nvdlib

What it is and what it does

NVDlib is a Python wrapper around the NIST National Vulnerability Database API that lets you query CVEs and CPEs programmatically and work with the results as structured Python objects. It handles the HTTP communication with the NVD, parses responses, and enforces rate limiting according to NIST recommendations—6 seconds between requests by default, or faster with an API key. The library supports searching CVEs by ID, keywords, severity, CVSS score, publication date, and CPE name, as well as searching CPE records and retrieving associated vulnerability IDs.

The package is designed for developers who need to integrate vulnerability data into security tools, compliance workflows, or risk assessment pipelines. It abstracts away the details of the NVD API protocol and response format, letting you focus on the security logic. The built-in rate limiting means you can run queries without manually managing delays, though you'll need a free API key from NIST to get the faster rate.

Use it for:

• Scan a list of installed packages against the NVD to identify known CVEs affecting your software supply chain.
• Build a security dashboard that retrieves and displays the latest high-severity vulnerabilities by keyword or CPE.
• Automate compliance checks by querying CVE severity scores and CVSS vectors for risk assessment reports.
• Integrate vulnerability data into a CI/CD pipeline to flag dependencies with critical security issues.
• Research a specific CVE by ID to pull its full description, severity rating, and affected CPE names.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Wrapper library for the NIST National Vulnerability Database API that retrieves CVEs and CPEs as Python objects with built-in rate limiting.

Yes, if you need programmatic access to NIST vulnerability data. The library has low install friction, permissive licensing, and no known vulnerabilities. The aging maintenance status (last commit 373 days ago) is a minor concern but not a blocker since the NVD API itself is stable. Requires Python 3.11.0+. Get a free NIST API key to avoid the 6-second default rate limit.

Install

nvdlib on PyPI

pip install nvdlib

uv add nvdlib

poetry add nvdlib

Installing nvdlib

Before you install

Low install friction with a single runtime dependency (requests). Maintenance status is aging—last commit was 2025-08-06, over 373 days from release, though the repository remains active and not archived.

License in practice

MIT license permits unrestricted use, modification, and distribution with minimal obligations—suitable for commercial and private projects.

Quickstart

pip install nvdlib

import nvdlib
r = nvdlib.searchCVE(cveId='CVE-2021-26855')[0]
print(r.v31severity, r.v31score)

Requires Python 3.11.0 or later. NIST NVD API key recommended for faster rate limiting (default is 6 seconds between requests).

Verify before relying

• Whether the library supports all NVD API v2 parameters beyond the examples shown in the description.
• Current state of CPE search functionality and whether it reliably retrieves associated CVE IDs.
• Performance characteristics when querying large result sets or running repeated searches.

Package facts

Evidence: nvdlib-0.8.3-py3-none-any.whl

Tags

More Security packages