Developers · open data

CVE data API

A free, no-key JSON API and a nightly CSV export of our enriched CVE data. Base vulnerability data is derived from NVD; the summaries, weakness explainers and PoC/patch links are dbcve.org’s enrichment, shared under CC-BY-4.0. No sign-up, no rate-limit gymnastics — just link back to dbcve.org.

JSON endpoints

All responses are JSON with Access-Control-Allow-Origin: *, so you can call them straight from a browser app. Paths are versioned under /api/v1/.

GET/api/v1/cves/

Paginated, filterable list. Query params: severity, vendor, kev, days, q, status, sort, page, limit (max 100).

https://dbcve.org/api/v1/cves/?severity=critical&kev=1

GET/api/v1/cve/{id}/

A single CVE — record, enrichment, CWEs and references.

https://dbcve.org/api/v1/cve/CVE-2026-48908/

GET/api/v1/latest/

The week’s highest-severity CVEs (mirrors the Latest page).

https://dbcve.org/api/v1/latest/

GET/api/v1/kev/

The most recent actively-exploited (CISA KEV) CVEs.

https://dbcve.org/api/v1/kev/

Bulk CSV export

Regenerated nightly and served as static files — pull these instead of paginating the JSON when you want the whole dataset.

GET/api/v1/export/cves.csv

Core CVE records: id, severity, CVSS, KEV, published date, vendor, product, description.

https://dbcve.org/api/v1/export/cves.csv

GET/api/v1/export/enriched.csv

Only enriched CVEs, with our technical summary, mitigation and PoC/patch links.

https://dbcve.org/api/v1/export/enriched.csv

GitHub & auto-downloader

Endpoint list, schema and a ready-to-cron downloader live in the public repo. The downloader pulls the latest CSVs and only rewrites them when they’ve actually changed.

github.com/dbcve/cve-data →

# fetch the latest exports into ./dbcve-data (safe to cron nightly)
curl -fsSL https://dbcve.org/api/v1/export/enriched.csv -o dbcve-data/enriched.csv
curl -fsSL https://dbcve.org/api/v1/export/cves.csv     -o dbcve-data/cves.csv

Licence & attribution

Data and enrichment are released under CC-BY-4.0. You’re free to use, adapt and redistribute — just credit dbcve.org with a link. Base CVE data originates from the NVD and remains in the public domain.