The CVE Search API: A New Way to Access CVE Records

The CVE™ Program is introducing a new CVE Search API designed to make vulnerability information easier to find, easier to reuse, and easier to integrate into automated workflows. CVE Record information is already available for users through two channels: CVE List Search on the CVE website, and CVE List Downloads, the CVE Program's bulk download capability on GitHub.

Both remain important parts of the CVE information distribution architecture. The new CVE Search API is intended to complement those capabilities by adding a modern, real-time, programmatic way to query the CVE List with precision.

Why a Search API Now?

As vulnerability reporting volumes continue to grow, so does the need for faster and more precise access to CVE data. Security teams, researchers, product vendors, and downstream integrations increasingly depend on automation to triage, enrich, and act on vulnerability information at scale. The new CVE Search API is being introduced to help meet that need. It is being designed to support precise searches across all CVE Record containers, enabling users to retrieve targeted vulnerability information quickly and accurately. Rather than replace existing access methods, it adds an important new option for users who need low-latency programmatic access to CVE data.

The CVE Program's GitHub repository remains the right place for bulk access and download-oriented workflows. The cve.org website remains the primary interactive experience for browsing and discovering CVE Records as a human user. The new Search API adds a third capability for precise programmatic search through the API for automation and integration.

The technology behind the API has been built with long-term reliability and scalability in mind. This matters because many users are no longer just reading CVE information one record at a time. They are feeding it into dashboards, asset pipelines, prioritization tools, security analytics, and response processes. A dedicated API helps support that reality.

What Value a CVE Search API Will Bring

The CVE Program is committed to continually improving the quality, completeness, and efficient retrievability of the data available. The Search API is focused on making CVE information more usable in modern security operations and software workflows.

With this new capability, users are able to:

• Run repeatable searches from applications and automated processes
• Combine filters such as weakness types, severity, exploitation indicators, dates, and other record attributes
• Scope their searches across the multiple CVE Record containers with greater precision
• Receive complete JSON CVE Records as result

Popular use cases may include:

• Searching for HIGH and CRITICAL in cvssV4Severity and cvssV3_1Severity
• Searching for the principal SSVC fields (ssvcTechnicalImpact, ssvcAutomatable, and ssvcExploitation)
• Searching by cweId (e.g., to find weakness examples)

Because of the limitations of data within CVE Records, not all of the documented search types currently provide data that is operationally viable. There will be fewer of these limitations in later iterations. It is also possible that, depending on community interest, the Search API will draw upon data elements contributed by organizations that partner with the CVE Program.

In practical terms, this means users are now able to move beyond simple keyword discovery and ask more focused questions of the CVE data they rely on every day.

Available Now: BETA Release and Practical Use

The BETA CVE Search API is being initially released as an open capability with no identification or authentication requirements. However, it includes service limits designed to support reliable and responsible use. The service returns complete CVE Records, along with documented paging behavior and explicit warnings where needed which will give integrators a clear, predictable contract for building against the API.

The BETA test period — scheduled to run October 13, 2026, through December 31, 2026 — is intended to give the community an opportunity to evaluate the capability.

Users are encouraged to begin experimenting with the API now, with the understanding that they are helping shape how it grows. Feedback on missing data, unexpected search behavior, or desired filters will directly inform the roadmap for enhancing both the technology and the completeness of the information it exposes.

Resources:

• CVE Search API Documentation (Swagger Docs)
• CVE Search API Source Code (GitHub)
• CVE Search API Feedback (Issue Tracker on GitHub)

Looking Ahead

The introduction of the CVE Search API reflects a broader goal of making high-quality CVE information easier to access, easier to search precisely, and easier to operationalize at scale.

In the near term, users should expect a series of enhancements and adjustments to the Search API behavior, as we review community feedback and deploy improvements rapidly.

As the vulnerability landscape grows more complex, the CVE ecosystem must continue to support both human users and automated systems. By complementing the GitHub repository and the cve.org website search experience, the new Search API is designed to strengthen the way CVE information is distributed and consumed across the global cybersecurity community — starting with a solid technical foundation today and evolving toward more complete and powerful data access tomorrow.