Security — entry 022 of 30
National Vulnerability Database
NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.
NIST's NVD API 2.0 is a single keyless JSON endpoint over the whole CVE catalog: filter by CVE ID, keyword, CPE, source, severity, or a last-modified date range, and get back full CVE records (descriptions, CVSS scores, CWE weaknesses, CPE match criteria, references) in one consistent shape. Every query hits the same `/rest/json/cves/2.0` path -- there's no separate per-CVE resource.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/national-vulnerability-database/"><img src="https://greatapis.com/badge/national-vulnerability-database.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key is required for keyless access. NIST's own docs (nvd.nist.gov/developers/start-here) state the keyless rate limit is "5 requests in a rolling 30 second window" -- this is docs-sourced only in this run; it was not deliberately tripped against a live government service.
- Requesting a free API key (via the "Request an API Key" link on the same docs page) raises that same-documented cap to 50 requests per rolling 30-second window. Once issued, the key is passed in an `apiKey` request header -- not tested live in this run since no key was requested.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Fetch a single CVE record with a minimal page size
GEThttps://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1
{"resultsPerPage":1,"startIndex":0,"totalResults":370423,"format":"NVD_CVE","version":"2.0","timestamp":"2026-07-26T14:19:02.445","vulnerabilities":[{"cve":{"id":"CVE-1999-0095","sourceIdentifier":"cve@mitre.org","published":"1988-10-01T04:00:00.000","lastModified":"2026-06-16T21:47:34.460","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The debug command in Sendmail is enabled, allowing attackers to execute commands as root."},{"lang":"es","value":"El comando de depuración de Sendmail está activado, permitiendo a atacantes ejecutar comandos como root."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eric_allman:sendmail:5.58:*:*:*:*:*:*:*","matchCriteriaId":"1D07F493-9C8D-44A4-8652-F28B46CBA27C"}]}]}],"references":[{"url":"http://seclists.org/fulldisclosure/2019/Jun/16","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/4","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/06/06/1","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/195","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/1","source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2019/Jun/16","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/4","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/06/06/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/195","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/1","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}resultsPerPage=1 was requested directly in this run's own live probe, not truncated after capture, specifically to keep the example small -- a keyless CVE-ID lookup like CVE-2021-44228 (Log4Shell) was probed too, but the whole record runs 87 KB (87,091 bytes, measured live). With no cveId filter, this returns whichever record NVD's default ordering places first -- CVE-1999-0095 at probe time, an ancient Sendmail bug, not a curated pick.
Developer reference
https://services.nvd.nist.gov/rest/json/cves/2.05 requests per rolling 30-second window without an API key, 50 with a free key -- per nvd.nist.gov/developers/start-here (docs-sourced; not deliberately tripped against the live government service in this run)
Gotchas & limits
- A syntactically valid but nonexistent cveId (confirmed live with `cveId=CVE-9999-99999`) returns 200 with `totalResults:0` and an empty `vulnerabilities` array -- not a 404. A cveId that doesn't even match the CVE-####-##### pattern (confirmed live with `cveId=notacveformat`) instead 404s with an empty body (`content-length: 0`, no content-type -- no JSON at all); the actual error text ("Invalid cveId parameter.") only shows up in a nonstandard `message` response header, not in the body itself -- read the header if you need to show the reason to a user.
- `lastModStartDate`/`lastModEndDate` cap the queryable window at 120 consecutive days per request (per nvd.nist.gov/developers/vulnerabilities, docs-sourced -- not tested live to avoid an unnecessary extra request against a public government service); both parameters are required together if either is used.
- `resultsPerPage`'s default and maximum is 2,000 (per the same docs page, docs-sourced) -- pagination via `startIndex` is required for the full 370k+ catalog rather than one bulk pull.
- CORS is wide open: confirmed live with `access-control-allow-origin: *` on `resultsPerPage=1`, both bare and with an `Origin: https://example.com` header, and even on the 404 error response above.
- The keyless rate limit (5 requests / rolling 30s, 50 with a free key, per nvd.nist.gov/developers/start-here) is disclosed here as docs-sourced only -- this run did not deliberately hammer NIST's production service to confirm the exact threshold, since exceeding it in the wild returns a 429 that a real integration should simply back off from.