cve.bz API
The public records as JSON. No key and no sign-up; answers may be cached for 5 minutes.
Every answer carries its sources' notices in attribution: keep them with what you republish (Credits has each source's terms). Check your stack is limited per address and answers 429 with Retry-After when over. Please cache what you fetch, and page with next.
The same routes as an OpenAPI 3.1 document: https://cve.bz/api/public/openapi.json. Coding agents can use the MCP server over the same data.
On this page
GET /api/public/cves
The newest public records as JSON (same filters), with a next cursor and the sources' notices
| Parameter | Type | Meaning |
|---|---|---|
before | string | The next value of the previous page. |
cwe | string | A CWE (CWE-79, cwe-79 or 79): only CVEs whose record names exactly it. |
epss | number | Least EPSS score, 0 to 1. |
exploit | boolean | Only CVEs with a link to public exploit code (Exploit-DB, Metasploit or a nuclei template). |
kev | boolean | Only CVEs in CISA's KEV catalog. |
limit | integer | Page size, 1 to 100 (default 50). |
match | string | text: on the HTML list, words that name a product are matched as text only. Without it a search that is exactly a product's or vendor's name (nginx) lists the records affecting it, and match=text those that only mention it. The JSON list always matches text. |
owasp | string | An OWASP Top Ten category (A05:2025 or A05-2025): only CVEs whose record names a CWE MITRE's catalog puts in it. |
page | integer | A numbered page, 1 to [MAX_PAGE], for the HTML list's pager; ignored with before. |
product | string | A CPE vendor (apache) or vendor:product (apache:log4j): only CVEs the NVD marks as affecting it. |
q | string | Words that must all appear in the ID, description, CWEs or products. |
severity | string | critical, high, medium or low, by base score. |
Example: /api/public/cves?severity=critical&limit=20
Example answer
{
"entries": [
{
"published": "2099-01-05T10:15:09.143",
"score": 9.8,
"version": "3.1",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwes": [
"CWE-89"
],
"products": [
"example:gateway"
],
"description": "Example Gateway before 2.4.1 builds a query from the session name, so a remote attacker can run SQL.",
"cve": "CVE-2099-0001",
"kev": {
"cve": "CVE-2099-0001",
"date_added": "2099-01-12",
"due_date": "2099-02-02",
"vendor": "Example",
"product": "Gateway",
"known_ransomware": false
},
"epss": {
"cve": "CVE-2099-0001",
"score": 0.4312,
"percentile": 0.9731,
"date": "2099-01-20",
"score_7d": 0.2105,
"score_30d": null
},
"exploit": true
}
],
"next": "2099-01-05T10:15:09.143|CVE-2099-0001",
"importing": [],
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}GET /api/public/cves/{id}
One public record as JSON, with MITRE's names of its CWEs (weaknesses) and the sources' notices; a GHSA, RUSTSEC, PYSEC or GO id answers with the CVE record it names (resolved_from) or the advisory itself
| Parameter | Type | Meaning |
|---|---|---|
id | string, in the path |
Example: /api/public/cves/CVE-2024-3094
Example answer
{
"cve": "CVE-2099-0001",
"nvd": {
"published": "2099-01-05T10:15:09.143",
"modified": "2099-01-14T08:02:11.000",
"status": "Analyzed",
"description": "Example Gateway before 2.4.1 builds a query from the session name, so a remote attacker can run SQL.",
"cvss_v4": {
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"score": 9.3
},
"cvss_v3": {
"version": "3.1",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 9.8
},
"cwes": [
"CWE-89"
],
"references": [
"https://example.test/advisories/2099-01"
],
"reference_tags": [
{
"url": "https://example.test/advisories/2099-01",
"tags": [
"Vendor Advisory",
"Patch"
]
}
],
"products": [
"example:gateway"
],
"affected": [
{
"vendor": "example",
"product": "gateway",
"version_start": "2.0",
"start_inclusive": true,
"version_end": "2.4.1",
"end_inclusive": false,
"exact_version": null,
"source": "nvd"
}
],
"source": "nvd",
"synced_at": "2099-01-20T06:00:00+00:00"
},
"epss": {
"cve": "CVE-2099-0001",
"score": 0.4312,
"percentile": 0.9731,
"date": "2099-01-20",
"score_7d": 0.2105,
"score_30d": null
},
"kev": {
"cve": "CVE-2099-0001",
"date_added": "2099-01-12",
"due_date": "2099-02-02",
"vendor": "Example",
"product": "Gateway",
"known_ransomware": false
},
"exploits": [
{
"source": "exploitdb",
"id": "99001",
"url": "https://www.exploit-db.com/exploits/99001",
"title": "Example Gateway 2.4.0 - SQL Injection",
"published": "2099-01-10"
}
],
"signatures": [
{
"source": "etopen",
"id": "2990001",
"url": null,
"title": "ET WEB_SPECIFIC_APPS Example Gateway SQL Injection Attempt (CVE-2099-0001)",
"published": "2099-01-11"
}
],
"weaknesses": [
{
"name": "Improper Neutralization of Special Elements used in an SQL Command",
"common_name": "SQL Injection",
"deprecated": false,
"replaced_by": [],
"owasp": [
{
"id": "A05:2025",
"name": "Injection",
"category": "CWE-1440",
"url": "https://cwe.mitre.org/data/definitions/1440.html",
"path": "/cve/owasp/A05-2025"
}
],
"id": "CWE-89",
"attack_patterns": [
{
"id": "CAPEC-66",
"name": "SQL Injection",
"likelihood": "High",
"severity": "High",
"url": "https://capec.mitre.org/data/definitions/66.html",
"path": "/cve/capec/66"
}
]
}
],
"cisa_adp": {
"ssvc": {
"exploitation": "active",
"automatable": "yes",
"technical_impact": "total",
"assessed": "2099-01-13T14:25:34Z"
},
"cvss_v4": null,
"cvss_v3": {
"version": "3.1",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 9.8
},
"cwes": []
},
"cna": {
"affected": [
{
"vendor": "Example",
"product": "Gateway",
"version_start": "2.0",
"start_inclusive": true,
"version_end": "2.4.1",
"end_inclusive": false,
"exact_version": null,
"source": "cvelist"
}
],
"fixed": [
{
"vendor": "Example",
"product": "Gateway",
"line": null,
"fixed": "2.4.1"
}
],
"updated": "2099-01-13T09:00:00.000Z",
"assigner": "example",
"title": "Gateway: SQL injection through the session name"
},
"distros": [
{
"distro": "Debian",
"streams": [
"12"
],
"packages": [
"example-gateway"
],
"more_packages": 0,
"fixed": "2.4.1-1",
"advisories": [
{
"id": "DSA-9901-1",
"url": null
}
],
"license": null
}
],
"redhat": {
"severity": "Important",
"public_date": "2099-01-05T00:00:00Z",
"statement": "Red Hat ships Example Gateway only in the products listed.",
"mitigation": null,
"package_state": [
{
"product_name": "Red Hat Enterprise Linux 9",
"package_name": "example-gateway",
"fix_state": "Affected"
}
],
"affected_release": [
{
"product_name": "Red Hat Enterprise Linux 10",
"package": "example-gateway-0:2.4.1-1.el10",
"advisory": "RHSA-2099:0101",
"release_date": "2099-01-15T00:00:00Z"
}
],
"updated": "2099-01-15T12:00:00+00:00",
"url": "https://access.redhat.com/security/cve/CVE-2099-0001",
"license": "CC-BY-4.0"
},
"ics": [
{
"id": "ICSA-99-012-01",
"title": "Example Gateway",
"published": "2099-01-12T00:00:00.000000Z",
"updated": "2099-01-12T00:00:00.000000Z",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-99-012-01",
"sectors": "Critical Manufacturing",
"vendor": "Example",
"affected": [
"Gateway: Versions 2.0 to 2.4.0"
],
"fixed": [
"Gateway: Version 2.4.1"
]
}
],
"history": [
{
"id": 4102,
"cve": "CVE-2099-0001",
"at": "2099-01-12T06:00:00Z",
"kind": "kev",
"before": null,
"after": "2099-01-12"
}
],
"osv": [
{
"id": "GHSA-xxxx-xxxx-0001",
"url": "https://osv.dev/vulnerability/GHSA-xxxx-xxxx-0001",
"summary": "SQL injection in example-gateway",
"modified": "2099-01-13T10:00:00Z",
"packages": [
{
"ecosystem": "npm",
"name": "example-gateway",
"purl": "pkg:npm/example-gateway",
"ranges": [
">=2.0.0 <2.4.1"
],
"fixed": [
"2.4.1"
]
}
]
}
],
"fixed": [
{
"ecosystem": "npm",
"package": "example-gateway",
"fixed": "2.4.1"
}
],
"fix_available": true,
"exploit_reference": false,
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}GET /api/public/capec/{id}
One CAPEC attack pattern as JSON (92, CAPEC-92): MITRE's entry, its CWEs with MITRE's names, related and more specific patterns, recent CVEs naming its CWEs, and the sources' notices
| Parameter | Type | Meaning |
|---|---|---|
id | string, in the path |
Example: /api/public/capec/92
Example answer
{
"id": "CAPEC-66",
"name": "SQL Injection",
"status": "Draft",
"likelihood": "High",
"severity": "High",
"abstraction": "Standard",
"detail": {
"description": [
{
"k": "p",
"t": "The pattern's description, a paragraph to an entry."
}
],
"extended": [],
"flow": [
{
"step": "1",
"phase": "Explore",
"description": [
{
"k": "p",
"t": "What the attacker does in this step."
}
],
"techniques": [
"A technique for the step."
]
}
],
"prerequisites": [
[
{
"k": "p",
"t": "What must hold for the attack to work."
}
]
],
"skills": [
{
"level": "Low",
"text": [
{
"k": "p",
"t": "What the attacker has to know."
}
]
}
],
"resources": [],
"indicators": [],
"consequences": [
{
"scopes": [
"Integrity"
],
"impacts": [
"Modify Data"
],
"likelihood": null,
"note": null
}
],
"mitigations": [
[
{
"k": "p",
"t": "A way to prevent the attack."
}
]
],
"examples": [],
"related": [
{
"nature": "ChildOf",
"id": "CAPEC-248"
}
]
},
"weaknesses": [
{
"name": "Improper Neutralization of Special Elements used in an SQL Command",
"common_name": "SQL Injection",
"deprecated": false,
"replaced_by": [],
"owasp": [],
"id": "CWE-89"
}
],
"related": [
{
"nature": "ChildOf",
"id": "CAPEC-248",
"name": "Command Injection",
"path": "/cve/capec/248"
}
],
"children": [
{
"id": "CAPEC-7",
"name": "Blind SQL Injection",
"path": "/cve/capec/7"
}
],
"recent": [
{
"cve": "CVE-2099-0001",
"published": "2099-01-05T10:15:09.143",
"score": 9.8,
"description": "Example Gateway before 2.4.1 builds a query from the session name, so a remote attacker can run SQL."
}
],
"url": "https://capec.mitre.org/data/definitions/66.html",
"path": "/cve/capec/66",
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}GET /api/public/changes
What changed in the public records, newest first: a score set, changed or removed; NVD analysis done or deferred; rejected or no longer; listed in CISA KEV; EPSS crossing 10%. {entries: [{id, cve, at, kind, before, after, url}], next (pass it as before), kinds, attribution}; since= an ISO date or time, kind=, limit= 1 to 1000
| Parameter | Type | Meaning |
|---|---|---|
before | integer | The next of the page before. |
kind | string | Only this kind: score, status, kev or epss. |
limit | integer | At most this many (1 to 1000; 100 when unset). |
since | string | Only changes at or after this ISO date or time. |
Example: /api/public/changes?kind=kev&limit=20
Example answer
{
"entries": [
{
"id": 4102,
"cve": "CVE-2099-0001",
"at": "2099-01-12T06:00:00Z",
"kind": "kev",
"before": null,
"after": "2099-01-12",
"url": "https://cve.example/cve/CVE-2099-0001"
}
],
"next": 4102,
"kinds": [
"score",
"status",
"kev",
"epss"
],
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}POST /api/public/check-stack
Check your stack: the body is a package-lock.json, poetry.lock, Cargo.lock, go.sum or Gemfile.lock, or a CycloneDX or SPDX JSON SBOM, and ?name= its file name; answers the packages the stored OSV advisories affect, each with the advisory's id, severity, summary, fixed version and page, plus when the answer was made (generated_at), each source's last update (updated) and the sources' notices. At most 2 MiB and 20,000 packages; matched in memory, stored nowhere, never cached. Limited per client address with the MCP check_stack tool (enrichment.public_check_rate a minute, default 30, bursts of 10): over it 429 with Retry-After
| Parameter | Type | Meaning |
|---|---|---|
name | string, required |
curl --data-binary @package-lock.json "https://cve.bz/api/public/check-stack?name=package-lock.json"
Example answer
{
"packages": 1,
"matched": [
{
"purl": "pkg:npm/example-gateway@2.4.0",
"version": "2.4.0",
"advisories": [
{
"id": "GHSA-xxxx-xxxx-0001",
"severity": "critical",
"summary": "SQL injection in example-gateway",
"fixed": "2.4.1",
"cves": [
"CVE-2099-0001"
],
"url": "https://cve.example/cve/CVE-2099-0001"
}
]
}
],
"generated_at": "2099-01-20T06:05:00Z",
"updated": {
"nvd": "2099-01-20T06:00:00+00:00",
"epss": "2099-01-20T05:15:00+00:00",
"kev": "2099-01-20T06:00:00+00:00",
"osv": "2099-01-20T05:50:00+00:00",
"cvelist": "2099-01-20T06:00:00+00:00",
"exploits": "2099-01-20T04:20:00+00:00",
"cwe": "2099-01-19T22:00:00+00:00",
"redhat": "2099-01-20T06:00:00+00:00",
"ics": "2099-01-20T06:00:00+00:00"
},
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}GET /api/public/insights
The Insights page's figures as JSON: published (last_24h, last_7d, last_30d, each a count and the prior period's), critical_high_30d, kev_added_30d, epss_10, daily (90 days by severity), severity_30d, top_vendors_30d, top_products_30d, top_cwes_30d, kev_latest and epss_newest, with as_of and the sources' notices
Example: /api/public/insights
Example answer
{
"generated_at": "2099-01-20T06:05:00Z",
"as_of": "2099-01-20T06:00:00Z",
"published": {
"last_24h": {
"count": 180,
"prior": 164
},
"last_7d": {
"count": 1210,
"prior": 1175
},
"last_30d": {
"count": 5020,
"prior": 4870
}
},
"critical_high_30d": {
"count": 2110,
"of": 5020,
"share": 0.4203
},
"kev_added_30d": {
"count": 14,
"prior": 11
},
"epss_10": 3120,
"daily": [
{
"critical": 12,
"high": 61,
"medium": 80,
"low": 9,
"none": 18,
"date": "2099-01-19",
"total": 180
}
],
"severity_30d": {
"critical": 410,
"high": 1700,
"medium": 2100,
"low": 290,
"none": 520
},
"named_product_30d": 3300,
"top_vendors_30d": [
{
"vendor": "example",
"cves": 85,
"url": "https://cve.example/cve/vendor/example"
}
],
"top_products_30d": [
{
"product": "example:gateway",
"cves": 40,
"url": "https://cve.example/cve/vendor/example/gateway"
}
],
"with_cwe_30d": 4600,
"top_cwes_30d": [
{
"cwe": "CWE-89",
"cves": 310,
"url": "https://cve.example/cve/cwe/89",
"name": "Improper Neutralization of Special Elements used in an SQL Command",
"common_name": "SQL Injection",
"deprecated": false,
"replaced_by": [],
"owasp": [
{
"id": "A05:2025",
"name": "Injection",
"category": "CWE-1440",
"url": "https://cwe.mitre.org/data/definitions/1440.html",
"path": "/cve/owasp/A05-2025"
}
]
}
],
"with_owasp_30d": 3050,
"top_owasp_30d": [
{
"id": "A05:2025",
"name": "Injection",
"category": "CWE-1440",
"url": "https://cwe.mitre.org/data/definitions/1440.html",
"path": "/cve/owasp/A05-2025",
"cves": 900
}
],
"monthly": [
{
"month": "2098-12",
"count": 4870
}
],
"year_to_date": {
"year": 2099,
"count": 3300,
"pace": 60200,
"prior_year": 58400
},
"nvd_analysis_90d": {
"analyzed": 6100,
"waiting": 5200,
"deferred": 3100,
"not_in_nvd": 60,
"of": 14460,
"median_wait_days": 21
},
"cnas_90d": {
"with_cna": 9800,
"top": [
{
"cna": "example",
"cves": 120,
"scored": 118,
"cwe": 110,
"versions": 120,
"fix": 64
}
]
},
"kev_lag_90d": {
"added": 40,
"within_1d": 9,
"within_7d": 8,
"within_30d": 7,
"within_365d": 10,
"older": 6,
"median_days": 11
},
"cvss_v4_30d": {
"count": 1500,
"of": 5020
},
"cvss_v4_monthly": [
{
"month": "2098-12",
"count": 4870,
"v4": 1390
}
],
"kev_latest": [
{
"cve": "CVE-2099-0001",
"date_added": "2099-01-12",
"vendor": "Example",
"product": "Gateway",
"known_ransomware": false,
"score": 9.8,
"url": "https://cve.example/cve/CVE-2099-0001"
}
],
"epss_newest": [
{
"cve": "CVE-2099-0001",
"published": "2099-01-05T10:15:09.143",
"epss": 0.4312,
"percentile": 0.9731,
"score": 9.8,
"url": "https://cve.example/cve/CVE-2099-0001"
}
],
"attribution": [
"This product uses the NVD API but is not endorsed or certified by the NVD."
]
}GET /api/public/openapi.json
The public JSON routes and the feeds as an OpenAPI 3.1 document, the one the API reference at /cve/api is made from
Example: /api/public/openapi.json
GET /api/public/suggest
Suggestions for the search boxes while typing (?q=, 2 to 100 characters): {products: [{label, vendor, product (null for a vendor), count, url}], cwes: [{id, name, common_name, url}], ids: [{id, url}]}, at most 8 in all: the stored CVE or advisory (GHSA, RUSTSEC, PYSEC, GO...) the words are, up to two weaknesses whose id, common name or acronym starts with them, then CPE vendors and products by exactness and record count
| Parameter | Type | Meaning |
|---|---|---|
q | string |
Example: /api/public/suggest?q=log4j
Example answer
{
"products": [
{
"label": "gateway (example)",
"url": "/cve/vendor/example/gateway",
"vendor": "example",
"product": "gateway",
"count": 12
}
],
"cwes": [
{
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command",
"common_name": "SQL Injection",
"url": "/cve/cwe/89"
}
],
"ids": []
}GET /cve/feed.json
JSON Feed 1.1 of the newest public records (same filters)
| Parameter | Type | Meaning |
|---|---|---|
before | string | The next value of the previous page. |
cwe | string | A CWE (CWE-79, cwe-79 or 79): only CVEs whose record names exactly it. |
epss | number | Least EPSS score, 0 to 1. |
exploit | boolean | Only CVEs with a link to public exploit code (Exploit-DB, Metasploit or a nuclei template). |
kev | boolean | Only CVEs in CISA's KEV catalog. |
limit | integer | Page size, 1 to 100 (default 50). |
match | string | text: on the HTML list, words that name a product are matched as text only. Without it a search that is exactly a product's or vendor's name (nginx) lists the records affecting it, and match=text those that only mention it. The JSON list always matches text. |
owasp | string | An OWASP Top Ten category (A05:2025 or A05-2025): only CVEs whose record names a CWE MITRE's catalog puts in it. |
page | integer | A numbered page, 1 to [MAX_PAGE], for the HTML list's pager; ignored with before. |
product | string | A CPE vendor (apache) or vendor:product (apache:log4j): only CVEs the NVD marks as affecting it. |
q | string | Words that must all appear in the ID, description, CWEs or products. |
severity | string | critical, high, medium or low, by base score. |
Example: /cve/feed.json?kev=true&severity=critical
GET /cve/feed.rss
RSS 2.0 of the newest public records (same filters)
| Parameter | Type | Meaning |
|---|---|---|
before | string | The next value of the previous page. |
cwe | string | A CWE (CWE-79, cwe-79 or 79): only CVEs whose record names exactly it. |
epss | number | Least EPSS score, 0 to 1. |
exploit | boolean | Only CVEs with a link to public exploit code (Exploit-DB, Metasploit or a nuclei template). |
kev | boolean | Only CVEs in CISA's KEV catalog. |
limit | integer | Page size, 1 to 100 (default 50). |
match | string | text: on the HTML list, words that name a product are matched as text only. Without it a search that is exactly a product's or vendor's name (nginx) lists the records affecting it, and match=text those that only mention it. The JSON list always matches text. |
owasp | string | An OWASP Top Ten category (A05:2025 or A05-2025): only CVEs whose record names a CWE MITRE's catalog puts in it. |
page | integer | A numbered page, 1 to [MAX_PAGE], for the HTML list's pager; ignored with before. |
product | string | A CPE vendor (apache) or vendor:product (apache:log4j): only CVEs the NVD marks as affecting it. |
q | string | Words that must all appear in the ID, description, CWEs or products. |
severity | string | critical, high, medium or low, by base score. |