Collectors · OSINT & security

CVE API in Python

Vulnerabilities from the NIST NVD — CVE id, description, CVSS score, severity, CWE. One POST from Python with the input, rows back as JSON with 23 fields, $0.0004 per delivered CVE. No proxies or parsers to maintain.

Get an API key See the collector

A Python requests snippet that posts { — A Python requests call to the nvd_cve collector returns one dict per CVE, at $0.0004 each.

First call

Install, call, read the rows.

pip install requests

The only dependency.

import os, requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run",
    headers={"Authorization": f"Bearer {os.environ['QD_API_KEY']}"},
    json={
        "keyword": "log4j",
        "max_results": 20,
    },
    timeout=120,
)
r.raise_for_status()
run = r.json()["payload"]
print(run["count"], "rows,", run["cost"]["usd"], "USD")
for row in run["results"]:
    print(row.get("cve_id"), row.get("description"), row.get("cvss_score"), row.get("severity"))

Python: one CVE vulnerabilities (NVD) run (Per keyword), printing cve_id, description, cvss_score, severity

The key comes from an environment variable, never from the code. The run answers in the same request when it finishes in time; payload.results holds the rows and payload.cost what they cost.

Request parameters

What the collector takes.

Input of the CVE vulnerabilities (NVD) collector
Parameter	Type	Required	Meaning
`keyword`	string	no	Search term (product, vendor, CVE text).
`severity`	string: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`	no	Filter to a CVSS v3 severity.
`cve_id`	string	no	Look up one CVE, e.g. CVE-2021-44228.
`known_exploited`	boolean	no (default false)	Only CVEs in the CISA Known Exploited Vulnerabilities catalog.
`max_results`	integer	no (default 20)	How many CVEs to deliver at most (1–200). You pay only for delivered CVEs.

Response fields

23 fields per CVE.

Fields of each row (CVE)
Field	Type	What it holds
`rank`	integer	1-based position.
`cve_id`	string	CVE identifier.
`description`	string, nullable	English description.
`cvss_score`	number, nullable	CVSS base score.
`severity`	string, nullable	CVSS severity.
`cvss_vector`	string, nullable	CVSS vector string.
`cwe`	string[]	CWE weakness ids.
`published`	string, nullable	Publish date.
`last_modified`	string, nullable	Last modified date.
`status`	string, nullable	Vulnerability status.
`references`	string[]	Reference URLs.
`url`	string	NVD detail page.
`cvss_version`	string, nullable	CVSS version of the score.
`exploitability_score`	number, nullable	CVSS exploitability sub-score.
`impact_score`	number, nullable	CVSS impact sub-score.
`attack_vector`	string, nullable	Attack vector (NETWORK, LOCAL…).
`affected_products`	string[]	Vulnerable vendor:product pairs from the CPE configurations.
`source`	string, nullable	Organisation that assigned the CVE.
`known_exploited`	boolean	In the CISA Known Exploited Vulnerabilities catalog.
`kev_added`	string, nullable	Date added to the CISA KEV catalog.
`kev_due_date`	string, nullable	CISA remediation due date.
`kev_required_action`	string, nullable	CISA required action.
`patch_urls`	string[]	References tagged Patch or Vendor Advisory.

Add ?format=csv to the runs endpoint to get the same rows as CSV.

Long runs

Run in the background, then poll.

A run that needs more time can go to the background: send "async": true, get 202 with the run id, and poll the runs endpoint until the status is done. Reading a run is free.

import os, time, requests

H = {"Authorization": f"Bearer {os.environ['QD_API_KEY']}"}
r = requests.post("https://api.quanticdata.io/v1/scraper/collectors/nvd_cve/run", headers=H,
                  json={**{"keyword":"log4j","max_results":20}, "async": True}, timeout=30)
run_id = r.json()["payload"]["run_id"]
while True:
    run = requests.get(f"https://api.quanticdata.io/v1/scraper/collectors/runs/{run_id}", headers=H, timeout=30).json()["payload"]
    if run["status"] in ("done", "failed"):
        break
    time.sleep(5)
print(run["status"], run["count"])

Python: background run and polling

Errors

What can come back, and what is billed.

Collector run errors
Status	Meaning	Billed
`400`	The input does not match the collector (`payload.errors`)	No
`401`	Missing or wrong API key	No
`402`	Balance and free credit do not cover the run: top up	No
`422`	The input can never resolve; retrying the same input cannot help	No
`424`	The run failed at the source (blocked, timed out, layout changed); safe to retry	No
`429`	Rate limit or a per-account brake; wait for `Retry-After`	No

Only delivered rows are billed: a run that delivers nothing costs nothing.

Price

$0.0004 per delivered CVE.

What CVE vulnerabilities (NVD) rows cost at list price
Rows	Cost
1	$0.0004
1,000	$0.40
10,000	$4.00

Up to 200 CVEs per run; split larger jobs into several runs. The $2 free credit every month covers about 5,000 CVEs. No subscription; paid tiers lower the unit price. All collector prices: collector pricing.

Before you run it

Questions developers ask

Is there a free CVE vulnerabilities (NVD) API?

Every account gets $2 of free usage each month, about 5,000 CVEs of this collector at $0.0004 each, with no card.

Do I have to handle proxies, retries or blocks?

No. The collector runs on our network and handles them; a run blocked at the source returns 424 and is not billed.

How many rows can one run return?

Up to 200 CVEs per run (the max_results input, where the collector has one).

Can an AI agent run it?

Yes: the MCP server exposes it as the run_collector tool, with the same input and price. See the MCP server.

Run it on the free credit.

Create an API key, export it as QD_API_KEY and run the example. $0.0004 per delivered CVE, no subscription.

Get an API key CVE API