CVE API

OSINT & security · v1.1.0 · nvd_cve

$0.0004 / CVE

$0.40 / 1K · pay per delivered CVE

A CVE API turns the NIST National Vulnerability Database into rows instead of a nested JSON tree you have to walk. Send a keyword — a product, a vendor, a library — and optionally a severity, and each matching vulnerability comes back as one flat record: the CVE id, its description, the best available CVSS base score and severity, the CWE weakness ids, the published and modified dates and the reference links.

By Aldo Morese, founder of QuanticData · Published Aug 21, 2026 · Updated Sep 3, 2026

Run in dashboard See the request

$0.0004 per delivered CVE · $2 free every month · Failed runs never billed

What it does

What a CVE API does

The NVD carries CVSS in three flavours — v3.1, v3.0 and v2 — and fills them in unevenly across records, so the score you actually want is wherever it happens to exist. This resolves the best available metric and hands you a single base score, severity label and vector string per CVE, which is the difference between a populated column and three partly-empty ones.

The public NVD 2.0 API throttles hard without a key and nests its scores several levels deep under version-specific metric arrays. This flattens each record, lifts the CWE weakness ids up as a plain array and returns the references as their own list, so a vulnerability is a row you can store next to a package name rather than a document you re-parse on every call.

Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

Input	Type	Required	What it does
`keyword`	string	no	Search term (product, vendor, CVE text).
`severity`	string	no	Filter to a CVSS v3 severity. One of: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
`cve_id`	string	no	Look up one CVE, e.g. CVE-2021-44228.
`known_exploited`	boolean	no	Only CVEs in the CISA Known Exploited Vulnerabilities catalog.
`max_results`	integer	no	How many CVEs to deliver at most (1–200). You pay only for delivered CVEs.

Outputs — 23 fields, one row per CVE

What one CVE looks like

Every delivered CVE carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

Field	Type	What it holds
`rank`	integer	1-based position.
`cve_id`	string	CVE identifier.
`description`	string · nullable	English description.
`cvss_score`	number · nullable	CVSS base score.
`severity`	string · nullable	CVSS severity.
`cvss_vector`	string · nullable	CVSS vector string.
`cwe`	string[]	CWE weakness ids.
`published`	string · nullable	Publish date.
`last_modified`	string · nullable	Last modified date.
`status`	string · nullable	Vulnerability status.
`references`	string[]	Reference URLs.
`url`	string	NVD detail page.
`cvss_version`	string · nullable	CVSS version of the score.
`exploitability_score`	number · nullable	CVSS exploitability sub-score.
`impact_score`	number · nullable	CVSS impact sub-score.
`attack_vector`	string · nullable	Attack vector (NETWORK, LOCAL…).
`affected_products`	string[]	Vulnerable vendor:product pairs from the CPE configurations.
`source`	string · nullable	Organisation that assigned the CVE.
`known_exploited`	boolean	In the CISA Known Exploited Vulnerabilities catalog.
`kev_added`	string · nullable	Date added to the CISA KEV catalog.
`kev_due_date`	string · nullable	CISA remediation due date.
`kev_required_action`	string · nullable	CISA required action.
`patch_urls`	string[]	References tagged Patch or Vendor Advisory.

Integration

One POST, typed rows

Base URL https://api.quanticdata.io/v1, Bearer auth, the same key as every other Data API. Endpoint: POST /v1/scraper/collectors/nvd_cve/run.

curl -X POST https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"log4j","max_results":20}'

import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "keyword": "log4j",
        "max_results": 20
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)

const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"keyword":"log4j","max_results":20}),
  },
);
const { payload } = await res.json();
console.table(payload.results);

claude mcp add quanticdata \
  -e QUANTICDATA_API_KEY=qd_live_your_key_here \
  -- npx -y quanticdata-mcp

# then, in the chat:
> run the nvd_cve collector with keyword="log4j" and max_results=20

Example response

POST /v1/scraper/collectors/nvd_cve/run

$ curl $QD/nvd_cve/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"keyword": "log4j", "max_results": 20}'
{ "status": "done", "count": 20,
  "results": [
    {
      "cve_id": "…",
      "description": "…",
      "cvss_score": …,
      "severity": "…" } ],
  "cost": 0.008 }
# 20 CVEs × $0.0004 · nothing delivered, nothing charged

Try it

CVE vulnerabilities (NVD), running now

Change the input and run it against the live collector — nothing to install, no sign-up.

Run it from your own code, on your own inputs

Same collector, same rows — $2 of free API credit every month, no card.

Get my free API key

CVE API: from keyword, QuanticData reads the vulnerability record and returns one row per CVE with description, cvss_score and severity, at $0.0004 per delivered CVE. — You send keyword and severity; the run reads the source and comes back as CVEs with rank, cve_id and description — 23 fields on every row — and you are billed $0.0004 for each CVE actually delivered, nothing for a run that delivers none.

$0.0004 / CVE5,000 CVEs on the free $2 every month

Semantic inputkeyword, severity, max_results — no URL lists

Up to 200CVEs per run, pagination handled for you

No browserread over HTTP/TLS — cheaper and faster than rendering

Pricing

CVE API pricing

$0.0004 per delivered CVE. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 CVEs before you spend anything.

$0.0004per delivered CVE$0.4 per 1,000 delivered CVEs

5,000 CVEson the free allowance$2 every month, no card

Zero rowszero chargeblocks, captchas and retries are on us

−30%on volume tiersthe catalog returns your key's price

Pay as you go

$0/mo

$2 free credit / month
60 requests / min
List unit prices

Starter

$19/mo

$15 free credit / month
300 requests / min
10% off unit prices

Growth

$79/mo

$50 free credit / month
600 requests / min
20% off unit prices

Scale

$299/mo

$250 free credit / month
1,200 requests / min
30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other Data API. Prices are launch pricing read live from the billing config — GET /v1/scraper/collectors returns the price your key actually pays.

What people build with the CVE API

Three shapes of work this endpoint was designed around.

Vulnerability feeds

Query a product or library name on a schedule and each new CVE arrives with its CVSS score and CWE ids already extracted, ready to diff against the last pull.

Severity-gated alerts

Filter to CRITICAL or HIGH and route only the vulnerabilities that clear your threshold into a table, leaving the low-severity noise out of the pipeline.

Weakness datasets

The CWE array on every row groups vulnerabilities by the class of bug, so a corpus of CVEs can be sliced by weakness type rather than by free-text search alone.

CVE API versus rolling your own

The differences that actually cost time when you build this in-house.

	DIY scraper	This collector
CVSS version	Read the v3.1, v3.0 and v2 metric blocks yourself	Best available score, severity and vector, resolved for you
Response shape	Scores buried under versioned metric arrays	One flat row per CVE, CWE ids as a plain array
Without a key	Throttled after a handful of calls	Keyless, with the rate limit handled our side

What people search for

Live autocomplete demand around CVE vulnerabilities (NVD), pulled with our own Keyword ideas collector.

CVE API: the POST to the nvd_cve collector, 20 CVEs delivered and the bill, 20 × $0.0004 = $0.008 in usage.cost_usd; zero CVEs would cost $0. — The same call you would paste into a terminal: a Bearer key, keyword and severity in the body, and back the envelope every QuanticData endpoint returns — type, message, payload — where count is how many CVEs arrived and usage.cost_usd is $0.008, which is 20 × $0.0004. A run that delivers nothing costs nothing. The key is good for 60 req/min on the free tier.

Sources and standards

The platform documentation and standards this collector is built against — check any claim on this page against the primary source:

FAQ

Questions we get about the CVE API.

Something else? Ask us

Do I need an NVD API key?

No. The public NVD 2.0 endpoint rate-limits sharply for unauthenticated callers; that limit is handled on our side, so you send a keyword and get CVE rows back without registering for or holding a key.

Which CVSS version does cvss_score come from?

The best one present on the record: v3.1 is preferred, then v3.0, then v2. You get one score, severity and vector per CVE instead of three partly-filled metric blocks to reconcile yourself.

Can I return only critical vulnerabilities?

Yes — set severity to LOW, MEDIUM, HIGH or CRITICAL and only CVEs at that CVSS v3 severity come back, so a feed can be gated down to the rows that matter.

Is there a free CVE API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered CVEs on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 200 CVEs — the maximum for this collector — costs $0.08 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and GET /v1/scraper/collectors returns the price your key actually pays.

Run the CVE API now

$2 of free credit every month, no card. Your key returns its own prices from GET /v1/scraper/collectors.

Run in dashboard

Illustration: three coloured zones of the page that is read (Vulnerability record) turn into clean JSON with the fields description, cvss_score and severity; 23 fields on every row.