CVEDB

Everyone

The CVEDB API provides vulnerability lookups by CVE, CPE, or product. It combines NVD data with linked EUVD and GitHub Security Advisory (GHSA) records when available. Enterprise customers can download the SQLite database.

See the interactive OpenAPI reference for current schemas and parameters. The database article documents the SQLite schema and data freshness.

Frequently Asked Questions

How much does it cost?
The API is free for non-commercial use. Commercial use requires an Enterprise license.
How often is it updated?
The API database is updated daily. Upstream publication and a successful refresh affect when changes become available. Check /last_updated for the last successful database download timestamp (Unix seconds, UTC).
Do I need a Shodan API key?
No. You can use the CVEDB API without a Shodan account or API key.

Single-record lookups

CVE: `/cve/{cve_id}`

curl -X 'GET' \
  'https://cvedb.shodan.io/cve/CVE-2025-8960?format=json' \
  -H 'accept: application/json'

Returns one JSON object. Upstream-backed values may be null when unavailable.

Field	Description
`cve_id`	CVE identifier.
`summary`	Human-readable vulnerability description.
`cvss`	Highest available CVSS score, preferring v4, then v3, then v2.
`cvss_version`	Version used for `cvss`.
`cvss_v2`, `cvss_v3`, `cvss_v4`	Individual version-specific CVSS scores.
`epss`	EPSS probability from 0 to 1, estimating exploitation likelihood over the next 30 days.
`ranking_epss`	Relative EPSS ranking from 0 to 1.
`kev`	Whether the CVE is listed in Known Exploited Vulnerabilities data.
`propose_action`	Proposed mitigation/action when supplied by the source.
`ransomware_campaign`	Ransomware campaign information when supplied by the source.
`references`	Reference URLs associated with the CVE.
`cpes`	Affected CPE 2.3 identifiers.
`published_time`	Source publication date-time for the CVE.
`euvd`	Optional nested EUVD record; fields are listed below.
`ghsa`	Optional nested GHSA record; fields are listed below.

EUVD: `/euvd/{euvd_id}`

Looks up one EUVD entry, for example EUVD-2024-16003. The response has EUVD fields at the top level and linked CVE and GHSA objects nested under cve and ghsa when available. The identifier is case-insensitive; no query parameters are required.

curl -X 'GET' \
  'https://cvedb.shodan.io/euvd/EUVD-2024-16003' \
  -H 'accept: application/json'

Field	Description
`id`	EUVD identifier.
`description`	Vulnerability description published by EUVD.
`published_time`	EUVD publication date-time.
`cvss`	EUVD CVSS base score, from 0 to 10.
`cvss_version`	CVSS version used for the EUVD base score.
`epss`	EPSS score recorded by EUVD, from 0 to 1.
`assigner`	Organization that assigned the EUVD entry.
`references`	Reference links listed in the EUVD entry.
`products`	Products listed in the EUVD entry.
`vendors`	Vendors listed in the EUVD entry.
`cve`	Optional nested CVE record.
`ghsa`	Optional nested GitHub Security Advisory record.

GHSA: `/ghsa/{ghsa_id}`

Looks up one GHSA entry, for example GHSA-wcwp-r3fj-mm3p. The response has GHSA fields at the top level and linked CVE and EUVD objects nested under cve and euvd when available. The identifier is case-insensitive; no query parameters are required.

curl -X 'GET' \
  'https://cvedb.shodan.io/ghsa/GHSA-wcwp-r3fj-mm3p' \
  -H 'accept: application/json'

Field	Description
`id`	GitHub Security Advisory identifier.
`summary`	Short advisory summary.
`details`	Full advisory description.
`published_time`	Advisory publication date-time.
`modified_time`	Advisory last-modified date-time.
`withdrawn_time`	Advisory withdrawal date-time, when applicable.
`severity`	Severity records supplied by GHSA.
`affected`	Affected packages and version ranges.
`references`	Advisory reference links and types.
`cwe_ids`	Associated CWE identifiers.
`github_severity`	GitHub's advisory severity rating.
`github_reviewed`	Whether GitHub reviewed the advisory.
`github_reviewed_at`	Date-time of the GitHub review.
`euvd`	Optional nested EUVD record.
`cve`	Optional nested CVE record.

Search endpoints

CVE search: `/cves`

Search by CPE 2.3 or product; do not supply both. Supports pagination, publication-date filtering, KEV filtering, EPSS sorting, and count-only mode.

cpe23, product (optional): Search key; use one, not both.
count (default false): Return match count only.
is_kev (default false): Restrict results to KEV entries.
sort_by_epss (default false): Sort by descending EPSS; otherwise sort by publication time.
skip (default 0), limit (default 1000): Pagination controls.
start_date, end_date (optional): Publication-date bounds, formatted YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS.
format (default json): Response format, such as JSON or Markdown.

curl -X 'GET' \
  'https://cvedb.shodan.io/cves?cpe23=cpe%3A2.3%3Aa%3Alibpng%3Alibpng%3A0.8&count=false&is_kev=false&sort_by_epss=false&skip=0&limit=1000&format=json' \
  -H 'accept: application/json'

curl -X 'GET' \
  'https://cvedb.shodan.io/cves?product=nginx&count=false&is_kev=true&sort_by_epss=true&skip=0&limit=1000&format=json' \
  -H 'accept: application/json'

CPE search: `/cpes`

Returns CPE identifiers associated with a required product.

product (required): Product name.
count (default false): Return the number of matching CPE groups.
skip (default 0), limit (default 1000): Pagination controls.
format (default json): Response format, such as JSON or Markdown.

curl -X 'GET' \
  'https://cvedb.shodan.io/cpes?product=nginx&count=false&skip=0&limit=1000&format=json' \
  -H 'accept: application/json'

For current response models and parameter defaults, see the interactive OpenAPI reference.

CVEDB

Frequently Asked Questions

Single-record lookups

CVE: /cve/{cve_id}

EUVD: /euvd/{euvd_id}

GHSA: /ghsa/{ghsa_id}