CVE API

The CVE API here searches the NIST National Vulnerability Database and flattens each vulnerability into one typed row — the CVE id, the English description, the best available CVSS base score and severity, the CVSS vector, CWE weakness ids, the published and last-modified dates, the status and the reference links, plus the NVD detail URL.

The NVD feed is public but rate-limits hard for anyone without an API key, and even with a key a large keyword sweep is slow going from a single address. This collector reads the same feed over rotating residential exits and hands you clean rows, so you can filter by keyword and severity without babysitting the NVD's request budget. You authenticate with your QuantumProxies key; there is no NVD key to request or rotate.

$0.0004 per delivered CVE, up to 200 CVEs per run. Nothing delivered means nothing charged.

How the CVE API works

You pass a keyword (a product, a vendor or free text from the CVE record), an optional severity filter, or both. Each matching CVE becomes one flat row.

Inputs

Provide a keyword, a severity, or both — a keyword alone searches the CVE text, and a severity alone narrows to that CVSS v3 band. max_results caps delivery at 200 CVEs; you pay only for the CVEs returned.

What one CVE looks like

One row per CVE. cvss_score is numeric and severity is the band (LOW…CRITICAL); cvss_vector is the full vector string for anyone recomputing sub-scores. cwe and references are arrays; published and last_modified are dates; url links the NVD detail page for the human-readable record.

What the CVE API costs

$0.0004 per delivered CVE ($0.40 per 1,000). Nothing delivered means nothing charged, and the $2 monthly free credit covers roughly 5,000 CVEs here. Volume tiers take up to 30% off.

$0.0004 per delivered CVE — $0.40 per 1,000 — no subscription. The $2/month free allowance is about 5,000 CVEs with no card on file.

Billing is per delivered row, so a narrow severity filter that returns a short list costs the length of that list, not your max_results cap. Pair it with the Certificate Transparency API to line up disclosed vulnerabilities against an org's issued certificates.

CVE API vs the NVD API directly

The NVD's own API is the source of truth and it is free — but it gates throughput behind an API key you have to request, and it rate-limits so tightly that unauthenticated bulk pulls are impractical and even authenticated ones need careful pacing. Its response shape is also deeply nested across CVSS versions.

This collector removes both frictions: no NVD key to manage, rotation instead of pacing, and one flat row with the CVSS fallback already resolved. For a single CVE lookup the NVD site is fine; for a monitored keyword set refreshed daily, the infrastructure is the point.

Versus polling the NVD yourself

Rolling your own means requesting an NVD key, building a rate-limiter that respects their rolling window, and writing the CVSS-version fallback and CWE extraction by hand — then keeping it working as the schema shifts. That is real, ongoing work for what looks like a simple feed.

If you would rather own the poller and just need exits that are not already on a NIST rate-limit list, run it over our residential proxies.

What people build with it

Vendor and product monitoring

Track a keyword for the software you run and alert on new rows by published date, so a fresh CVE for your stack reaches you the day it lands.

Severity-triaged backlogs

Filter to severity CRITICAL and sort your own queue by cvss_score to work the vulnerabilities that matter first.

Weakness-class research

Group a keyword's results by cwe to see which weakness types dominate a product's history — useful for hardening and for security write-ups.

Limits, coverage and the legal bit

One run delivers up to 200 CVEs from the NVD search. Records reflect the NVD's own analysis state, so a very new CVE may arrive with a null score until NIST finishes enrichment — that is upstream, not dropped data. Runs parallelise up to your plan's rate limit (60–1,200 requests/minute by tier).

NVD data is US-government public data and free to use; you are responsible for how you act on it. This is not legal advice.

FAQ

Is the CVE API free?

NVD data is free at the source, but its API rate-limits hard and gates throughput behind a requested key. This collector fronts it with rotating exits and a flat schema, and carries a $2/month free allowance — about 5,000 CVEs — with no card.

Do I need an NVD API key?

No. You authenticate with your QuantumProxies key. There is no NVD key to request, and no rolling-window rate budget for you to manage — the rotation handles the NVD's throttle.

Which CVSS version do I get?

The best available for each CVE. The row takes CVSS v3.1, falling back to v3.0 and then v2, so cvss_score and severity are populated even for pre-v3 records; cvss_vector carries the full vector.

Can I filter by severity?

Yes. The severity input narrows results to a CVSS v3 band (for example CRITICAL), and you can combine it with a keyword to scope to one product's high-severity issues.

Related scrapers