CVE (Common Vulnerabilities and Exposures) List: coverage and access

What it covers

Geography and granularity

Geography: Use the geography stated by the source; coverage can vary by dataset and release.

Granularity: Build vulnerability intelligence, dependency-risk views, security-content research, or alerting products by normalizing CVE identifiers, descriptions, affected products, and update history.

Source type: Vulnerability and security database

Potential use

Build vulnerability intelligence, dependency-risk views, security-content research, or alerting products by normalizing CVE identifiers, descriptions, affected products, and update history. Strong fit for developer-tool and data-product founders building software supply-chain, AppSec, compliance, or security-observability features.

Access and cost

Web, download, or API

Public website access plus downloadable CVE JSON archives; the official download page points to release assets generated from the CVE Services API. Treat the published terms of use and archive mechanics as authoritative.

Cost: Current price was not established in this review; check the provider's access terms.

Update cadence: Release cadence was not normalized in this review; check the source's dates, update notes, and API limits before comparing periods.

• Provider page ↗
• Documentation and access details ↗Check the provider's current terms and instructions before use

Interpret carefully

Limits that affect the decision

CVE records are vulnerability identifiers and descriptions, not a complete exploitability or remediation service; legacy CSV, HTML, XML, and CVRF downloads are no longer supported, and coverage/timing depends on CVE record publication.

Release cadence was not normalized in this review; check the source's dates, update notes, and API limits before comparing periods.

This record summarizes source documentation; Jon Bishop did not conduct an independent audit of the underlying dataset.