National Vulnerability Database — Free NIST CVE Security API (No Key)

TL;DR

The NIST National Vulnerability Database (NVD) provides the definitive API for querying CVE (Common Vulnerabilities and Exposures) data. Search vulnerabilities by CVE ID, keyword, time range, or CVSS score. Each entry includes affected software versions, severity metrics (CVSS v3.1 scores), exploitability data, and remediation references. Used by security tools worldwide. No API key required.

Quick start: https://services.nvd.nist.gov/rest/json/cves/2.0

No API key needed — free US government vulnerability data!

How to Use This API

1. Get Recent CVEs

Returns the most recently published CVEs sorted by modification date:

https://services.nvd.nist.gov/rest/json/cves/2.0

2. Search by CVE ID

https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-3094

3. Filter by CVSS Score

Find critical vulnerabilities with a minimum CVSS v3 score of 9.0:

https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Severity=CRITICAL

4. JavaScript — Check Recent Critical Vulns

fetch('https://services.nvd.nist.gov/rest/json/cves/2.0?cvssV3Severity=CRITICAL&resultsPerPage=5')
  .then(r => r.json())
  .then(data => {
    data.vulnerabilities.forEach(v => {
      const cve = v.cve;
      console.log(cve.id, '-', cve.descriptions[0]?.value.slice(0, 80));
      console.log('  Score:', cve.metrics?.cvssMetricV31?.[0]?.cvssData?.baseScore);
    });
  });

5. Python — Keyword Search

import requests

resp = requests.get(
    'https://services.nvd.nist.gov/rest/json/cves/2.0',
    params={'keywordSearch': 'apache log4j', 'resultsPerPage': 10}
).json()

for v in resp['vulnerabilities']:
    cve = v['cve']
    desc = cve['descriptions'][0]['value'][:100]
    print(f"{cve['id']}: {desc}...")

Recent CVEs: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=5

Try This URL Now

Frequently Asked Questions

What is included in a CVE entry?: Each entry includes CVE ID, description, CVSS v3.1 and v2.0 scores, severity rating, affected software (CPE), references, exploitability metrics, and configuration data.
How often is the database updated?: NVD updates continuously as new CVEs are published. The API reflects changes in near real-time. The lastModStartDate and lastModEndDate parameters filter by modification time.
What search parameters are available?: Keyword search (keywordSearch), CVE ID (cveId), CVSS severity (cvssV3Severity), publication date range, modification date range, and CPE match string.
Is there a rate limit?: Without an API key, the limit is approximately 5 requests per 30 seconds. Registering for a free NVD API key raises this to 50 requests per 30 seconds.
Can I get data in other formats?: The NVD also provides full data feeds in JSON and XML format for bulk download, updated every 2 hours. Available at https://nvd.nist.gov/vuln/data-feeds.
Does it include CWE (Common Weakness Enumeration) data?: Yes — each CVE includes CWE IDs indicating the type of weakness (buffer overflow, XSS, SQL injection, etc.) where applicable.

API Details

API URL: https://services.nvd.nist.gov/rest/json/cves/2.0
Documentation: nvd.nist.gov/vuln/Data-Feeds
Category: Security
Authentication: Not Required (optional API key for higher rate limits)
Rate Limit: 5 requests / 30s (no key), 50 requests / 30s (free key)

What You Can Build

Vulnerability monitoring dashboard alerting on new critical CVEs
Software inventory scanner matching packages against known vulns
Security audit report generator with CVSS scoring and remediation
CI/CD pipeline gate blocking deployments with critical vulnerabilities
Threat intelligence feed combining NVD data with exploit databases