Censys vs National Vulnerability Database

Censys grew out of the University of Michigan's ZMap internet-scanning research and now re-scans the full public IPv4 space multiple times a day, fingerprinting open ports, services, and TLS certificates. Its Search API exposes that host and certificate-transparency dataset for asset discovery, exposure monitoring, and threat hunting, and underpins Censys's own attack-surface-management product. Access is account-scoped through an API key, with a limited free community tier and metered paid plans for higher query volume.

NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.