CVE & Vulnerabilities APIs

CVE and vulnerability APIs here are mostly free and keyless. The National Vulnerability Database is the US government's catalog of CVE records with CVSS scores, MSRC publishes Microsoft's own advisories in CVRF and CSAF formats, and Defend Network narrows the list to exploited CVEs with EPSS scores and CISA KEV status. VulDB adds exploit intelligence.

4 listings

Table Rows

API	Pricing	Auth	Format	Free tier	Status
Defend NetworkDaily JSON feed of exploited CVEs with CVSS/EPSS scores and CISA KEV status, no key needed. Identity & Security › Threat Intel	Free	None	JSON	Unlimited	Live
Microsoft Security Response Center (MSRC)Official Microsoft security bulletin and CVE data in CVRF/CSAF format, no key needed. Identity & Security › Threat Intel		None	JSON	Unlimited	Live
National Vulnerability Database (NVD)US government database of CVE vulnerability records with CVSS scores, descriptions and references. Identity & Security › Threat Intel	Free	None	JSON	10k+/day	Live
VulDBVulnerability and exploit intelligence database tracking CVEs and security advisories. Identity & Security › Threat Intel				—	Untested

Choosing a CVE & Vulnerabilities API

Is there a free CVE & Vulnerabilities API?

Yes. National Vulnerability Database (NVD) and Defend Network are free to use.

Which CVE & Vulnerabilities APIs work without an API key?

National Vulnerability Database (NVD), Defend Network and Microsoft Security Response Center (MSRC) need no key or sign-up, so you can try them with a plain request.

Can I call a CVE & Vulnerabilities API from front-end JavaScript?

National Vulnerability Database (NVD) and Defend Network allow cross-origin requests and need no key, so they work straight from the browser. For the others, call them from your server so your key stays private.

Can I use CVE & Vulnerabilities APIs in a commercial project?

National Vulnerability Database (NVD) and Defend Network permit commercial use.

Which CVE & Vulnerabilities APIs work with AI agents?

Microsoft Security Response Center (MSRC) has both an MCP server and an OpenAPI spec.

Broader: Threat Intel APIs · Identity & Security APIs

More in Threat Intel: IP Reputation APIs · Phishing & Malicious URLs APIs · Data Breach APIs