Free Public CVE API

JSON + NDJSON access to the same vulnerability intelligence behind /pulse: NVD CVSS, EchelonGraph synthesised score, CISA KEV flag, FIRST EPSS percentile, GHSA links, and vendor advisory cross-walks (Microsoft, Red Hat, Cisco, AWS, GCP, GitLab).

No API key required. Rate-limited at 60 requests per minute per IP via our WAF. Need higher throughput? Get in touch.

Quickstart

Every endpoint is GET-only and returns JSON. Try this Log4Shell lookup:

curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228 | jq .

Endpoints

GET/api/v1/public/cves

The main feed — paginated JSON list, newest first. Params: limit (default 50), offset, search, vendor, severity, min_cvss, kev_only, year, sort (published | epss | severity | cvss_v3_score). severity filters on NVD's CVSS v3 label by default; pass severity_basis=eg to filter on the EchelonGraph severity instead — that is the basis the /pulse counts use, and it is the only way to reach the ~72,000 CVEs NVD never rated under v3. min_cvss matches the highest CVSS we hold (v3.1, v4.0 or v2.0). Rate limited per IP; see Limits below.

curl "https://app.echelongraph.io/api/v1/public/cves?severity=HIGH&severity_basis=eg&min_cvss=7&limit=20"
GET/api/v1/public/cves/summary

Overall counts and the live NVD poller's health snapshot, updated continuously. Severity buckets (critical/high/medium/low/unscored) use the EchelonGraph severity — the band we publish — and always sum to total. NVD's own CVSS v3 classification is returned alongside as nvd_critical/nvd_high/nvd_medium/nvd_low/nvd_none, so you can compare the two bases.

curl https://app.echelongraph.io/api/v1/public/cves/summary
GET/api/v1/public/cves/{id}

Single CVE record — the merged view: NVD CVSS, EchelonGraph synthesised score, KEV/EPSS signals, GHSA references, vendor advisory cross-links. For the ~72,000 pre-2016 CVEs that NVD only ever rated under CVSS v2, cvss_v3_score is 0 and the real rating is in cvss_v2_score / cvss_v2_severity / cvss_v2_vector — v2 has three bands only (LOW 0.0-3.9 / MEDIUM 4.0-6.9 / HIGH 7.0-10.0, no CRITICAL) and is NOT comparable to a v3 score. exploit_poc_available is derived from verified exploit records (Exploit-DB, Metasploit, GitHub PoC, Nuclei), not self-reported.

curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228
GET/api/v1/public/cves/{id}/related

Three categories of related CVEs (same_product / same_vendor / same_cwe), 10 each, ranked by EchelonGraph score. Powers the sidebar on every /pulse/{id} page.

curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228/related
GET/api/v1/public/cves/{id}/references

Per-reference enrichment for one CVE — vendor advisory cross-walks, patch URLs, exploit POC indicators where surfaced.

curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228/references
GET/api/v1/public/cves/trends

Weekly + monthly volume + week-over-week delta + severity distribution. Backs the dashboard cards on /pulse.

curl https://app.echelongraph.io/api/v1/public/cves/trends
GET/api/v1/public/cves/export.ndjson

Streaming NDJSON bulk export — one CVE per line. Filters: year, severity, kev_only, min_cvss. min_cvss matches the HIGHEST CVSS we hold for a CVE (v3.1, v4.0 or v2.0), so a v2-only 10.0 is included where a v3-only filter would have missed it. Hard cap 50,000 rows per call (iterate via the year param for the full dataset).

curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2024&severity=CRITICAL&kev_only=true" | jq -c .
GET/api/v1/public/vendor-advisories

Vendor-disclosed security advisories (Microsoft MSRC, Red Hat RHSA, GitHub GHSA, Cisco PSIRT, AWS, GCP, GitLab). Many appear here before NVD assigns a CVE-ID.

curl https://app.echelongraph.io/api/v1/public/vendor-advisories?has_cve=true&limit=50
GET/api/v1/public/vendor-advisories/{vendor}/{advisory_id}

Single vendor-advisory detail — title, description, CVSS, affected products, remediation, references, linked CVE IDs.

curl https://app.echelongraph.io/api/v1/public/vendor-advisories/github/GHSA-99gv-2m7h-3hh9

Bulk NDJSON Export

For researchers + security teams who want offline analysis. The export streams one CVE per line as JSON (NDJSON / JSON Lines), so you can pipe it through jq -c . or process incrementally without buffering the whole dataset.

# All KEV-listed CVEs published in 2024
curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2024&kev_only=true" \
  | jq -c '{cve_id, severity, echelongraph_score, kev_added: .kev_added_date}'

# Full 2023 CRITICAL dataset
curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2023&severity=CRITICAL" \
  > cves-2023-critical.ndjson

Hard cap: 50,000 rows per call. Iterate via the year param for the full dataset. The endpoint streams from a DB cursor, so memory pressure stays flat regardless of result size.

Scoring fields

Every CVE carries two independent EchelonGraph numbers: EG Score answers “how severe?” and EG Risk answers “how urgently should I act?”. Each score also ships its own machine-readable breakdown in score_factors(including a plain-English score_factors.eg_risk.about / .summary), so the response is self-documenting.

FieldMeaning
echelongraph_score0–10 severity (CVSS-comparable): NVD/GHSA CVSS with honest KEV/EPSS escalation and reject suppression.
echelongraph_severityCRITICAL / HIGH / MEDIUM / LOW / NONE — derived from echelongraph_score.
echelongraph_risk0–100 PRIORITY: fuses severity (45%) + exploitation — KEV/eg_kev/EPSS (40%) + automatability — SSVC (15%). Separates equal-severity CVEs so the most dangerous surface first. Higher = act sooner.
echelongraph_ssvc_decisionCISA SSVC action: Act / Attend / Track* / Track — computed in-house from the SSVC decision points (+ KEV/EPSS/CVSS fallback).
score_confidenceHIGH / MEDIUM / LOW / NONE — how much corroborating enrichment backs the score.
score_factorsFull evidence blob: rule_triggered, sources_contributing, cvss/epss/kev/eg_kev inputs, and eg_risk { risk, severity_norm, exploitation, automatable, weights, about, summary }.

Want to be notified when critical CVEs hit?

Subscribe to real-time or digest alerts covering NVD + vendor-disclosed advisories.

Subscribe via /pulse →

Notes

  • All endpoints are CORS-enabled for browser use.
  • Responses are versioned under /api/v1/. Breaking changes will land under /api/v2/ with a deprecation window.
  • Where two sources disagree on CVSS (CNA vs NVD analyst), the freshest modified timestamp wins. See Why is the EG score different from NVD?
  • Powered by direct feeds from MITRE cvelistV5 (fast), NVD API (deep), GHSA, CISA KEV, FIRST EPSS, and per-vendor advisory pollers.