.
Search match criteriaFind the match criteria whose CPE fits a match string, for example every criterion that mentions log4j.
Search productsSearch the NVD's product dictionary for the CPE name of a piece of software or hardware.

Find CVEs affecting a product

Find every vulnerability that affects a piece of software or hardware, named by its CPE. Give an exact CPE name to ask about one version, or a match string with '*' in the version field to ask about the product as a whole, optionally narrowed to a version range. Use 'Search products' first if you do not know the CPE.

Inputs

Exact CPE namecpe_nametext
One fully specified product version. Fill in this or the match string, not both.
CPE match stringmatch_stringtext
A partial CPE covering a whole product or vendor, with '*' in the fields you are not pinning down. Fill in this or the exact CPE name, not both.
Only where this product is the vulnerable onevulnerable_onlytrue/false
A CVE's configuration also lists products that merely have to be present (an operating system, say). Turn this on to skip those. Needs an exact CPE name.Default: false.
From versionversion_starttext
The bottom of a version range to narrow the match string to. The match string's own version field must be '*' when you use this.
From version isversion_start_typetext
Whether the 'from' version is itself affected.One of: including (Including this version), excluding (Excluding this version). Default: including.
To versionversion_endtext
The top of a version range to narrow the match string to, typically the release that fixed the flaw.
To version isversion_end_typetext
Whether the 'to' version is itself affected. Choose 'excluding' when it is the fixed release.One of: including (Including this version), excluding (Excluding this version). Default: excluding.
Hide rejected CVEsexclude_rejectedtrue/false
Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing.Default: true.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 15
}

Find CVEs by severity

Find vulnerabilities by how bad they are: a CVSS severity band, a CVSS vector (whole or partial, e.g. AV:N for network reachable), or both. Pick which CVSS generation to filter on; the NVD scores most modern CVEs with v3.x.

Inputs

Severityseveritytext
The severity band to return. Critical exists only in CVSS v3.x and v4.0; v2.0 stops at High.One of: CRITICAL, HIGH, MEDIUM, LOW.
CVSS versioncvss_versiontext
Which generation of CVSS score the severity and vector apply to. v3.x covers both v3.0 and v3.1. Defaults to v3.x, which is what most current CVEs are scored with.One of: 4.0 (CVSS v4.0), 3.x (CVSS v3.x), 2.0 (CVSS v2.0). Default: 3.x.
CVSS vectorcvss_vectortext
A full or partial CVSS vector to match. A partial one filters on just those dimensions, so AV:N/PR:N finds anything reachable over the network with no privileges needed.
Search phrasekeyword_searchtext
Optional words the CVE description must also contain, to narrow the band to one product or technology.
Hide rejected CVEsexclude_rejectedtrue/false
Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing.Default: true.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 30573
}

Get a CVE

Look up one vulnerability by its CVE ID and get everything the NVD holds on it: the description, CVSS scores and severity, CWE weakness types, affected products, references, and whether CISA lists it as actively exploited.

Inputs

CVE IDcve_idtextRequired
The vulnerability to look up. A pasted nvd.nist.gov link works too.

Outputs

cveobject
Example output
{
  "cve": {
    "base_score": 10.0,
    "base_severity": "CRITICAL",
    "configurations": [
      {
        "nodes": [
          {
            "cpe_match": [
              {
                "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                "version_end_excluding": "2.15.0",
                "version_end_including": null,
                "version_start_excluding": null,
                "version_start_including": "2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": null
      }
    ],
    "cpe_matches": [
      {
        "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
        "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
        "version_end_excluding": "2.15.0",
        "version_end_including": null,
        "version_start_excluding": null,
        "version_start_including": "2.0",
        "vulnerable": true
      }
    ],
    "cvss": {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "exploitability_score": 3.9,
      "impact_score": 6.0,
      "source": "nvd@nist.gov",
      "type": "Primary",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "version": "3.1"
    },
    "cwe_ids": [
      "CWE-917",
      "CWE-20"
    ],
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "descriptions": [
      {
        "lang": "en",
        "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
      }
    ],
    "evaluator_comment": null,
    "evaluator_impact": null,
    "evaluator_solution": null,
    "id": "CVE-2021-44228",
    "in_kev": true,
    "kev": {
      "action_due": "2021-12-24",
      "date_added": "2021-12-10",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    },
    "last_modified": "2025-04-03T01:03:51Z",
    "metrics": [
      {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      }
    ],
    "published": "2021-12-10T10:15:09Z",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://logging.apache.org/log4j/2.x/security.html"
      }
    ],
    "source_identifier": "security@apache.org",
    "ssvc": [
      {
        "options": {
          "automatable": "yes",
          "exploitation": "active",
          "technicalImpact": "total"
        },
        "role": "CISA Coordinator",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "timestamp": "2025-02-04T14:25:34Z",
        "version": "2.0.3"
      }
    ],
    "tags": [],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
    "vendor_comments": [],
    "vuln_status": "Analyzed",
    "weaknesses": [
      {
        "cwe_ids": [
          "CWE-917"
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

Get a CVE's change history

List every change ever made to one CVE record, oldest first: when it was received, analyzed, rescored, retagged or rejected, who made each change and exactly which values moved.

Inputs

CVE IDcve_idtextRequired
The vulnerability whose history you want.
Only this kind of changeevent_nametext
Narrow the history to one kind of event. Leave blank for all of them.One of: CVE Received, Initial Analysis, Reanalysis, CVE Modified, Modified Analysis, CVE Translated, Vendor Comment, CVE Source Update, CPE Deprecation Remap, CWE Remap, and 6 more.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 5,000. Defaults to 50.From 1 to 5000. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

changeslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "changes": [
    {
      "change_id": "BBAEE5EE-DF18-4452-90D7-BCAA175D51B0",
      "created": "2021-12-14T18:49:04Z",
      "cve_id": "CVE-2021-44228",
      "detail_count": 1,
      "details": [
        {
          "action": "Added",
          "new_value": "NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)",
          "old_value": null,
          "type": "CVSS V3.1"
        }
      ],
      "event_name": "Initial Analysis",
      "source_identifier": "nvd@nist.gov"
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 27
}

Get a data source

Look up one data-supplying organization and get its contact address, every identifier it publishes under, and its CVSS and CWE acceptance levels.

Inputs

Data sourcesource_identifiertextRequired
The organization to look up, picked from the sources the NVD publishes.

Outputs

sourceobject
Example output
{
  "source": {
    "contact_email": "cve@mitre.org",
    "created": "2019-09-09T16:18:45Z",
    "cwe_acceptance_level": {
      "description": "Provider",
      "last_modified": "2025-07-08T00:00:00Z"
    },
    "last_modified": "2019-09-09T16:18:45Z",
    "name": "MITRE",
    "source_identifiers": [
      "cve@mitre.org",
      "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
    ],
    "v2_acceptance_level": null,
    "v3_acceptance_level": {
      "description": "Contributor",
      "last_modified": "2025-08-18T00:00:26Z"
    }
  }
}

Get a match criterion

Get one match criterion by its ID, with its version bounds and every CPE name it resolves to.

Inputs

Match criteria IDmatch_criteria_idtextRequired
The UUID of the criterion.

Outputs

match_criterionobject
Example output
{
  "match_criterion": {
    "cpe_last_modified": "2019-07-22T16:37:38Z",
    "created": "2019-06-17T09:16:33Z",
    "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
    "last_modified": "2022-08-05T15:15:43Z",
    "match_count": 1,
    "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
    "matches": [
      {
        "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
        "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
      }
    ],
    "status": "Active",
    "version_end_excluding": null,
    "version_end_including": null,
    "version_start_excluding": null,
    "version_start_including": null
  }
}

Get a product

Get one product record from the CPE dictionary by its ID, including its titles, vendor references, and whether it has been deprecated in favour of another CPE.

Inputs

CPE name IDcpe_name_idtextRequired
The UUID of the product record. 'Search products' returns it as cpe_name_id.

Outputs

productobject
Example output
{
  "product": {
    "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
    "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
    "created": "2021-06-24T14:00:00Z",
    "deprecated": false,
    "deprecated_by": [],
    "deprecates": [],
    "last_modified": "2021-12-14T14:35:56Z",
    "references": [
      {
        "type": "Product",
        "url": "https://logging.apache.org/log4j/2.x/"
      }
    ],
    "title": "Apache Log4j 2.14.1",
    "titles": [
      {
        "lang": "en",
        "value": "Apache Log4j 2.14.1"
      }
    ]
  }
}

Get several CVEs

Look up as many as 100 CVEs in a single request, instead of one step each. Any ID the NVD does not know is listed under 'not found' rather than failing the step.

Inputs

CVE IDscve_idslistRequired
The vulnerabilities to look up, up to 100 at a time.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
not_foundlist
requested_countnumber
How many IDs were asked for.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": false,
  "not_found": [],
  "requested_count": 1,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1
}

List a CVE's match criteria

List the product ranges one CVE is tied to, each with the CPE names it covers. This is the full, expanded answer to 'exactly which versions does this vulnerability affect?'.

Inputs

CVE IDcve_idtextRequired
The vulnerability whose product ranges you want.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 500. Defaults to 50.From 1 to 500. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
match_criterialist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 147
}

List actively exploited CVEs (CISA KEV)

List the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, the ones confirmed to be under attack in the wild. Leave the dates blank for the whole catalog, or set them to see only what CISA added in a window of up to 120 days.

Inputs

Added to the catalog afteradded_afterdate and time
Optional. When set, the 'added before' date is required too and must be within 120 days.
Added to the catalog beforeadded_beforedate and time
Optional. Required whenever 'added after' is set.
Search phrasekeyword_searchtext
Optional words the CVE description must contain, to narrow the catalog to one product or technology.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1338
}

List CVE changes in a date range

List changes made across all CVEs inside a window of up to 120 days, optionally only one kind of change. Use it to watch for rescorings or KEV updates as they happen, rather than polling one CVE at a time.

Inputs

Changed afterchanged_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a changed range at that.
Changed beforechanged_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Only this kind of changeevent_nametext
Narrow the window to one kind of event. Leave blank for all of them.One of: CVE Received, Initial Analysis, Reanalysis, CVE Modified, Modified Analysis, CVE Translated, Vendor Comment, CVE Source Update, CPE Deprecation Remap, CWE Remap, and 6 more.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 5,000. Defaults to 50.From 1 to 5000. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

changeslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "changes": [
    {
      "change_id": "BBAEE5EE-DF18-4452-90D7-BCAA175D51B0",
      "created": "2021-12-14T18:49:04Z",
      "cve_id": "CVE-2021-44228",
      "detail_count": 1,
      "details": [
        {
          "action": "Added",
          "new_value": "NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)",
          "old_value": null,
          "type": "CVSS V3.1"
        }
      ],
      "event_name": "Initial Analysis",
      "source_identifier": "nvd@nist.gov"
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 9814
}

List CVEs changed in a date range

List the vulnerabilities whose records changed inside a window of up to 120 days, including ones published long ago that were rescored or reanalyzed. This is what the NVD asks you to poll to keep a local copy in step.

Inputs

Changed aftermodified_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
Changed beforemodified_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Search phrasekeyword_searchtext
Optional words the CVE description must contain, to narrow the window to one product or technology.
Hide rejected CVEsexclude_rejectedtrue/false
Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing.Default: true.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 5127
}

List CVEs published in a date range

List the vulnerabilities first published inside a window of up to 120 days. This is the one to run on a schedule to see what is new.

Inputs

Published afterpublished_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a published range at that.
Published beforepublished_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Search phrasekeyword_searchtext
Optional words the CVE description must contain, to narrow the window to one product or technology.
Hide rejected CVEsexclude_rejectedtrue/false
Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing.Default: true.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 2841
}

List data sources

List the organizations that supply the NVD its data, with the identifiers their CVE records are published under and how far NVD trusts each one's scores. These identifiers are what a CVE's 'source identifier' field holds.

Inputs

Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 1,000. Defaults to 100.From 1 to 1000. Default: 100.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
sourceslist
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "sources": [
    {
      "contact_email": "cve@mitre.org",
      "created": "2019-09-09T16:18:45Z",
      "cwe_acceptance_level": {
        "description": "Provider",
        "last_modified": "2025-07-08T00:00:00Z"
      },
      "last_modified": "2019-09-09T16:18:45Z",
      "name": "MITRE",
      "source_identifiers": [
        "cve@mitre.org",
        "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
      ],
      "v2_acceptance_level": null,
      "v3_acceptance_level": {
        "description": "Contributor",
        "last_modified": "2025-08-18T00:00:26Z"
      }
    }
  ],
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 499
}

List data sources changed in a date range

List the data-supplying organizations whose records changed inside a window of up to 120 days, which is how a new CVE Numbering Authority or a changed acceptance level shows up.

Inputs

Changed aftermodified_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
Changed beforemodified_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 1,000. Defaults to 100.From 1 to 1000. Default: 100.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
sourceslist
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "sources": [
    {
      "contact_email": "cve@mitre.org",
      "created": "2019-09-09T16:18:45Z",
      "cwe_acceptance_level": {
        "description": "Provider",
        "last_modified": "2025-07-08T00:00:00Z"
      },
      "last_modified": "2019-09-09T16:18:45Z",
      "name": "MITRE",
      "source_identifiers": [
        "cve@mitre.org",
        "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
      ],
      "v2_acceptance_level": null,
      "v3_acceptance_level": {
        "description": "Contributor",
        "last_modified": "2025-08-18T00:00:26Z"
      }
    }
  ],
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 12
}

List match criteria changed in a date range

List the match criteria added or changed inside a window of up to 120 days. A criterion changing is how the set of versions a CVE applies to gets corrected.

Inputs

Changed aftermodified_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
Changed beforemodified_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 500. Defaults to 50.From 1 to 500. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
match_criterialist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 863
}

List products changed in a date range

List the CPE product records added or changed inside a window of up to 120 days. Poll it to keep a local copy of the product dictionary in step.

Inputs

Changed aftermodified_afterdate and timeRequired
The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
Changed beforemodified_beforedate and timeRequired
The end of the window to look at. Required, and no more than 120 days after the start.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 10,000. Defaults to 50.From 1 to 10000. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
productslist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1204
}

List the products a match criterion covers

Expand one match criterion into the actual product versions it resolves to. A CVE says 'log4j from 2.0 up to 2.15.0'; this turns that into the list of concrete CPE names.

Inputs

Match criteria IDmatch_criteria_idtextRequired
The UUID of the criterion. A CVE's cpe_matches entries carry it as match_criteria_id.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 10,000. Defaults to 50.From 1 to 10000. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
productslist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": false,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1
}

Search CVEs

Search the NVD by keyword and by the flags on a record: weakness type, assigning source, analysis status, tag, and whether it is in CISA's Known Exploited Vulnerabilities catalog. The keyword is matched against the CVE descriptions, and every word given has to appear.

Inputs

Search phrasekeyword_searchtext
Words to look for in the CVE descriptions. Every word given has to appear, in any order.
Match the phrase exactlykeyword_exact_matchtrue/false
Off (the default) matches records containing every word in the phrase, anywhere. On matches only records containing the phrase itself, word for word.Default: false.
Weakness (CWE) IDcwe_idtext
Return only CVEs of this weakness type, e.g. CWE-79 for cross-site scripting.
Data sourcesource_identifiertext
Return only CVEs assigned by this organization, picked from the sources the NVD publishes.
Analysis statusvuln_statusestext
Return only CVEs in these stages of the NVD's analysis workflow. Choose as many as you like; leaving it empty covers every status.One or more of: Received (Received (not yet analyzed)), AwaitingAnalysis (Awaiting analysis), UndergoingAnalysis (Undergoing analysis), Analyzed, Modified (Modified since analysis), Deferred, Rejected.
Tagcve_tagtext
Return only CVEs carrying this tag.One of: disputed (Disputed by the vendor), unsupported-when-assigned (Product was already unsupported), exclusively-hosted-service (Affects a hosted service only).
In CISA's exploited-vulnerabilities cataloghas_kevtrue/false
Return only vulnerabilities CISA has confirmed are being exploited in the wild.Default: false.
Hide rejected CVEsexclude_rejectedtrue/false
Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing.Default: true.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 2,000. Defaults to 20.From 1 to 2000. Default: 20.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

cveslist
has_moretrue/false
Whether there are further pages to fetch.
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 42
}

Search match criteria

Find the match criteria whose CPE fits a match string, for example every criterion that mentions log4j. Each one names the version range and the products inside it.

Inputs

CPE match stringmatch_stringtextRequired
A CPE, whole or partial, with '*' in the fields you are not pinning down.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 500. Defaults to 50.From 1 to 500. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
match_criterialist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 147
}

Search products

Search the NVD's product dictionary for the CPE name of a piece of software or hardware. Run this first when you know a product by name and need the CPE that 'Find CVEs affecting a product' takes.

Inputs

Search phrasekeyword_searchtext
Words to look for in the product titles and reference links, e.g. 'apache log4j'.
Match the phrase exactlykeyword_exact_matchtrue/false
Off (the default) matches records containing every word in the phrase, anywhere. On matches only records containing the phrase itself, word for word.Default: false.
CPE match stringmatch_stringtext
A partial CPE to list the products under it, with '*' in the fields you are not pinning down. Use this instead of, or alongside, a search phrase.
Number of resultsresults_per_pagenumber
How many records to return in one step, from 1 to 10,000. Defaults to 50.From 1 to 10000. Default: 50.
Start at resultstart_indexnumber
Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result.At least 0. Default: 0.

Outputs

has_moretrue/false
Whether there are further pages to fetch.
productslist
result_countnumber
How many records this step returned.
results_per_pagenumber
The page size the NVD used.
start_indexnumber
The offset this page starts at.
timestamptext
When the NVD generated this response.
total_resultsnumber
How many records match in total.
Example output
{
  "has_more": true,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 78
}

Numverify

Previous Page

Obsidian

Next Page

On this page

ActionsFind CVEs affecting a productFind CVEs by severityGet a CVEGet a CVE's change historyGet a data sourceGet a match criterionGet a productGet several CVEsList a CVE's match criteriaList actively exploited CVEs (CISA KEV)List CVE changes in a date rangeList CVEs changed in a date rangeList CVEs published in a date rangeList data sourcesList data sources changed in a date rangeList match criteria changed in a date rangeList products changed in a date rangeList the products a match criterion coversSearch CVEsSearch match criteriaSearch products