NIST NVD CVE Search
nvd.cves.searchRead-onlyIdempotent
Search the National Vulnerability Database for CVE records by keyword, vendor, product, CVSS severity, or publication date range. Returns CVE-ID, summary, severity, and affected configurations.
Instructions
Search the National Vulnerability Database for CVE records by keyword, vendor, product, CVSS severity, or publication date range. Returns CVE-ID, summary, CVSS v3 base score, severity (LOW/MEDIUM/HIGH/CRITICAL), affected CPE configurations, references. Distinct from OSV: NVD provides canonical NIST records with CVSS v3 scores, CWE weakness types, and CPE configurations.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| keyword | No | Free-text keyword to search CVE records. Examples: 'log4j', 'OpenSSL CVE-2023', 'Linux kernel use-after-free'. Combined with other filters using AND logic. | |
| cvss_v3_severity | No | Filter by CVSS v3 base severity. LOW = 0.1–3.9, MEDIUM = 4.0–6.9, HIGH = 7.0–8.9, CRITICAL = 9.0–10.0. Omit to return all severities. | |
| pub_start_date | No | Earliest CVE publication date in ISO 8601 extended format with timezone offset (e.g. '2024-01-01T00:00:00.000+00:00'). Maximum 120-day window per request when combined with pub_end_date. | |
| pub_end_date | No | Latest CVE publication date in ISO 8601 extended format with timezone offset (e.g. '2024-12-31T23:59:59.999+00:00'). Must be paired with pub_start_date. Maximum 120-day window. | |
| results_per_page | No | Number of CVE records to return per page. Range: 1–2000. Default: 20. | |
| start_index | No | Zero-based offset for pagination. Use with results_per_page to page through large result sets. Default: 0. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | No | Tool response payload. Shape varies per tool — consult the tool description and inputSchema. May be an object, array, string, or number depending on the upstream provider response. | |
| error | No | Present only when the call failed. Includes error code, message, request_id, and any provider-specific extras. |