Skip to content

Quickstart: Look Up A CVE With The NVD API

A single request to the NVD CVE API 2.0 returns the full Log4Shell record, which runs to thousands of lines. Only seven of those fields tell you how severe the flaw is and whether attackers are already using it.

Before You Begin

All you need is a web browser or a terminal with curl. A single lookup doesn't need an account or an API key, because the NVD accepts unauthenticated requests at a lower rate limit.

Note

Since April 15, 2026, NIST has fully analysed only a priority subset of CVEs. Log4Shell sits inside that subset, so its record is complete, while many newer CVEs remain partial. The vulnStatus field, covered in Read The Response, tells you which kind of record you're holding.

Send Your First Request

Every vulnerability in the NVD has a unique identifier in the format CVE-YEAR-NUMBER. Pass one to the cveId parameter to return that single record.

curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228"

To skip the terminal, paste the same URL into your browser's address bar and the raw JSON loads directly.

Parameter Used

Parameter Type Required Description
cveId string No Returns the single CVE that matches this ID. Without it, the API searches all CVEs using the other parameters in your request.

Read The Response

Most of the full record lists affected products and reference links. The excerpt below, captured on October 24, 2026, keeps only the fields that matter for a first lookup. It leaves out the affected, configurations, weaknesses and references blocks, the Spanish description, the CVSS v2 score, the secondary CVSS v3.1 score, several cvssData sub-fields and the second half of the English description.

{
  "resultsPerPage": 1,
  "startIndex": 0,
  "totalResults": 1,
  "format": "NVD_CVE",
  "version": "2.0",
  "timestamp": "2026-10-24T04:32:53.964",
  "vulnerabilities": [
    {
      "cve": {
        "id": "CVE-2021-44228",
        "sourceIdentifier": "security@apache.org",
        "published": "2021-12-10T10:15:09.143",
        "lastModified": "2026-08-11T19:33:44.513",
        "vulnStatus": "Analyzed",
        "descriptions": [
          {
            "lang": "en",
            "value": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints."
          }
        ],
        "metrics": {
          "cvssMetricV31": [
            {
              "source": "nvd@nist.gov",
              "type": "Primary",
              "cvssData": {
                "version": "3.1",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL"
              }
            }
          ]
        },
        "cisaExploitAdd": "2021-12-10",
        "cisaActionDue": "2021-12-24",
        "cisaVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability"
      }
    }
  ]
}

Log4Shell is about as clear a case as the NVD offers. NIST has completed its analysis and assigned the maximum CVSS v3.1 score of 10.0. CISA added the flaw to its Known Exploited Vulnerabilities catalog on the day it was published, and US federal agencies had until December 24, 2021 to patch it.

Field What it tells you
totalResults The number of matching CVEs. A lookup by ID returns 1, or 0 if the ID isn't in the NVD.
vulnStatus Shows whether NIST has analysed the record. Check it first, because since April 2026 a record can stay in the database for months without NIST analysis.
metrics.cvssMetricV31 Severity scores under CVSS v3.1, where baseScore runs from 0.0 to 10.0 and baseSeverity gives the matching label, such as CRITICAL.
type Primary marks a score from NIST. A score from another organisation, such as the CVE Numbering Authority that reported the flaw, appears as Secondary. Now that NIST no longer scores every record, a newer CVE may carry only a secondary score or none at all.
cisaExploitAdd, cisaActionDue These appear only for CVEs in CISA's Known Exploited Vulnerabilities catalog, with the date each was added and the deadline for US federal agencies to fix it. CISA lists a flaw only on evidence of active exploitation, so treat any CVE carrying these fields as urgent.

Warning

Without an API key, the NVD allows 5 requests in a rolling 30-second window. A quickstart fits within that limit, but any automated workflow will stall on it. A free key raises the limit to 50 requests per 30 seconds. Request one before you build on the API, and send it in an apiKey request header.

Next Steps