U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

NVD Data Feeds


Users of the data feeds provided on this page must have an understanding of the XML and/or JSON standards and XML or JSON related technologies as defined by www.w3.org.

The entire NVD database can be downloaded from this web page for public use. All NIST publications are available in the public domain according to Title 17 of the United States Code, however acknowledgement of the NVD when using our information is always appreciated.

APIs and Data Feed Types

The following table contains quick links and descriptions to each API or data feed type we offer. Please make sure to read about how to keep up-to-date with NVD data when using the traditional data feeds at the bottom of this page!

Type Description
CVE and CPE APIs An alternative to the traditional vulnerability data feed files. The APIs are far more flexible and offer a richer dataset in a single interface compared to the JSON Vulnerability Feeds and CPE Match Feed.
JSON Vulnerability Feeds Each vulnerability in the file includes a description and associated reference links from the CVE® dictionary feed, as well as CVSS base scores, vulnerable product configuration, and weakness categorization.
CPE Match Feed A feed that provides the product/platform applicability statement to CPE URI matching based on the CPEs in the official CPE dictionary.
RSS Vulnerability Feeds An eight day window of security related software flaws.
Vulnerability Translation Feeds Translations of vulnerability feeds.
Vulnerability Vendor Comments Comments provided by vendors regarding a particular flaw affecting within a product.
CPE Dictionary dictionary containing a list of products.
Common Configuration Enumeration (CCE) Reference Data Reference data for common configuration items.


The CVE and CPE APIs are the next stage in providing up to date vulnerability information for NVD data consumers. The results from these APIs are updated as quickly as our website (unlike the traditional feeds which have explicit update intervals).

CVE API Documentation CPE API Documentation
Automation Support for CVE Retrieval  Automation Support for CPE Retrieval

A few of the greater benefits of the APIs over the traditional data feeds are listed below:

  • Retain all search capabilities based on the Advanced search page for the website
  • Both CVE and CPE based searching capabilities
  • No longer required to download entire feed files for simple requests
  • Ability to see what has changed since a given date
  • Ease of identifying CPE matches to Applicability statements

JSON Feeds

These data feeds includes both previously offered and new NVD data points in an updated JSON format. The "year" feeds are updated once per day, while the "recent" and "modified" feeds are updated every two hours.

XML Schema Version 1.1 NVD JSON 1.1 Schema
Feed Updated Download Size (MB)
CVE-Modified 12/07/2021; 8:00:01 PM -0500 META
GZ 0.44 MB
ZIP 0.44 MB
CVE-Recent 12/07/2021; 8:00:00 PM -0500 META
GZ 0.09 MB
ZIP 0.09 MB
CVE-2021 12/07/2021; 3:00:09 AM -0500 META
GZ 3.92 MB
ZIP 3.92 MB
CVE-2020 12/07/2021; 3:00:27 AM -0500 META
GZ 5.09 MB
ZIP 5.09 MB
CVE-2019 12/07/2021; 3:00:45 AM -0500 META
GZ 4.35 MB
ZIP 4.35 MB
CVE-2018 12/07/2021; 3:00:59 AM -0500 META
GZ 3.90 MB
ZIP 3.90 MB
CVE-2017 12/07/2021; 3:01:13 AM -0500 META
GZ 3.58 MB
ZIP 3.58 MB
CVE-2016 12/07/2021; 3:01:25 AM -0500 META
GZ 2.57 MB
ZIP 2.57 MB
CVE-2015 12/04/2021; 3:01:25 AM -0500 META
GZ 2.10 MB
ZIP 2.10 MB
CVE-2014 12/01/2021; 3:01:44 AM -0500 META
GZ 2.24 MB
ZIP 2.24 MB
CVE-2013 12/01/2021; 3:01:54 AM -0500 META
GZ 2.34 MB
ZIP 2.34 MB
CVE-2012 11/23/2021; 3:01:02 AM -0500 META
GZ 1.97 MB
ZIP 1.97 MB
CVE-2011 11/30/2021; 3:01:20 AM -0500 META
GZ 1.75 MB
ZIP 1.75 MB
CVE-2010 11/16/2021; 3:01:11 AM -0500 META
GZ 1.85 MB
ZIP 1.85 MB
CVE-2009 11/16/2021; 3:01:17 AM -0500 META
GZ 1.88 MB
ZIP 1.88 MB
CVE-2008 11/16/2021; 3:01:23 AM -0500 META
GZ 2.06 MB
ZIP 2.06 MB
CVE-2007 12/01/2021; 3:02:01 AM -0500 META
GZ 2.00 MB
ZIP 2.00 MB
CVE-2006 12/04/2021; 3:01:32 AM -0500 META
GZ 2.03 MB
ZIP 2.03 MB
CVE-2005 11/09/2021; 3:02:07 AM -0500 META
GZ 1.28 MB
ZIP 1.28 MB
CVE-2004 11/09/2021; 3:02:10 AM -0500 META
GZ 0.82 MB
ZIP 0.82 MB
CVE-2003 08/23/2021; 1:59:45 PM -0400 META
GZ 0.41 MB
ZIP 0.41 MB
CVE-2002 11/17/2021; 3:00:36 AM -0500 META
GZ 1.39 MB
ZIP 1.39 MB

CPE Match Feed

This data feed provides a list of all CVE applicability statement match criteria (CPE match strings and CPE match ranges) and the CPE URIs from the official CPE dictionary that match. Data consumers can use this feed to enhance the CPE information provided in the JSON Vulnerability feeds. If a CPE URI expected to match a given criteria is missing, please contact cpe_dictionary@nist.gov as those CPEs may need approved to the official CPE dictionary. This feed is updated once per day.

XML Schema Version 1.0 NVD CPE Match Feed 1.0 Schema
Feed Updated Download Size (MB)
CPE-Match 12/07/2021; 12:10:40 AM -0500 META
GZ 20.21 MB
ZIP 20.21 MB

RSS Vulnerability Feeds

NVD provides two RSS 1.0 data feeds. The first feed, nvd-rss.xml ( zip or gz ), provides information on all vulnerabilities within the previous eight days. The second feed, nvd-rss-analyzed.xml ( zip or gz ), provides only vulnerabilities which have been analyzed within the previous eight days. The advantage of the second feed is that we are able to provide vulnerable product names in the title. The advantage of the former is that you learn about new vulnerabilities as soon as possible.

Vulnerability Vendor Comments

NVD provides a service whereby software development organizations can submit "Official Vendor Comments" on the set of CVE vulnerabilities that apply to their products. Organizations can submit comments by contacting NVD staff at nvd@nist.gov . More information is provided on the vendor comment page.

All of the vendors comments can be downloaded from the following XML feed which is updated every 2 hours:

Feed Updated Download Size (MB)
Vendor Comments 12/07/2021; 12:45:02 AM -0500 META
GZ 0.07 MB
ZIP 0.07 MB

NVD/CVE Translated XML Feed (version 1.0)

NVD provides an XML feed for translations of CVE vulnerabilities into other languages.

Currently, INCIBE (Spanish National Cybersecurity Institute) is translating vulnerabilities into Spanish. INCIBE is solely responsible for the Spanish translation content. Incibe Logo

XML Schema Version 1 NVD/CVE Translation XML Schema
Feed Updated Download Size (MB)
CVE-Modified 12/07/2021; 12:40:00 AM -0500 META
GZ 0.03 MB
ZIP 0.03 MB
CVE-2021 12/07/2021; 12:35:45 AM -0500 META
GZ 1.42 MB
ZIP 1.42 MB
CVE-2020 12/07/2021; 12:36:35 AM -0500 META
GZ 1.71 MB
ZIP 1.71 MB
CVE-2019 12/07/2021; 12:37:21 AM -0500 META
GZ 1.45 MB
ZIP 1.45 MB
CVE-2018 12/07/2021; 12:38:03 AM -0500 META
GZ 1.32 MB
ZIP 1.32 MB
CVE-2017 12/07/2021; 12:38:46 AM -0500 META
GZ 1.26 MB
ZIP 1.26 MB
CVE-2016 12/07/2021; 12:39:12 AM -0500 META
GZ 0.72 MB
ZIP 0.72 MB
CVE-2015 12/07/2021; 12:39:34 AM -0500 META
GZ 0.64 MB
ZIP 0.64 MB
CVE-2014 12/07/2021; 12:39:57 AM -0500 META
GZ 0.65 MB
ZIP 0.65 MB
CVE-2013 12/07/2021; 12:40:15 AM -0500 META
GZ 0.55 MB
ZIP 0.55 MB
CVE-2012 12/07/2021; 12:40:30 AM -0500 META
GZ 0.47 MB
ZIP 0.47 MB
CVE-2011 12/07/2021; 12:40:43 AM -0500 META
GZ 0.41 MB
ZIP 0.41 MB
CVE-2010 12/07/2021; 12:40:58 AM -0500 META
GZ 0.45 MB
ZIP 0.45 MB
CVE-2009 12/07/2021; 12:41:12 AM -0500 META
GZ 0.48 MB
ZIP 0.48 MB
CVE-2008 12/07/2021; 12:41:31 AM -0500 META
GZ 0.64 MB
ZIP 0.64 MB
CVE-2007 12/07/2021; 12:41:49 AM -0500 META
GZ 0.63 MB
ZIP 0.63 MB
CVE-2006 12/07/2021; 12:42:01 AM -0500 META
GZ 0.39 MB
ZIP 0.39 MB
CVE-2005 12/07/2021; 12:42:03 AM -0500 META
GZ 0.04 MB
ZIP 0.04 MB
CVE-2004 12/07/2021; 12:42:06 AM -0500 META
GZ 0.06 MB
ZIP 0.06 MB
CVE-2003 12/07/2021; 12:42:09 AM -0500 META
GZ 0.07 MB
ZIP 0.07 MB
CVE-2002 12/07/2021; 12:42:12 AM -0500 META
GZ 0.07 MB
ZIP 0.07 MB

How to Keep Up-to-Date with the NVD Data Using the Traditional Feeds

The vulnerability feeds provide CVE® data organized by the first four digits of a CVE® identifier (except for the 2002 feeds which include vulnerabilities prior to and including "CVE-2002-"). If you are locally mirroring NVD data, the data feeds should be used to stay synchronized. After performing a one-time import of the complete data set using the compressed JSON vulnerability feeds, the "modified" feeds should be used to keep up-to-date.

Each feed is updated nightly, but only if the content of that feed has changed. For example the 2004 feeds will be updated only if there is an addition or modification to any vulnerability with a starting CVE® identifier of "CVE-2004-". The "recent" feeds are a list of recently published vulnerabilities and the "modified" feeds are a list of recently published and modified vulnerabilities. The "recent" and "modified" feeds only contain vulnerabilities changed within the previous eight days. These feeds are updated approximately every two hours.

META Files

Each of the data feeds is described by an associated plain text file with the same name as the .xml file with a .meta extension. These files are updated approximately every two hours to reflect changes within their respective feed file. For example, if the name of the file is nvdcve-1.1-Modified.json then the .meta file name will be nvdcve-1.1-Modified.meta. The .meta file contains information about the specific feed file including the last modified date and time, the size of the file uncompressed, and a SHA256 value of the uncompressed file:


The META file should be used to determine if a given feed has been updated since your last import. This helps prevent unnecessary downloads of the .zip or .gz files and should result in a reasonable use of less than 200 requests per day.