cve_lookup
Look up NIST NVD CVE records with CISA KEV status. Filter by CVE ID, keyword, CPE name, severity, or date range, and get combined CVSS and KEV remediation data for IT compliance.
Instructions
Look up NIST NVD CVE records (keyless; services.nvd.nist.gov CVE API 2.0) — exact by cveId (CVE-YYYY-NNNN) OR search by keyword/cpeName/cvssV3Severity/a publication or last-modified date range — each row JOINED with its CISA KEV (Known Exploited Vulnerabilities) status. THE B2G unlock for FedRAMP/CMMC/SBOM IT-compliance: CVSS severity AND whether CISA mandates remediation by a date, in one row. Returns { results:[{ cveId, vulnStatus, rejected, published, lastModified, description, cvssMetrics:[{version,source,type,baseScore,baseSeverity,vectorString,exploitabilityScore,impactScore}], primaryCvss:{version,baseScore,baseSeverity,type}|null, cwes, references, kev }] } + honest _meta. Optional kevOnly (KEV-listed rows only), resultsPerPage (≤2000, def 50), startIndex. CVSS HONESTY: every metrics key matching ^cvssMetric (V2/V30/V31/V40) is surfaced as its own cvssMetrics[] element — versions are NEVER conflated and ssvcV203/non-CVSS keys are excluded; V2 baseSeverity reads from the metric level; primaryCvss is the highest-version metric, preferring type:'Primary' but FALLING BACK to the highest Secondary (a real CNA score is never dropped), null ONLY when no CVSS exists (Rejected/Awaiting) — base scores are null-never-0. KEV HONESTY: kev is {listed:true,dateAdded,dueDate,ransomware,requiredAction,catalogVersion} | {listed:false,note} | {listed:null,status:'unavailable'}; a not-listed result carries the not-in-KEV≠safe caveat (absence is NOT a clearance); if the KEV catalog cannot load, kev.listed degrades to NULL (never false) with fieldsUnavailable:['kev'], and a kevOnly filter during that outage THROWS (a KEV-membership filter is unanswerable without the catalog). PAGINATION is from NVD's EXACT totalResults, never page length. A genuine totalResults:0 is an honest found:false; a 403/429 rate breach THROWS rate_limited with the NVD_API_KEY tier disclosure; 404/5xx/timeout/off-host-redirect THROW (never a fake-empty). An OPTIONAL free NVD_API_KEY (env; https://nvd.nist.gov/developers/request-an-api-key) lifts the rate and is sent ONLY in the apiKey header — never a URL/label/_meta/log.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cveId | No | Exact CVE identifier CVE-YYYY-NNNN (^CVE-\d{4}-\d+$, validated client-side). Exact-lookup mode; a malformed cveId is rejected (invalid_input) — a malformed cveId 404s upstream. At least one of cveId/keyword/cpeName/cvssV3Severity/a date range is REQUIRED. | |
| cpeName | No | A CPE 2.3 formatted string to match affected products (cpe:2.3:[aho]:… — e.g. cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*). Non-CPE input is rejected (invalid_input). | |
| kevOnly | No | When true, return ONLY rows listed in the CISA KEV catalog. ★If the KEV catalog cannot be loaded, this THROWS (a KEV-membership filter is unanswerable without a loaded catalog) — it NEVER returns a silently-empty set (which would falsely read as 'none on the mandatory-remediation list'). | |
| keyword | No | Free-text keyword search (NVD keywordSearch) over CVE descriptions (e.g. 'log4j', 'apache struts'). Control chars stripped, length-capped; rides only as a query param (SSRF-safe). | |
| pubEndDate | No | Publication-date window END (ISO YYYY-MM-DD). Paired with pubStartDate. | |
| startIndex | No | Zero-based page offset (default 0). Pagination derives from NVD's exact totalResults, never the page length. | |
| pubStartDate | No | Publication-date window START (ISO YYYY-MM-DD). PAIRED with pubEndDate (both required together — NVD 404s a lone bound). A span >120 days is clamped forward to 120 days BEFORE the request and disclosed. | |
| cvssV3Severity | No | Filter to a CVSS v3 base severity band (LOW|MEDIUM|HIGH|CRITICAL). | |
| lastModEndDate | No | Last-modified window END (ISO YYYY-MM-DD). Paired with lastModStartDate. | |
| resultsPerPage | No | Rows per page (default 50, max 2000 — NVD's cap). Over-cap is refused, never silently clamped. | |
| lastModStartDate | No | Last-modified window START (ISO YYYY-MM-DD). PAIRED with lastModEndDate (both required together). A span >120 days is clamped + disclosed. |