Feed

Schema version

cve-export-24. JSON files state it in "schema_version"; CSV files use the column names listed below for this version. A change of meaning or format gets a new schema version.

CSV layout

UTF-8 with BOM, CRLF line endings, a header row and one row per CVE with its current state only (no Timeline or EPSS history columns).

Unknown values in CSV

Yes/no facts (for example rce, kev_listed, known_exploitation, fix_available) are true or false when known and an empty cell when Unknown: Unknown is never written as false, No or 0. Numbers and dates are an empty cell when not available, never 0. A readable list column (values separated by "; ") is empty when nothing is listed; when the field also has a detailed JSON column (for example cwes next to cwe_ids), that column holds [] for a known empty list.

Unknown values in JSON

Every yes/no fact (for example summary.rce, summary.indicators, kev.listed, known_exploitation, exploit_available, fix_available and the by-product values) is one of the strings "yes", "no" or "unknown": Unknown is "unknown", never "no", false or null. Other selected values that are not available are null, never 0. Unselected fields are omitted, and [] is a known empty list.

Numbers and scales

Dot decimals without exponent. cvss_base_score is on a 0–10 scale; epss_probability and epss_percentile are on a 0–1 scale (0.05 = 5%). Bands and severities are text.

Dates

ISO 8601 instants in UTC (ending in Z), or YYYY-MM-DD when the source only gives a day.

Products and relations

Readable columns keep each value with its product ("Product: value; Other product: value"). Detailed columns (for example affected_products, cvss_assessments, remediations, references) hold compact JSON in one quoted cell, with ids and the product each value belongs to.

Published texts not shown on the page

Every published text and measure is exported, including those the CVE page and the PDF leave out: in other_texts and remediations each entry has display "page" or "export_only", and an export-only entry has a hidden_reason: "translation" (a text in another language from a publisher that does not own the product, when the CVE has an English description), "regional_summary" (a summary of a national CERT in its own language, same condition), "publisher_boilerplate" (fixed sentences a publisher adds to every entry), "placeholder" (a text that says nothing), "shown_structured" (a text the page shows as a structured value: the CNA's impact line "CAPEC-100 Overflow Buffers" is the attack pattern) or "non_english_title" (a title in another language from a publisher that does not own the product, when the product is known: the CVE then uses the "CVE ID · product" title). Texts are exported as published: Markdown stays Markdown.

Status qualifiers

affected_products.subjects[].status_qualifiers (CSV column status_qualifiers) lists what the publishers state next to a product's status: kind, code, label (our English wording), since (the day it was stated), version (a package version as published), text (the publisher's own words, only for sources published in full) and sources. end_of_life is true when a current statement puts the product or release out of security support (absent otherwise, never false). A code outside these lists is never exported. Not-affected reasons: component_not_present ("Component not present"), vulnerable_code_not_present ("Vulnerable code not present"), vulnerable_code_not_in_execute_path ("Vulnerable code not in the execute path"), vulnerable_code_cannot_be_controlled_by_adversary ("Vulnerable code cannot be controlled by an adversary"), inline_mitigations_already_exist ("Inline mitigations already exist"), code_not_compiled ("Vulnerable code not compiled"), uses_system_library ("Uses the system copy of the library"), see_notes ("See the publisher's notes"), as_published ("Reason as published"), never_affected ("Never affected in this release"). Fix states: fix_deferred ("Fix deferred"), no_fix_planned ("No fix planned (will not fix)"), out_of_support ("No fix: out of support"); a publisher may word a fix state its own way (Debian: "Fix postponed to a later update or point release"). No-fix reasons of remediation measures (no_fix_reason): will_not_fix ("No fix planned (the vendor will not fix)"), out_of_support ("No fix: out of support"), not_yet_available ("No fix available yet"). Publisher classifications (kind publisher_classification, code = the value as published): RustSec's informational advisories, unsound ("RustSec classification: unsound (informational advisory)"), unmaintained ("RustSec classification: unmaintained (informational advisory)"), notice ("RustSec classification: notice (informational advisory)"); never a status or a fix state.

Spreadsheet formula protection

A CSV text cell that starts with =, +, -, @ (or their full-width forms), possibly after spaces or double quotes, or that starts with a tab or a carriage return, is prefixed with a single quote (') so spreadsheet software does not run it as a formula. Spreadsheets that split a line on ";" (the list separator of many locales, used when a CSV is opened by double-click), on tabs or on line breaks can also start a cell inside a text cell, so a ' is also inserted right after each ";", tab or line break that is followed (after any spaces or double quotes) by one of those characters, and cells containing ";" or a tab are quoted. When you process the CSV as data you can remove that ' (at the start of the cell and right after those separators), but a ' that the published text already had at such a place is kept as it is, so it cannot always be told apart from an inserted one (for example, the published texts x;=1 and x;'=1 are both written x;'=1). Use the JSON export when you need every text exactly as published: values in JSON files are never changed. In the JSON columns of the CSV a ";" is written as the JSON escape \u003b, which reads back as the same value.

Spreadsheet cell size

Cells are never shortened: every CSV cell holds its whole value. Spreadsheet programs limit what one cell can hold (Microsoft Excel: 32,767 characters), and a cell can be longer, mostly a detailed JSON column (for example affected_products or references) of a CVE with many products, versions or references. Opening such a file in a spreadsheet program can cut that cell or spread its end over other cells, although the file itself is complete. Read such files with a CSV or JSON parser, or use the JSON export.

Advisory-wide sources

A source in a "sources" list can carry advisory_wide (advisory_id, vulnerability_count): the publisher made that statement once for all the vulnerabilities of that advisory, and it applies to each of them. Readable CSV cells built from such a statement add "(advisory-wide, N vulnerabilities)".

Source pages and record links

Each source of a CVE lists its public pages (source_pages in the CSV; pages in JSON, each with a label and a kind: record, advisory, catalogue or resource) and when the source says it first published and last modified what it states (first_published, last_modified; null when it does not say). The URLs the source records were read from (APIs, JSON, CSAF or OSV files) are only in the JSON export (record_urls), never in a CSV cell. Each attribution in a "sources" list names the original publisher's role (publisher_role: vendor, cna, cisa, nvd…). In the CSV every publisher of the CVE List (an attribution, a version's published_by, its sources_detail entry) is the CNA's organization name (Cisco Systems, Inc.), where the CVE record names the CNA by its CVE short name (cisco, kept in the cna_name column), and an attribution of NVD that names the CVE's CNA by its CVE Program organization id (or the e-mail NVD uses for older CNAs) gives the CNA's organization name as its publisher, the cna_org_id column keeping the id; the JSON export keeps each publisher as the source states it. In the JSON export an attribution's url is the URL the value was read from; in the CSV it is the page people read for it: the URL itself when it is such a page, otherwise the source's page for the CVE that record belongs to (for example the CVE.org record for the CVE List API, the NVD detail page for the NVD API, the BSI advisory page for its CSAF file), or null when the source offers none. Every other link of a CSV cell (a measure, a resource, a detail row) follows the References rule: a machine-readable file is null and a raw GitHub file is given as its GitHub page. Published texts are never edited: an address a publisher wrote in its text stays as written. One exception in the CSV: the link markup of Cisco's texts (an address in brackets and quotes after its words) is read as on the CVE page and in the PDF: a link to a page people read is written as its address in brackets, a link to another section of Cisco's page and a link to a machine-readable file are left out; the JSON export keeps the texts as published.

Per-record licences

Most sources publish every record under one licence, named in their attribution. When single records of a source declare another licence (RustSec entries imported from GHSA under CC BY 4.0 in a CC0 database), the source lists them in record_licenses (sources_detail and JSON): the licence as published, its URL when published and the ids of the records that declare it (record_keys).

Vendor and distribution severity ratings

vendor_severity and severity_ratings hold each publisher's own rating on its own scale, as published (Microsoft "Important", BSI "mittel" shown as "Medium (mittel)", a distribution priority). They are not CVSS severities and never change the priority, filters or the main CVSS. applies_to says whether a rating is about the CVE, some products, or a whole advisory that may list several vulnerabilities.

Timeline details

With the Timeline, each entry carries details: what it changed in detail, as lists of items added and removed (label, link, publishers, date, the product it is about) and values changed (field, before, after). They hold codes, not wording: kind is a measure type (fixed_release, update, code_patch, workaround, mitigation, vendor_guidance, no_fix), a reference group (vendor_advisory, official, other) or a product kind; roles are resource roles (exploitation_poc, exploit_module, vulnerability_check, scanner_coverage, hunting_rule, forensic_guidance, advisory, related_resource); a changed field such as facts.rce or kev.forensic_triage_required has yes, no or unknown (never read unknown as no), affected_products.status a product status. Long texts are cut at 2,000 characters, lists at 100 items (truncated counts the rest; facts.fixed_versions_truncated counts the fixed versions left out of a very long item). A References item may carry facts.cited_by, the resources that cite the link ([{publisher, resource_type}], e.g. Metasploit module). details is null for entries recorded before this schema version, for withheld entries, when a text it quotes comes from a source that is no longer published in full, and when there is nothing more to show than the sentence.

CWE publishers and attack patterns (CAPEC)

cwe_publishers names who publishes each CWE ("CWE-79: Palo Alto Networks, NVD"), so a CWE of the CNA and a different one of NVD can be told apart. capec_ids and attack_patterns hold the CAPEC attack patterns the CNA names (id, the name as published, its page on capec.mitre.org): context only, never used for the priority or filters. The CNA's impact line that only names the pattern ("CAPEC-100 Overflow Buffers") stays in other_texts with display "export_only" and hidden_reason "shown_structured" (shown on the page as the attack pattern).

Credits and disclosure dates

credits (JSON cve.credits) lists who found, reported, coordinated or fixed the vulnerability as the publishers credit them: names and roles only, never e-mail addresses, profiles, handles or user ids, and none from a source published as facts and link. date_public and date_reserved are the CNA's own dates (when it says the vulnerability was made public, when the CVE ID was reserved) and disclosure_timeline its timeline as published; they never replace the Published date, which keeps deciding the Feed and the filters. rejected_date is when the CNA rejected the record. advisories (JSON references.advisories) gives the version and revision history of each source advisory; revision summaries in another language from a publisher that does not own the product (the German summaries of BSI) are kept here but left off the CVE page (summaries_display "export_only").

Related identifiers and withdrawn advisories

related_identifiers lists each identifier of the CVE once, however many sources list it (the same GHSA id from GitHub, OSV.dev, ENISA EUVD and the CNA is one entry), with its strongest relation, a readable label and the sources that list it (publishers). An advisory its publisher withdrew keeps its entry with withdrawn (the date, as published) and withdrawn_by (who withdrew it): the advisory no longer counts for anything else, and another source that still lists it stays in publishers. related_identifier_ids gives the identifiers alone. An advisory of a European CSIRT that ENISA EUVD lists from a source we do not read (NCSC-NL) is an entry with listed_by ["ENISA EUVD"]: only its identifier and link, never its title or text.

Exploitation statements

known_exploitation is true when an admitted source reports attacks (CISA KEV, a vendor's "aware of active exploitation", read with fixed rules) or ENISA EUVD lists the CVE as exploited, and false only when a source states, on a date, that it knows of no exploitation (for example "not aware of any malicious exploitation"): never proof that there is none. exploitation_statements lists these statements with who made them, when and the rule that read them (read_by); unread_exploitation_statements keeps the statements no rule reads, as published. A statement that proof-of-concept code is public is an exploit indication (kind vendor_statement), never a public exploit. euvd_exploited_since and exploitation_signals: ENISA EUVD lists the CVE as exploited since that day without stating its source; since 4 Oct 2026 that listing counts as known exploitation (counted true), never as a CISA KEV listing (kev_listed).

Vendor assessments and customer action

vendor_exploitability (JSON exploitation_and_checks.vendor_assessments) holds each vendor's own assessment: whether the vulnerability was publicly disclosed when the vendor published, and Microsoft's Exploitability Index for the latest and older software releases (exploitation_more_likely, exploitation_less_likely, exploitation_unlikely, exploitation_detected, not_applicable), which is a forecast, not a report of attacks. None of them changes known_exploitation, exploit_available, the priority or the filters, and publicly_disclosed true is not a public exploit. customer_action_required (JSON remediation.customer_action) is true or false as the vendor states it (Microsoft's "Customer Action"); empty when not stated; it never changes fix_available.

Source repositories and fix commits

An affected entry published only as a git repository (an OSV GIT range without a package or product: the OSV conversion of the CVE record, the PSF, OSS-Fuzz) is listed under the product whose CVE record or GitHub advisory names the same repository, matched exactly (never by name); otherwise it is named "Git repository <host/path>" (github.com/decolua/9router), no longer "Unidentified product". affected_products.subjects[].repositories lists the source repositories its publishers name, as https URLs (scheme, "www.", ".git" and a trailing "/" dropped; lower-case on github.com and gitlab.com); absent when none. A code patch target that names a fix commit (note "Fix commit <hash> in <repo>") has commit_url, the commit page on GitHub, GitLab, git.kernel.org or Gitiles (absent for other hosts), and a commit several sources publish is listed once, in a measure whose sources are exactly the sources that list it (the commits they all list together; official measures first): a source is never given for a commit it does not list.

Versions and fixes read from vendor texts

An affected range with a lower bound and no upper bound always names its release line in affected_versions: "≥ 8.9.0 (branch 8.9); fixed version not listed for this branch" when its publisher lists no fixed version for that line (Atlassian: the fixed version is unknown there, never "no fix"; JSON fixed_version_unlisted), "7.4: ≥ 7.4.0" otherwise. A fixed version that only a third party states, never the product owner, names who states it in fixed_versions: "2.8.0 · JVN iPedia (IPA) (not from the product owner)" (JSON fixed_versions keeps the bare version, fixed_versions_display the marked one); it never makes fix_available true. tracking_issues lists the tracking issues still open ("Kubernetes: open"), which say nothing about whether a fix is available. cwe_placeholders lists NVD-CWE-Other / NVD-CWE-noinfo with who states them (JVN's "CWE-Other" included): not weaknesses, never in cwe_ids.

Vendor guidance and scope notes

vendor_detection_guidance (JSON hunting_and_forensics.vendor_guidance) holds what a vendor publishes for investigating suspected exploitation, as published (Cisco's "Indicators of Compromise" and "Recommendations"): a recommendation to investigate does not confirm a compromise, and none of it is read as evidence of exploitation. vendor_scope_notes (JSON affected_products.vendor_scope_notes) holds the products a vendor states are not affected, as published (Cisco's "Products Confirmed Not Vulnerable"); no product is given a status from it. product_list_complete (JSON affected_products.product_list_complete) says whether the vendor states its own list of affected products is complete; empty when not stated.

JSON

An envelope with schema_version, generated_at, query (filters, time zone, period, snapshot), count, coverage and items (one per CVE). Timeline and EPSS history are added only with their checkboxes.

Complete files

An export of up to 1,000 CVEs downloads at once and is written while it downloads. Its X-Export-Count response header gives the number of CVEs in the file: a complete CSV file has exactly that many data rows after the header row, one per CVE (count them with a CSV parser, as a quoted cell can hold line breaks), and a complete JSON file parses and holds that many items, the number its "count" states. A file with fewer rows or items, or a JSON file that does not parse, was interrupted while downloading: request it again. Larger exports are prepared in the background and offered for download only once the file is complete.

Fields

Machine-readable field reference (JSON)