dbcve.org — CVE data

Free, no-key access to CVE intelligence: base vulnerability data derived from the NVD, enriched by dbcve.org with plain-English technical summaries, mitigations, weakness context, and PoC / patch links.

JSON API — versioned, CORS-open, no sign-up.
Bulk CSV — regenerated nightly, served as static files.
Auto-downloader — download.sh, safe to cron.
Licence — CC-BY-4.0. Use it anywhere; just credit dbcve.org with a link.

Everything here is derived from public data and provided for defensive and informational use. Always verify against the referenced primary sources before acting.

Quick start

# one CVE, fully enriched
curl "https://dbcve.org/api/v1/cve/CVE-2026-48908/"

# this week's highest-severity CVEs
curl "https://dbcve.org/api/v1/latest/"

# grab the whole enriched dataset as CSV
curl -O "https://dbcve.org/api/v1/export/enriched.csv"

# or keep a local copy in sync (only downloads when it changes)
./download.sh

JSON API

Base URL: https://dbcve.org/api/v1

No API key. Responses are JSON (Content-Type: application/json) and send Access-Control-Allow-Origin: *, so you can call them directly from a browser app. Every response includes an attribution block. Trailing slashes are optional.

Endpoints

Method & path	Description
`GET /api/v1/`	Machine-readable index of the endpoints below
`GET /api/v1/cves/`	Paginated, filterable list of CVEs
`GET /api/v1/cve/{id}/`	A single CVE — record, enrichment, CWEs, references
`GET /api/v1/latest/`	The week's highest-severity CVEs (CVSS-ranked)
`GET /api/v1/kev/`	Most recent actively-exploited (CISA KEV) CVEs
`GET /api/v1/export/cves.csv`	Bulk core records (CSV)
`GET /api/v1/export/enriched.csv`	Bulk enriched CVEs (CSV)

Query parameters

For GET /api/v1/cves/:

Param	Values	Default	Notes
`severity`	`critical` \| `high` \| `medium` \| `low`	—	Exact tier
`vendor`	slug, e.g. `apache`	—	Matches the affected vendor
`kev`	`1`	—	Actively-exploited (CISA KEV) only
`days`	integer	—	Published within the last N days
`q`	text	—	Keyword / CVE-ID search
`status`	`complete` \| `developing` \| `pending`	—	Enrichment status
`sort`	`newest` \| `oldest` \| `cvss` \| `priority`	`newest`	`priority` puts KEV first
`page`	integer	`1`	1-based
`limit`	1–100	`50`	Page size

latest and kev accept limit (max 50).

Response shape

List endpoints return meta + data + attribution:

{
  "meta": { "total": 1745, "page": 1, "pages": 35, "per_page": 50 },
  "data": [
    {
      "cve_id": "CVE-2026-48908",
      "severity": "CRITICAL",
      "cvss": 9.8,
      "cvss_version": "3.1",
      "kev": true,
      "published": "2026-06-20",
      "vendor": "ollyo",
      "product": "sp_page_builder",
      "description": "A vulnerability in SP Page Builder for Joomla allows ...",
      "url": "https://dbcve.org/cve/CVE-2026-48908"
    }
  ],
  "attribution": {
    "source": "dbcve.org",
    "license": "CC-BY-4.0",
    "terms": "Base CVE data derived from NVD (public domain). dbcve.org enrichment is CC-BY-4.0 — attribution to dbcve.org required.",
    "docs": "https://dbcve.org/api"
  }
}

The detail endpoint (/api/v1/cve/{id}/) adds enrichment, cwes and references:

{
  "data": {
    "cve_id": "CVE-2026-48908",
    "severity": "CRITICAL",
    "cvss": 9.8,
    "cvss_version": "3.1",
    "kev": true,
    "published": "2026-06-20",
    "vendor": "ollyo",
    "product": "SP Page Builder",
    "description": "…",
    "url": "https://dbcve.org/cve/CVE-2026-48908",
    "enrichment": {
      "status": "complete",
      "summary": "Unauthenticated file upload leading to PHP execution …",
      "mitigation": "Restrict uploads and validate file types; update to a patched release.",
      "confidence": "high",
      "poc_url": "https://…",
      "patch_commit_url": "https://…"
    },
    "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type" } ],
    "references": [ { "url": "https://…", "tags": ["Vendor Advisory"] } ]
  },
  "attribution": { "…": "…" }
}

Errors return a JSON body with an error key and the matching HTTP status (404 not found, 405 method not allowed).

Bulk CSV export

Prefer these over paginating the JSON when you want the whole dataset. They're regenerated nightly and served as static files, and they support conditional requests (If-Modified-Since → 304 Not Modified) so a scheduled downloader transfers nothing on days the data didn't change.

https://dbcve.org/api/v1/export/cves.csv
https://dbcve.org/api/v1/export/enriched.csv

All fields are UTF-8; the first row is a header. Free-text fields (description, summary, mitigation) are whitespace-collapsed and RFC-4180 quoted.

`cves.csv`

Core records for the catalogue.

Column	Type	Notes
`cve_id`	string	e.g. `CVE-2026-48908`
`severity`	string	`CRITICAL` \| `HIGH` \| `MEDIUM` \| `LOW`
`cvss`	number	CVSS base score, `0.0`–`10.0`
`cvss_version`	string	e.g. `3.1`
`kev`	`0` / `1`	On the CISA Known Exploited Vulnerabilities list
`published`	date	`YYYY-MM-DD`
`vendor`	string	Affected vendor slug (may be empty)
`product`	string	Affected product slug (may be empty)
`description`	string	Official NVD description

`enriched.csv`

Only CVEs that have dbcve.org enrichment.

Column	Type	Notes
`cve_id`	string
`severity`	string
`cvss`	number
`kev`	`0` / `1`
`published`	date	`YYYY-MM-DD`
`product`	string
`summary`	string	Plain-English technical summary
`mitigation`	string	Suggested remediation direction
`confidence`	string	`high` \| `medium` \| `low`
`poc_url`	string	Proof-of-concept link, if found (may be empty)
`patch_commit_url`	string	Patch / fix commit, if found (may be empty)

Auto-downloader

download.sh keeps a local copy of the CSVs in sync. It uses a conditional GET, so it only rewrites a file when the server's copy is newer — ideal for a nightly cron. POSIX sh + curl, nothing else.

chmod +x download.sh

./download.sh                          # into ./data
DEST=/opt/cve ./download.sh            # a custom directory
FILES="enriched.csv" ./download.sh     # only some files
BASE=https://dbcve.org ./download.sh   # (default host)

Nightly cron:

0 6 * * * cd /opt/dbcve-cve-data && ./download.sh >> /var/log/dbcve-download.log 2>&1

It prints updated: / unchanged: per file and exits non-zero if any fetch failed, so it's safe to wire into a pipeline.

Code examples

Python (with pandas):

import pandas as pd
df = pd.read_csv("https://dbcve.org/api/v1/export/enriched.csv")
kev = df[df.kev == 1].sort_values("cvss", ascending=False)
print(kev[["cve_id", "cvss", "summary"]].head())

Python (JSON API):

import requests
r = requests.get("https://dbcve.org/api/v1/cves/",
                 params={"severity": "critical", "kev": 1, "limit": 100})
for cve in r.json()["data"]:
    print(cve["cve_id"], cve["cvss"], cve["url"])

JavaScript (browser / Node 18+):

const res = await fetch("https://dbcve.org/api/v1/latest/");
const { data } = await res.json();
data.forEach(c => console.log(`#${c.cve_id} ${c.severity} ${c.cvss}`));

PHP:

$json = file_get_contents('https://dbcve.org/api/v1/cve/CVE-2026-48908/');
$cve  = json_decode($json, true)['data'];
echo $cve['enrichment']['summary'] ?? '(not enriched yet)';

Field reference

Severity — the CVSS v3.x qualitative tier: CRITICAL (9.0–10.0), HIGH (7.0–8.9), MEDIUM (4.0–6.9), LOW (0.1–3.9).
kev — the CVE appears on CISA's Known Exploited Vulnerabilities catalogue. Treat these as urgent: they're being exploited in the wild.
enrichment.status — complete (reviewed), developing (published very recently; authoritative data still settling), pending (queued for enrichment).
confidence — dbcve.org's confidence in the generated summary/mitigation.
poc_url / patch_commit_url — best-effort links discovered during enrichment; may be empty. Absence does not guarantee no fix exists — check the references.

Freshness & fair use

New CVEs are ingested from the NVD daily; enrichment and the CSV exports refresh on a nightly cycle. The API is cached at the edge — please cache responses on your side too, and for bulk use pull the CSVs (with the conditional-GET downloader) rather than crawling the paginated JSON. There's no hard rate limit, but hammering the endpoints may get an IP throttled. Be kind and it stays open for everyone.

Licence & attribution

Released under CC-BY-4.0. You're free to use, adapt and redistribute — even commercially — provided you credit dbcve.org with a link back to https://dbcve.org, and indicate if you changed anything. Base CVE data originates from the NVD and remains in the public domain.

Questions, corrections, or a project you built on this? Open an issue — we'd love to see it.

Name		Name	Last commit message	Last commit date
LICENSE		LICENSE
README.md		README.md
download.sh		download.sh

Navigation Menu

Repository files navigation

dbcve.org — CVE data

Contents

Quick start

JSON API

Endpoints

Query parameters

Response shape

Bulk CSV export

`cves.csv`

`enriched.csv`

Auto-downloader

Code examples

Field reference

Freshness & fair use

Licence & attribution

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

dbcve.org — CVE data

Contents

Quick start

JSON API

Endpoints

Query parameters

Response shape

Bulk CSV export

cves.csv

enriched.csv

Auto-downloader

Code examples

Field reference

Freshness & fair use

Licence & attribution

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`cves.csv`

`enriched.csv`