skills.rest
irrit-us
irrit-usOFFICIAL
Explore all skills by this author →
GitHub

nvd-cve

Query the NVD REST API for CVE records, CVSS scores, and KEV catalog data.

Updated May 17, 2026
Search Tags:#security#vulnerability#api#cvss#cve#nvd#kev
One-click install
npx skills add https://github.com/irrit-us/agent_misc --skill nvd-cve-irrit-us
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nvd-cve
Source: https://github.com/irrit-us/agent_misc/tree/main/skills/nvd-cve
Command: npx skills add https://github.com/irrit-us/agent_misc --skill nvd-cve-irrit-us

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security research and vulnerability triage require fast access to authoritative CVE data, but manually browsing the NVD website is slow and hard to automate. This Skill provides verified curl commands against the NVD REST API v2.0 so you can retrieve CVE details, severity scores, and exploit catalog entries directly from the terminal. ## Core Features & Use Cases - CVE Lookup and Detail Extraction: Fetch single or bulk CVE records with CVSS v2/v3/v4 scores, CWE mappings, references, and CISA KEV status. - Filtered Vulnerability Search: Query by CVSS severity, CWE ID, keyword, CPE product, publication or modification date range, and KEV catalog membership. - Use Case: A security engineer needs to check whether any CRITICAL vulnerabilities were published against Apache Log4j versions 2.0 through 2.17.1. Using the virtual CPE match query with version range parameters, they get a filtered list of matching CVEs in seconds. ## Quick Start Ask the agent to look up CVE-2024-3094 in the NVD database and summarize its CVSS severity, CWE weaknesses, and KEV status.

Frequently Asked Questions about nvd-cve

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I look up a CVE in the NVD database from the command line?▼

Send a GET request to https://services.nvd.nist.gov/rest/json/cves/2.0 with the cveId parameter, for example using curl with cveId=CVE-2024-3094. Pipe the response through python3 -m json.tool to format the JSON output.

How to filter NVD CVEs by CVSS severity or CWE?▼

Use the cvssV3Severity parameter with values LOW, MEDIUM, HIGH, or CRITICAL to filter by severity, or the cweId parameter such as CWE-287 to filter by weakness type. Combine with noRejected to exclude rejected CVEs and resultsPerPage to control output size.

Do I need an API key to query the NVD API?▼

No, the NVD API works without a key but limits you to roughly 5 requests per 30 seconds. Requesting a free API key from NIST raises the limit to about 50 requests per 30 seconds, passed via the apiKey header.

How do I check if a CVE is in the CISA KEV catalog?▼

Query the NVD API with the hasKev flag to list only CVEs in the CISA Known Exploited Vulnerabilities catalog. The response includes cisaExploitAdd, cisaActionDue, and cisaRequiredAction fields for each entry.

What are the limitations of the NVD API date range queries?▼

Publication and last-modified date range queries are capped at 120 consecutive days per request. The resultsPerPage parameter maxes out at 2000 for CVEs, and no new CVSS v2 data has been added since July 2022.

Related Skills

Explore More Software Engineering Skills→
adihebbalaeadihebbalae
3

sbom

Generate and scan Software Bill of Materials for known vulnerabilities.

Community
Advanced
DCx7C5DCx7C5

vulnerabilities-SKILL.md

Prioritize CVEs by CVSS scores enriched with EPSS and KEV data.

Community
Advanced
braydos-hbraydos-h
4

prioritizing-vulnerabilities-with-cvss-scoring

Prioritize vulnerabilities using CVSS scores, EPSS exploit probability, and CISA KEV data.

Community
Intermediate
x-cmdx-cmd
4.6k

x-osv

Query OSV database for package vulnerabilities and scan local projects.

Official
Intermediate