Microproduct data guideintermediate

NIST National Vulnerability Database CVEs

CVE records enriched with severity, weakness, reference, and affected-product data for building vulnerability monitors and exposure triage tools.

Start the guide Open official source

At a glance

Difficulty
Intermediate — some data preparation helps
Size
Small · ≤0.1 GB
Formats
JSON
Access
API
API key
Not required
Provider
National Institute of Standards and Technology
Updates
Continuous
Data terms
NIST public-domain data notice

From source to product signal

Test a product idea in four steps

The NVD enriches CVE records with CVSS metrics, weaknesses, references, and affected-product configurations. Start with records modified during one recent week. NVD analysis can lag publication, CPE matching is imperfect, and CVSS severity does not measure exposure or business impact.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Read the NVD API guidance and choose a modification window no longer than seven days.
  2. 2.Request a small page and honor rate limits; add a free key later only if higher throughput is necessary.
  3. 3.Retain CVE identifiers, publication time, modification time, and analysis status.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

from datetime import datetime, timedelta, timezone
import pandas as pd
import requests

end = datetime.now(timezone.utc)
start = end - timedelta(days=7)
response = requests.get(
    "https://services.nvd.nist.gov/rest/json/cves/2.0",
    params={
        "lastModStartDate": start.isoformat(timespec="milliseconds"),
        "lastModEndDate": end.isoformat(timespec="milliseconds"),
        "resultsPerPage": 100,
        "noRejected": "",
    },
    timeout=30,
)
response.raise_for_status()
records = pd.json_normalize([item["cve"] for item in response.json()["vulnerabilities"]])
print(records[["id", "published", "lastModified", "vulnStatus"]].head(20))
4

Test a useful signal

Monitor recently modified vulnerabilities

Identify CVE records modified during the last seven days and review their analysis status.

  1. 01Retrieve one bounded modification window and exclude rejected records.
  2. 02Summarize records by analysis status and inspect CVSS and affected-product fields when present.
  3. 03Explain why NVD lag, CPE applicability, asset exposure, and business impact must qualify prioritization.

Dataset details

National Institute of Standards and Technology is a government source. Last verified 2026-08-13. Temporal coverage: 1999-present.

Theme

Technology & Cybersecurity

Domains

CybersecuritySoftware Security

Data types

Registry DataEvent Data

Tasks

Vulnerability MonitoringRisk AssessmentAlerting

Geography

Global

Formats

JSON

Provider

National Institute of Standards and Technology

Data terms

NIST public-domain data notice