National Vulnerability Database (NVD)

NIST's database of published CVEs with CVSS scores, CWE classifications, affected-product (CPE) configurations and references.

National Institute of Standards and Technology (NIST).

• nvd.nist.gov
• CVE API 2.0

US government work, public domain.

The NVD API terms ask services that use the API to display a notice saying they are not endorsed or certified by the NVD. The NVD name may identify the source but must not imply endorsement, and modified content may not be attributed to the NVD.

NVD API terms of use

The NVD changes continuously. Each night we pull every record changed since the last run, using the lastModified date range. Rate limits apply per API key.

CVE ID, published and last-modified dates, English description, CVSS base score, version, vector and severity, CWE IDs, reference URLs, analysis status.

• Analysis backlogs mean recent CVEs can lack CVSS data for weeks. We return those fields as null rather than guess.
• Our copy began with the records the NVD changed in the 120 days before our first import, and adds every change since. It is not a full mirror: an older CVE whose record has not changed since then can come back with its NVD fields as null.
• The NVD does not test software.

The base record for CVE Triage: description, CVSS score and severity, CWE and references, under vulnerability.* and stackbyte.nvd.*.

Field by field details are in the CVE Triage docs.