Security · head-to-head
National Vulnerability Database vs PhishStats
NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.
PhishStats crowdsources and republishes a running feed of phishing URLs, screenshots, and detection metadata, giving anyone a free real-time phishing blocklist to query or download. The REST API — now served from api.phishstats.info after moving off its old port-based endpoint — supports complex filter queries against the phishing database and returns JSON records ready to stream into an existing security stack. Anonymous lookups are capped at 50 requests/day per IP; a free registered key raises that to 150/day, with paid tiers for higher volume.
| National Vulnerability Database | PhishStats | |
|---|---|---|
| Authentication | None | None |
| Pricing | free | freemium |
| Formats | JSON | JSON |
| CORS | yes | no |
| HTTPS | Yes | Yes |
National Vulnerability Database supports CORS, while PhishStats doesn't — pick National Vulnerability Database for direct browser calls.