CVE API

A CVE API turns the NIST National Vulnerability Database into rows instead of a nested JSON tree you have to walk. Send a keyword — a product, a vendor, a library — and optionally a severity, and each matching vulnerability comes back as one flat record: the CVE id, its description, the best available CVSS base score and severity, the CWE weakness ids, the published and modified dates and the reference links.

Get my free API key See the request

$0.0004 per delivered CVE · $2 free every month · Failed runs never billed

POST /v1/scraper/collectors/nvd_cve/run

$ curl $QD/nvd_cve/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"keyword": "log4j", "max_results": 20}'
{ "status": "done", "count": 20,
  "results": [
    {
      "cve_id": "…",
      "description": "…",
      "cvss_score": …,
      "severity": "…" } ],
  "cost": 0.008 }
# 20 CVEs × $0.0004 · nothing delivered, nothing charged

$0.0004 / CVE5,000 CVEs on the free $2 every month

Semantic inputkeyword, severity, max_results — no URL lists

Up to 200CVEs per run, pagination handled for you

No browserread over HTTP/TLS — cheaper and faster than rendering

What a CVE API does

The NVD carries CVSS in three flavours — v3.1, v3.0 and v2 — and fills them in unevenly across records, so the score you actually want is wherever it happens to exist. This resolves the best available metric and hands you a single base score, severity label and vector string per CVE, which is the difference between a populated column and three partly-empty ones.

The public NVD 2.0 API throttles hard without a key and nests its scores several levels deep under version-specific metric arrays. This flattens each record, lifts the CWE weakness ids up as a plain array and returns the references as their own list, so a vulnerability is a row you can store next to a package name rather than a document you re-parse on every call.

What one CVE looks like

Every delivered CVE carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

Field	Type	What it holds
`rank`	integer	1-based position.
`cve_id`	string	CVE identifier.
`description`	string · nullable	English description.
`cvss_score`	number · nullable	CVSS base score.
`severity`	string · nullable	CVSS severity.
`cvss_vector`	string · nullable	CVSS vector string.
`cwe`	string[]	CWE weakness ids.
`published`	string · nullable	Publish date.
`last_modified`	string · nullable	Last modified date.
`status`	string · nullable	Vulnerability status.
`references`	string[]	Reference URLs.
`url`	string	NVD detail page.

Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

Input	Type	Required	What it does
`keyword`	string	no	Search term (product, vendor, CVE text).
`severity`	string	no	Filter to a CVSS v3 severity. One of: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
`max_results`	integer	no	How many CVEs to deliver at most (1–200). You pay only for delivered CVEs.

Pricing

CVE API pricing

$0.0004 per delivered CVE. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 CVEs before you spend anything.

$0.0004per delivered CVE$0.4 per 1,000 delivered CVEs

5,000 CVEson the free allowance$2 every month, no card

Zero rowszero chargeblocks, captchas and retries are on us

−30%on volume tiersthe catalog returns your key's price

Pay as you go

$0/mo

$2 free credit / month
60 requests / min
List unit prices

Starter

$19/mo

$15 free credit / month
300 requests / min
10% off unit prices

Growth

$79/mo

$50 free credit / month
600 requests / min
20% off unit prices

Scale

$299/mo

$250 free credit / month
1,200 requests / min
30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other Data API. Prices are launch pricing read live from the billing config — GET /v1/scraper/collectors returns the price your key actually pays.

Integration

One POST, typed rows

Base URL https://api.quanticdata.io/v1, Bearer auth, the same key as every other Data API. Endpoint: POST /v1/scraper/collectors/nvd_cve/run.

curl -X POST https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"log4j","max_results":20}'

import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "keyword": "log4j",
        "max_results": 20
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)

const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"keyword":"log4j","max_results":20}),
  },
);
const { payload } = await res.json();
console.table(payload.results);

claude mcp add quantumproxies \
  -e QUANTUMPROXIES_API_KEY=qd_live_your_key_here \
  -- npx -y quantumproxies-mcp

# then, in the chat:
> run the nvd_cve collector with keyword="log4j" and max_results=20

What people build with the CVE API

Three shapes of work this endpoint was designed around.

Vulnerability feeds

Query a product or library name on a schedule and each new CVE arrives with its CVSS score and CWE ids already extracted, ready to diff against the last pull.

Severity-gated alerts

Filter to CRITICAL or HIGH and route only the vulnerabilities that clear your threshold into a table, leaving the low-severity noise out of the pipeline.

Weakness datasets

The CWE array on every row groups vulnerabilities by the class of bug, so a corpus of CVEs can be sliced by weakness type rather than by free-text search alone.

CVE API versus rolling your own

The differences that actually cost time when you build this in-house.

	DIY scraper	This collector
CVSS version	Read the v3.1, v3.0 and v2 metric blocks yourself	Best available score, severity and vector, resolved for you
Response shape	Scores buried under versioned metric arrays	One flat row per CVE, CWE ids as a plain array
Without a key	Throttled after a handful of calls	Keyless, with the rate limit handled our side

FAQ

Questions we get about the CVE API.

Something else? Ask us →

Do I need an NVD API key?

No. The public NVD 2.0 endpoint rate-limits sharply for unauthenticated callers; that limit is handled on our side, so you send a keyword and get CVE rows back without registering for or holding a key.

Which CVSS version does cvss_score come from?

The best one present on the record: v3.1 is preferred, then v3.0, then v2. You get one score, severity and vector per CVE instead of three partly-filled metric blocks to reconcile yourself.

Can I return only critical vulnerabilities?

Yes — set severity to LOW, MEDIUM, HIGH or CRITICAL and only CVEs at that CVSS v3 severity come back, so a feed can be gated down to the rows that matter.

Is there a free CVE API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered CVEs on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 200 CVEs — the maximum for this collector — costs $0.08 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and GET /v1/scraper/collectors returns the price your key actually pays.

Run the CVE API now

$2 of free credit every month, no card. Your key returns its own prices from GET /v1/scraper/collectors.

Get my free API key