The CVE API here searches the NIST National Vulnerability Database and flattens each vulnerability into one typed row — the CVE id, the English description, the best available CVSS base score and severity, the CVSS vector, CWE weakness ids, the published and last-modified dates, the status and the reference links, plus the NVD detail URL.
The NVD feed is public but rate-limits hard for anyone without an API key, and even with a key a large keyword sweep is slow going from a single address. This collector reads the same feed over rotating residential exits and hands you clean rows, so you can filter by keyword and severity without babysitting the NVD's request budget. You authenticate with your QuantumProxies key; there is no NVD key to request or rotate.
$0.0004 per delivered CVE, up to 200 CVEs per run. Nothing delivered means nothing charged.
You pass a keyword (a product, a vendor or free text from the CVE record), an optional severity filter, or both. Each matching CVE becomes one flat row.
cvss_score and severity take the best metric available — CVSS v3.1, then v3.0, then v2 — so a row is populated even for older CVEs that predate v3.cwe is an array of the CWE ids attached to the CVE, which is what you group on for weakness-class analysis.Provide a keyword, a severity, or both — a keyword alone searches the CVE text, and a severity alone narrows to that CVSS v3 band. max_results caps delivery at 200 CVEs; you pay only for the CVEs returned.
One row per CVE. cvss_score is numeric and severity is the band (LOW…CRITICAL); cvss_vector is the full vector string for anyone recomputing sub-scores. cwe and references are arrays; published and last_modified are dates; url links the NVD detail page for the human-readable record.
$0.0004 per delivered CVE ($0.40 per 1,000). Nothing delivered means nothing charged, and the $2 monthly free credit covers roughly 5,000 CVEs here. Volume tiers take up to 30% off.
$0.0004 per delivered CVE — $0.40 per 1,000 — no subscription. The $2/month free allowance is about 5,000 CVEs with no card on file.
Billing is per delivered row, so a narrow severity filter that returns a short list costs the length of that list, not your max_results cap. Pair it with the Certificate Transparency API to line up disclosed vulnerabilities against an org's issued certificates.
The NVD's own API is the source of truth and it is free — but it gates throughput behind an API key you have to request, and it rate-limits so tightly that unauthenticated bulk pulls are impractical and even authenticated ones need careful pacing. Its response shape is also deeply nested across CVSS versions.
This collector removes both frictions: no NVD key to manage, rotation instead of pacing, and one flat row with the CVSS fallback already resolved. For a single CVE lookup the NVD site is fine; for a monitored keyword set refreshed daily, the infrastructure is the point.
Rolling your own means requesting an NVD key, building a rate-limiter that respects their rolling window, and writing the CVSS-version fallback and CWE extraction by hand — then keeping it working as the schema shifts. That is real, ongoing work for what looks like a simple feed.
If you would rather own the poller and just need exits that are not already on a NIST rate-limit list, run it over our residential proxies.
Track a keyword for the software you run and alert on new rows by published date, so a fresh CVE for your stack reaches you the day it lands.
Filter to severity CRITICAL and sort your own queue by cvss_score to work the vulnerabilities that matter first.
Group a keyword's results by cwe to see which weakness types dominate a product's history — useful for hardening and for security write-ups.
One run delivers up to 200 CVEs from the NVD search. Records reflect the NVD's own analysis state, so a very new CVE may arrive with a null score until NIST finishes enrichment — that is upstream, not dropped data. Runs parallelise up to your plan's rate limit (60–1,200 requests/minute by tier).
NVD data is US-government public data and free to use; you are responsible for how you act on it. This is not legal advice.
NVD data is free at the source, but its API rate-limits hard and gates throughput behind a requested key. This collector fronts it with rotating exits and a flat schema, and carries a $2/month free allowance — about 5,000 CVEs — with no card.
No. You authenticate with your QuantumProxies key. There is no NVD key to request, and no rolling-window rate budget for you to manage — the rotation handles the NVD's throttle.
The best available for each CVE. The row takes CVSS v3.1, falling back to v3.0 and then v2, so cvss_score and severity are populated even for pre-v3 records; cvss_vector carries the full vector.
Yes. The severity input narrows results to a CVSS v3 band (for example CRITICAL), and you can combine it with a keyword to scope to one product's high-severity issues.