Microsoft Security Response Center (MSRC) vs National Vulnerability Database

MSRC's CVRF API serves Microsoft's own machine-readable security-update bulletins: list every bulletin's ID and dates from `/updates`, then pull one full document by ID (e.g. "2026-Jan") from `/cvrf/{id}` -- as CVRF XML by default, or the same CVRF document serialised to JSON under an `Accept: application/json` header. It's a fully public, unauthenticated REST endpoint with no signup or key required, backing tools like the community MsrcSecurityUpdates PowerShell module. Two traps confirmed live: the OData-shaped response envelope is misleading (most `$filter`/`$top` syntax 500s, and there's no CVE-to-bulletin lookup at all), and the separately documented `/csaf/{id}` route rejected all 17 id formats probed with "Invalid ID format" -- so despite the CSAF branding, the JSON this API actually returns is CVRF, not CSAF. The old stored URL pointed at the unrelated Report Abuse API's developer page; the live developer portal for this security-updates API now redirects straight to its published OpenAPI/Swagger definition.

NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.