# NVD

> Search the US government's National Vulnerability Database, run by NIST. Look up a CVE and get its description, CVSS scores, CWE weakness types, affected product versions and references; find every vulnerability in a product by its CPE; filter by severity, weakness or CVSS vector; list what was published or rescored in a date range; and pull the CVEs CISA confirms are being exploited right now. Also covers the CPE product dictionary, the match criteria behind a CVE's affected-version ranges, every recorded change to a CVE record, and the organizations that supply the data. No account is needed; a free NIST API key raises the rate limit.

App · Compliance & Security · 21 actions. Web page: https://docs.lodol.com/docs/integrations/nvd

## Actions

### Find CVEs affecting a product

Find every vulnerability that affects a piece of software or hardware, named by its CPE. Give an exact CPE name to ask about one version, or a match string with '*' in the version field to ask about the product as a whole, optionally narrowed to a version range. Use 'Search products' first if you do not know the CPE.

**Inputs**

- Exact CPE name (`cpe_name`, text): One fully specified product version. Fill in this or the match string, not both.
- CPE match string (`match_string`, text): A partial CPE covering a whole product or vendor, with '*' in the fields you are not pinning down. Fill in this or the exact CPE name, not both.
- Only where this product is the vulnerable one (`vulnerable_only`, true/false): A CVE's configuration also lists products that merely have to be present (an operating system, say). Turn this on to skip those. Needs an exact CPE name. Default: `false`.
- From version (`version_start`, text): The bottom of a version range to narrow the match string to. The match string's own version field must be '*' when you use this.
- From version is (`version_start_type`, text): Whether the 'from' version is itself affected. One of: `including` (Including this version), `excluding` (Excluding this version). Default: `including`.
- To version (`version_end`, text): The top of a version range to narrow the match string to, typically the release that fixed the flaw.
- To version is (`version_end_type`, text): Whether the 'to' version is itself affected. Choose 'excluding' when it is the fixed release. One of: `including` (Including this version), `excluding` (Excluding this version). Default: `excluding`.
- Hide rejected CVEs (`exclude_rejected`, true/false): Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing. Default: `true`.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 15
}
```

### Find CVEs by severity

Find vulnerabilities by how bad they are: a CVSS severity band, a CVSS vector (whole or partial, e.g. AV:N for network reachable), or both. Pick which CVSS generation to filter on; the NVD scores most modern CVEs with v3.x.

**Inputs**

- Severity (`severity`, text): The severity band to return. Critical exists only in CVSS v3.x and v4.0; v2.0 stops at High. One of: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`.
- CVSS version (`cvss_version`, text): Which generation of CVSS score the severity and vector apply to. v3.x covers both v3.0 and v3.1. Defaults to v3.x, which is what most current CVEs are scored with. One of: `4.0` (CVSS v4.0), `3.x` (CVSS v3.x), `2.0` (CVSS v2.0). Default: `3.x`.
- CVSS vector (`cvss_vector`, text): A full or partial CVSS vector to match. A partial one filters on just those dimensions, so AV:N/PR:N finds anything reachable over the network with no privileges needed.
- Search phrase (`keyword_search`, text): Optional words the CVE description must also contain, to narrow the band to one product or technology.
- Hide rejected CVEs (`exclude_rejected`, true/false): Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing. Default: `true`.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 30573
}
```

### Get a CVE

Look up one vulnerability by its CVE ID and get everything the NVD holds on it: the description, CVSS scores and severity, CWE weakness types, affected products, references, and whether CISA lists it as actively exploited.

**Inputs**

- CVE ID (`cve_id`, text, required): The vulnerability to look up. A pasted nvd.nist.gov link works too.

**Outputs**

- `cve` (object)

**Example output**

```json
{
  "cve": {
    "base_score": 10.0,
    "base_severity": "CRITICAL",
    "configurations": [
      {
        "nodes": [
          {
            "cpe_match": [
              {
                "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                "version_end_excluding": "2.15.0",
                "version_end_including": null,
                "version_start_excluding": null,
                "version_start_including": "2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": null
      }
    ],
    "cpe_matches": [
      {
        "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
        "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
        "version_end_excluding": "2.15.0",
        "version_end_including": null,
        "version_start_excluding": null,
        "version_start_including": "2.0",
        "vulnerable": true
      }
    ],
    "cvss": {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "exploitability_score": 3.9,
      "impact_score": 6.0,
      "source": "nvd@nist.gov",
      "type": "Primary",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "version": "3.1"
    },
    "cwe_ids": [
      "CWE-917",
      "CWE-20"
    ],
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "descriptions": [
      {
        "lang": "en",
        "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
      }
    ],
    "evaluator_comment": null,
    "evaluator_impact": null,
    "evaluator_solution": null,
    "id": "CVE-2021-44228",
    "in_kev": true,
    "kev": {
      "action_due": "2021-12-24",
      "date_added": "2021-12-10",
      "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
    },
    "last_modified": "2025-04-03T01:03:51Z",
    "metrics": [
      {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      }
    ],
    "published": "2021-12-10T10:15:09Z",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://logging.apache.org/log4j/2.x/security.html"
      }
    ],
    "source_identifier": "security@apache.org",
    "ssvc": [
      {
        "options": {
          "automatable": "yes",
          "exploitation": "active",
          "technicalImpact": "total"
        },
        "role": "CISA Coordinator",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "timestamp": "2025-02-04T14:25:34Z",
        "version": "2.0.3"
      }
    ],
    "tags": [],
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
    "vendor_comments": [],
    "vuln_status": "Analyzed",
    "weaknesses": [
      {
        "cwe_ids": [
          "CWE-917"
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}
```

### Get a CVE's change history

List every change ever made to one CVE record, oldest first: when it was received, analyzed, rescored, retagged or rejected, who made each change and exactly which values moved.

**Inputs**

- CVE ID (`cve_id`, text, required): The vulnerability whose history you want.
- Only this kind of change (`event_name`, text): Narrow the history to one kind of event. Leave blank for all of them. One of: `CVE Received`, `Initial Analysis`, `Reanalysis`, `CVE Modified`, `Modified Analysis`, `CVE Translated`, `Vendor Comment`, `CVE Source Update`, `CPE Deprecation Remap`, `CWE Remap`, and 6 more.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 5,000. Defaults to 50. From 1 to 5000. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `changes` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "changes": [
    {
      "change_id": "BBAEE5EE-DF18-4452-90D7-BCAA175D51B0",
      "created": "2021-12-14T18:49:04Z",
      "cve_id": "CVE-2021-44228",
      "detail_count": 1,
      "details": [
        {
          "action": "Added",
          "new_value": "NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)",
          "old_value": null,
          "type": "CVSS V3.1"
        }
      ],
      "event_name": "Initial Analysis",
      "source_identifier": "nvd@nist.gov"
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 27
}
```

### Get a data source

Look up one data-supplying organization and get its contact address, every identifier it publishes under, and its CVSS and CWE acceptance levels.

**Inputs**

- Data source (`source_identifier`, text, required): The organization to look up, picked from the sources the NVD publishes.

**Outputs**

- `source` (object)

**Example output**

```json
{
  "source": {
    "contact_email": "cve@mitre.org",
    "created": "2019-09-09T16:18:45Z",
    "cwe_acceptance_level": {
      "description": "Provider",
      "last_modified": "2025-07-08T00:00:00Z"
    },
    "last_modified": "2019-09-09T16:18:45Z",
    "name": "MITRE",
    "source_identifiers": [
      "cve@mitre.org",
      "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
    ],
    "v2_acceptance_level": null,
    "v3_acceptance_level": {
      "description": "Contributor",
      "last_modified": "2025-08-18T00:00:26Z"
    }
  }
}
```

### Get a match criterion

Get one match criterion by its ID, with its version bounds and every CPE name it resolves to.

**Inputs**

- Match criteria ID (`match_criteria_id`, text, required): The UUID of the criterion.

**Outputs**

- `match_criterion` (object)

**Example output**

```json
{
  "match_criterion": {
    "cpe_last_modified": "2019-07-22T16:37:38Z",
    "created": "2019-06-17T09:16:33Z",
    "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
    "last_modified": "2022-08-05T15:15:43Z",
    "match_count": 1,
    "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
    "matches": [
      {
        "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
        "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
      }
    ],
    "status": "Active",
    "version_end_excluding": null,
    "version_end_including": null,
    "version_start_excluding": null,
    "version_start_including": null
  }
}
```

### Get a product

Get one product record from the CPE dictionary by its ID, including its titles, vendor references, and whether it has been deprecated in favour of another CPE.

**Inputs**

- CPE name ID (`cpe_name_id`, text, required): The UUID of the product record. 'Search products' returns it as cpe_name_id.

**Outputs**

- `product` (object)

**Example output**

```json
{
  "product": {
    "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
    "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
    "created": "2021-06-24T14:00:00Z",
    "deprecated": false,
    "deprecated_by": [],
    "deprecates": [],
    "last_modified": "2021-12-14T14:35:56Z",
    "references": [
      {
        "type": "Product",
        "url": "https://logging.apache.org/log4j/2.x/"
      }
    ],
    "title": "Apache Log4j 2.14.1",
    "titles": [
      {
        "lang": "en",
        "value": "Apache Log4j 2.14.1"
      }
    ]
  }
}
```

### Get several CVEs

Look up as many as 100 CVEs in a single request, instead of one step each. Any ID the NVD does not know is listed under 'not found' rather than failing the step.

**Inputs**

- CVE IDs (`cve_ids`, list, required): The vulnerabilities to look up, up to 100 at a time.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `not_found` (list)
- `requested_count` (number): How many IDs were asked for.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": false,
  "not_found": [],
  "requested_count": 1,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1
}
```

### List a CVE's match criteria

List the product ranges one CVE is tied to, each with the CPE names it covers. This is the full, expanded answer to 'exactly which versions does this vulnerability affect?'.

**Inputs**

- CVE ID (`cve_id`, text, required): The vulnerability whose product ranges you want.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 500. Defaults to 50. From 1 to 500. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `match_criteria` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 147
}
```

### List actively exploited CVEs (CISA KEV)

List the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, the ones confirmed to be under attack in the wild. Leave the dates blank for the whole catalog, or set them to see only what CISA added in a window of up to 120 days.

**Inputs**

- Added to the catalog after (`added_after`, date and time): Optional. When set, the 'added before' date is required too and must be within 120 days.
- Added to the catalog before (`added_before`, date and time): Optional. Required whenever 'added after' is set.
- Search phrase (`keyword_search`, text): Optional words the CVE description must contain, to narrow the catalog to one product or technology.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1338
}
```

### List CVE changes in a date range

List changes made across all CVEs inside a window of up to 120 days, optionally only one kind of change. Use it to watch for rescorings or KEV updates as they happen, rather than polling one CVE at a time.

**Inputs**

- Changed after (`changed_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a changed range at that.
- Changed before (`changed_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Only this kind of change (`event_name`, text): Narrow the window to one kind of event. Leave blank for all of them. One of: `CVE Received`, `Initial Analysis`, `Reanalysis`, `CVE Modified`, `Modified Analysis`, `CVE Translated`, `Vendor Comment`, `CVE Source Update`, `CPE Deprecation Remap`, `CWE Remap`, and 6 more.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 5,000. Defaults to 50. From 1 to 5000. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `changes` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "changes": [
    {
      "change_id": "BBAEE5EE-DF18-4452-90D7-BCAA175D51B0",
      "created": "2021-12-14T18:49:04Z",
      "cve_id": "CVE-2021-44228",
      "detail_count": 1,
      "details": [
        {
          "action": "Added",
          "new_value": "NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)",
          "old_value": null,
          "type": "CVSS V3.1"
        }
      ],
      "event_name": "Initial Analysis",
      "source_identifier": "nvd@nist.gov"
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 9814
}
```

### List CVEs changed in a date range

List the vulnerabilities whose records changed inside a window of up to 120 days, including ones published long ago that were rescored or reanalyzed. This is what the NVD asks you to poll to keep a local copy in step.

**Inputs**

- Changed after (`modified_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
- Changed before (`modified_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Search phrase (`keyword_search`, text): Optional words the CVE description must contain, to narrow the window to one product or technology.
- Hide rejected CVEs (`exclude_rejected`, true/false): Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing. Default: `true`.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 5127
}
```

### List CVEs published in a date range

List the vulnerabilities first published inside a window of up to 120 days. This is the one to run on a schedule to see what is new.

**Inputs**

- Published after (`published_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a published range at that.
- Published before (`published_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Search phrase (`keyword_search`, text): Optional words the CVE description must contain, to narrow the window to one product or technology.
- Hide rejected CVEs (`exclude_rejected`, true/false): Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing. Default: `true`.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 2841
}
```

### List data sources

List the organizations that supply the NVD its data, with the identifiers their CVE records are published under and how far NVD trusts each one's scores. These identifiers are what a CVE's 'source identifier' field holds.

**Inputs**

- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 1,000. Defaults to 100. From 1 to 1000. Default: `100`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `sources` (list)
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "sources": [
    {
      "contact_email": "cve@mitre.org",
      "created": "2019-09-09T16:18:45Z",
      "cwe_acceptance_level": {
        "description": "Provider",
        "last_modified": "2025-07-08T00:00:00Z"
      },
      "last_modified": "2019-09-09T16:18:45Z",
      "name": "MITRE",
      "source_identifiers": [
        "cve@mitre.org",
        "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
      ],
      "v2_acceptance_level": null,
      "v3_acceptance_level": {
        "description": "Contributor",
        "last_modified": "2025-08-18T00:00:26Z"
      }
    }
  ],
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 499
}
```

### List data sources changed in a date range

List the data-supplying organizations whose records changed inside a window of up to 120 days, which is how a new CVE Numbering Authority or a changed acceptance level shows up.

**Inputs**

- Changed after (`modified_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
- Changed before (`modified_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 1,000. Defaults to 100. From 1 to 1000. Default: `100`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `sources` (list)
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "sources": [
    {
      "contact_email": "cve@mitre.org",
      "created": "2019-09-09T16:18:45Z",
      "cwe_acceptance_level": {
        "description": "Provider",
        "last_modified": "2025-07-08T00:00:00Z"
      },
      "last_modified": "2019-09-09T16:18:45Z",
      "name": "MITRE",
      "source_identifiers": [
        "cve@mitre.org",
        "8254265b-2729-46b6-b9e3-3dfca2d5bfca"
      ],
      "v2_acceptance_level": null,
      "v3_acceptance_level": {
        "description": "Contributor",
        "last_modified": "2025-08-18T00:00:26Z"
      }
    }
  ],
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 12
}
```

### List match criteria changed in a date range

List the match criteria added or changed inside a window of up to 120 days. A criterion changing is how the set of versions a CVE applies to gets corrected.

**Inputs**

- Changed after (`modified_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
- Changed before (`modified_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 500. Defaults to 50. From 1 to 500. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `match_criteria` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 863
}
```

### List products changed in a date range

List the CPE product records added or changed inside a window of up to 120 days. Poll it to keep a local copy of the product dictionary in step.

**Inputs**

- Changed after (`modified_after`, date and time, required): The start of the window to look at. Required, and no more than 120 days before the end: the NVD caps a modified range at that.
- Changed before (`modified_before`, date and time, required): The end of the window to look at. Required, and no more than 120 days after the start.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 10,000. Defaults to 50. From 1 to 10000. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `products` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1204
}
```

### List the products a match criterion covers

Expand one match criterion into the actual product versions it resolves to. A CVE says 'log4j from 2.0 up to 2.15.0'; this turns that into the list of concrete CPE names.

**Inputs**

- Match criteria ID (`match_criteria_id`, text, required): The UUID of the criterion. A CVE's cpe_matches entries carry it as match_criteria_id.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 10,000. Defaults to 50. From 1 to 10000. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `products` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": false,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 1
}
```

### Search CVEs

Search the NVD by keyword and by the flags on a record: weakness type, assigning source, analysis status, tag, and whether it is in CISA's Known Exploited Vulnerabilities catalog. The keyword is matched against the CVE descriptions, and every word given has to appear.

**Inputs**

- Search phrase (`keyword_search`, text): Words to look for in the CVE descriptions. Every word given has to appear, in any order.
- Match the phrase exactly (`keyword_exact_match`, true/false): Off (the default) matches records containing every word in the phrase, anywhere. On matches only records containing the phrase itself, word for word. Default: `false`.
- Weakness (CWE) ID (`cwe_id`, text): Return only CVEs of this weakness type, e.g. CWE-79 for cross-site scripting.
- Data source (`source_identifier`, text): Return only CVEs assigned by this organization, picked from the sources the NVD publishes.
- Analysis status (`vuln_statuses`, text): Return only CVEs in these stages of the NVD's analysis workflow. Choose as many as you like; leaving it empty covers every status. One or more of: `Received` (Received (not yet analyzed)), `AwaitingAnalysis` (Awaiting analysis), `UndergoingAnalysis` (Undergoing analysis), `Analyzed`, `Modified` (Modified since analysis), `Deferred`, `Rejected`.
- Tag (`cve_tag`, text): Return only CVEs carrying this tag. One of: `disputed` (Disputed by the vendor), `unsupported-when-assigned` (Product was already unsupported), `exclusively-hosted-service` (Affects a hosted service only).
- In CISA's exploited-vulnerabilities catalog (`has_kev`, true/false): Return only vulnerabilities CISA has confirmed are being exploited in the wild. Default: `false`.
- Hide rejected CVEs (`exclude_rejected`, true/false): Leave out CVE IDs that were withdrawn after being assigned. On is usually what you want: a rejected record describes nothing. Default: `true`.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 2,000. Defaults to 20. From 1 to 2000. Default: `20`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `cves` (list)
- `has_more` (true/false): Whether there are further pages to fetch.
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "cves": [
    {
      "base_score": 10.0,
      "base_severity": "CRITICAL",
      "configurations": [
        {
          "nodes": [
            {
              "cpe_match": [
                {
                  "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
                  "version_end_excluding": "2.15.0",
                  "version_end_including": null,
                  "version_start_excluding": null,
                  "version_start_including": "2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": null
        }
      ],
      "cpe_matches": [
        {
          "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
          "match_criteria_id": "1AB5AC5B-2C34-4A03-9E4D-6B5E9C4F0D8A",
          "version_end_excluding": "2.15.0",
          "version_end_including": null,
          "version_start_excluding": null,
          "version_start_including": "2.0",
          "vulnerable": true
        }
      ],
      "cvss": {
        "base_score": 10.0,
        "base_severity": "CRITICAL",
        "exploitability_score": 3.9,
        "impact_score": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      },
      "cwe_ids": [
        "CWE-917",
        "CWE-20"
      ],
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
        }
      ],
      "evaluator_comment": null,
      "evaluator_impact": null,
      "evaluator_solution": null,
      "id": "CVE-2021-44228",
      "in_kev": true,
      "kev": {
        "action_due": "2021-12-24",
        "date_added": "2021-12-10",
        "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks.",
        "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability"
      },
      "last_modified": "2025-04-03T01:03:51Z",
      "metrics": [
        {
          "base_score": 10.0,
          "base_severity": "CRITICAL",
          "exploitability_score": 3.9,
          "impact_score": 6.0,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      ],
      "published": "2021-12-10T10:15:09Z",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        }
      ],
      "source_identifier": "security@apache.org",
      "ssvc": [
        {
          "options": {
            "automatable": "yes",
            "exploitation": "active",
            "technicalImpact": "total"
          },
          "role": "CISA Coordinator",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "timestamp": "2025-02-04T14:25:34Z",
          "version": "2.0.3"
        }
      ],
      "tags": [],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "vendor_comments": [],
      "vuln_status": "Analyzed",
      "weaknesses": [
        {
          "cwe_ids": [
            "CWE-917"
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    }
  ],
  "has_more": true,
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 42
}
```

### Search match criteria

Find the match criteria whose CPE fits a match string, for example every criterion that mentions log4j. Each one names the version range and the products inside it.

**Inputs**

- CPE match string (`match_string`, text, required): A CPE, whole or partial, with '*' in the fields you are not pinning down.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 500. Defaults to 50. From 1 to 500. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `match_criteria` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "match_criteria": [
    {
      "cpe_last_modified": "2019-07-22T16:37:38Z",
      "created": "2019-06-17T09:16:33Z",
      "criteria": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
      "last_modified": "2022-08-05T15:15:43Z",
      "match_count": 1,
      "match_criteria_id": "B773ED91-1D39-42E6-9C52-D02210DE1A94",
      "matches": [
        {
          "cpe_name": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
          "cpe_name_id": "02E4C368-978E-4818-9ED1-A7C665A25351"
        }
      ],
      "status": "Active",
      "version_end_excluding": null,
      "version_end_including": null,
      "version_start_excluding": null,
      "version_start_including": null
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 147
}
```

### Search products

Search the NVD's product dictionary for the CPE name of a piece of software or hardware. Run this first when you know a product by name and need the CPE that 'Find CVEs affecting a product' takes.

**Inputs**

- Search phrase (`keyword_search`, text): Words to look for in the product titles and reference links, e.g. 'apache log4j'.
- Match the phrase exactly (`keyword_exact_match`, true/false): Off (the default) matches records containing every word in the phrase, anywhere. On matches only records containing the phrase itself, word for word. Default: `false`.
- CPE match string (`match_string`, text): A partial CPE to list the products under it, with '*' in the fields you are not pinning down. Use this instead of, or alongside, a search phrase.
- Number of results (`results_per_page`, number): How many records to return in one step, from 1 to 10,000. Defaults to 50. From 1 to 10000. Default: `50`.
- Start at result (`start_index`, number): Zero-based offset into the full result set, for paging. Leave blank for the first page; to get the next one, add the previous step's Number of results to its Start at result. At least 0. Default: `0`.

**Outputs**

- `has_more` (true/false): Whether there are further pages to fetch.
- `products` (list)
- `result_count` (number): How many records this step returned.
- `results_per_page` (number): The page size the NVD used.
- `start_index` (number): The offset this page starts at.
- `timestamp` (text): When the NVD generated this response.
- `total_results` (number): How many records match in total.

**Example output**

```json
{
  "has_more": true,
  "products": [
    {
      "cpe_name": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
      "cpe_name_id": "9CF4F1C0-3E4D-4A2A-8CFF-8C1B0F1C1C77",
      "created": "2021-06-24T14:00:00Z",
      "deprecated": false,
      "deprecated_by": [],
      "deprecates": [],
      "last_modified": "2021-12-14T14:35:56Z",
      "references": [
        {
          "type": "Product",
          "url": "https://logging.apache.org/log4j/2.x/"
        }
      ],
      "title": "Apache Log4j 2.14.1",
      "titles": [
        {
          "lang": "en",
          "value": "Apache Log4j 2.14.1"
        }
      ]
    }
  ],
  "result_count": 1,
  "results_per_page": 1,
  "start_index": 0,
  "timestamp": "2026-08-23T18:50:34Z",
  "total_results": 78
}
```