# CVE API — $0.0004 per CVE

> CVE API: Vulnerabilities from the NIST NVD — CVE id, description, CVSS score, severity. $0.0004 per delivered CVE, nothing delivered means nothing charged.

[Home](https://quanticdata.io/)/[Collectors](https://quanticdata.io/collectors/)/*CVE API*

# CVE API

A CVE API turns the NIST National Vulnerability Database into rows instead of a nested JSON tree you have to walk. Send a keyword — a product, a vendor, a library — and optionally a severity, and each matching vulnerability comes back as one flat record: the CVE id, its description, the best available CVSS base score and severity, the CWE weakness ids, the published and modified dates and the reference links.

[Get my free API key](https://app.quanticdata.io/register) [See the request](/collectors/cve-api/#integration)

$0.0004 per delivered CVE · $2 free every month · Failed runs never billed

POST /v1/scraper/collectors/nvd_cve/run

```
$ curl $QD/nvd_cve/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"keyword": "log4j", "max_results": 20}'
{ "status": "done", "count": 20,
  "results": [
    {
      "cve_id": "…",
      "description": "…",
      "cvss_score": …,
      "severity": "…" } ],
  "cost": 0.008 }
# 20 CVEs × $0.0004 · nothing delivered, nothing charged
```

**$0.0004 / CVE**5,000 CVEs on the free $2 every month

**Semantic input**keyword, severity, max_results — no URL lists

**Up to 200**CVEs per run, pagination handled for you

**No browser**read over HTTP/TLS — cheaper and faster than rendering

On this page: [What it is](/collectors/cve-api/#what) [Output fields](/collectors/cve-api/#output) [Inputs](/collectors/cve-api/#input) [Pricing](/collectors/cve-api/#pricing) [Integration](/collectors/cve-api/#integration) [Use cases](/collectors/cve-api/#use-cases) [Versus the alternatives](/collectors/cve-api/#compare) [FAQ](/collectors/cve-api/#faq)

## What a CVE API does

The NVD carries CVSS in three flavours — v3.1, v3.0 and v2 — and fills them in unevenly across records, so the score you actually want is wherever it happens to exist. This resolves the best available metric and hands you a single base score, severity label and vector string per CVE, which is the difference between a populated column and three partly-empty ones.

The public NVD 2.0 API throttles hard without a key and nests its scores several levels deep under version-specific metric arrays. This flattens each record, lifts the CWE weakness ids up as a plain array and returns the references as their own list, so a vulnerability is a row you can store next to a package name rather than a document you re-parse on every call.

Input is meaning, not a URL *keyword* *severity* *max_results*

## What one CVE looks like

Every delivered CVE carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

| Field | Type | What it holds |
| --- | --- | --- |
| `rank` | integer | 1-based position. |
| `cve_id` | string | CVE identifier. |
| `description` | string · nullable | English description. |
| `cvss_score` | number · nullable | CVSS base score. |
| `severity` | string · nullable | CVSS severity. |
| `cvss_vector` | string · nullable | CVSS vector string. |
| `cwe` | string[] | CWE weakness ids. |
| `published` | string · nullable | Publish date. |
| `last_modified` | string · nullable | Last modified date. |
| `status` | string · nullable | Vulnerability status. |
| `references` | string[] | Reference URLs. |
| `url` | string | NVD detail page. |

## Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

| Input | Type | Required | What it does |
| --- | --- | --- | --- |
| `keyword` | string | no | Search term (product, vendor, CVE text). |
| `severity` | string | no | Filter to a CVSS v3 severity. One of: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. |
| `max_results` | integer | no | How many CVEs to deliver at most (1–200). You pay only for delivered CVEs. |

Pricing

## CVE API pricing

$0.0004 per delivered CVE. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 CVEs before you spend anything.

**$0.0004**per delivered CVE*$0.4 per 1,000 delivered CVEs*

**5,000 CVEs**on the free allowance*$2 every month, no card*

**Zero rows**zero charge*blocks, captchas and retries are on us*

**−30%**on volume tiers*the catalog returns your key's price*

### Pay as you go

$0/mo

- $2 free credit / month

- 60 requests / min

- List unit prices

### Starter

$19/mo

- $15 free credit / month

- 300 requests / min

- 10% off unit prices

Most popular

### Growth

$79/mo

- $50 free credit / month

- 600 requests / min

- 20% off unit prices

### Scale

$299/mo

- $250 free credit / month

- 1,200 requests / min

- 30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other [Data API](https://quanticdata.io/web-data-api-for-ai/). Prices are launch pricing read live from the billing config — `GET /v1/scraper/collectors` returns the price your key actually pays.

Integration

## One POST, typed rows

Base URL `https://api.quanticdata.io/v1`, Bearer auth, the same key as every other Data API. Endpoint: `POST /v1/scraper/collectors/nvd_cve/run`.

```
curl -X POST https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"log4j","max_results":20}'
```

```
import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "keyword": "log4j",
        "max_results": 20
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)
```

```
const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"keyword":"log4j","max_results":20}),
  },
);
const { payload } = await res.json();
console.table(payload.results);
```

```
claude mcp add quantumproxies \
  -e QUANTUMPROXIES_API_KEY=qd_live_your_key_here \
  -- npx -y quantumproxies-mcp

# then, in the chat:
> run the nvd_cve collector with keyword="log4j" and max_results=20
```

## What people build with the CVE API

Three shapes of work this endpoint was designed around.

### Vulnerability feeds

Query a product or library name on a schedule and each new CVE arrives with its CVSS score and CWE ids already extracted, ready to diff against the last pull.

### Severity-gated alerts

Filter to CRITICAL or HIGH and route only the vulnerabilities that clear your threshold into a table, leaving the low-severity noise out of the pipeline.

### Weakness datasets

The CWE array on every row groups vulnerabilities by the class of bug, so a corpus of CVEs can be sliced by weakness type rather than by free-text search alone.

## CVE API versus rolling your own

The differences that actually cost time when you build this in-house.

|  | DIY scraper | This collector |
| --- | --- | --- |
| CVSS version | Read the v3.1, v3.0 and v2 metric blocks yourself | Best available score, severity and vector, resolved for you |
| Response shape | Scores buried under versioned metric arrays | One flat row per CVE, CWE ids as a plain array |
| Without a key | Throttled after a handful of calls | Keyless, with the rate limit handled our side |

## FAQ

Questions we get about the CVE API.

[Something else? Ask us →](mailto:hello@quanticdata.io)

### Do I need an NVD API key?

No. The public NVD 2.0 endpoint rate-limits sharply for unauthenticated callers; that limit is handled on our side, so you send a keyword and get CVE rows back without registering for or holding a key.

### Which CVSS version does cvss_score come from?

The best one present on the record: v3.1 is preferred, then v3.0, then v2. You get one score, severity and vector per CVE instead of three partly-filled metric blocks to reconcile yourself.

### Can I return only critical vulnerabilities?

Yes — set `severity` to LOW, MEDIUM, HIGH or CRITICAL and only CVEs at that CVSS v3 severity come back, so a feed can be gated down to the rows that matter.

### Is there a free CVE API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered CVEs on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

### How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 200 CVEs — the maximum for this collector — costs $0.08 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and `GET /v1/scraper/collectors` returns the price your key actually pays.

## Run the CVE API now

$2 of free credit every month, no card. Your key returns its own prices from `GET /v1/scraper/collectors`.

[Get my free API key](https://app.quanticdata.io/register)

Related: [All 65 collectors](https://quanticdata.io/collectors/) [Certificate transparency API](https://quanticdata.io/collectors/certificate-transparency-api/) [GitHub repository search API](https://quanticdata.io/collectors/github-repository-search-api/) [npm registry API](https://quanticdata.io/collectors/npm-registry-api/) [Documentation](https://quanticdata.io/docs/)

---

Source: https://quanticdata.io/collectors/cve-api/ · Site index for AI: https://quanticdata.io/llms.txt