---
id: nvdlib
version: "0.8.3"
license: MIT
license_treatment: permissive
maintenance: aging
---

# nvdlib — National Vulnerability Database CPE/CVE API Library for Python

License: permissive · Maintenance: aging · Downloads: 169.2K/mo

## What it is and what it does

NVDlib is a Python wrapper around the NIST National Vulnerability Database API that lets you query CVEs and CPEs programmatically and work with the results as structured Python objects. It handles the HTTP communication with the NVD, parses responses, and enforces rate limiting according to NIST recommendations—6 seconds between requests by default, or faster with an API key. The library supports searching CVEs by ID, keywords, severity, CVSS score, publication date, and CPE name, as well as searching CPE records and retrieving associated vulnerability IDs.

The package is designed for developers who need to integrate vulnerability data into security tools, compliance workflows, or risk assessment pipelines. It abstracts away the details of the NVD API protocol and response format, letting you focus on the security logic. The built-in rate limiting means you can run queries without manually managing delays, though you'll need a free API key from NIST to get the faster rate.

Use it for:

- Scan a list of installed packages against the NVD to identify known CVEs affecting your software supply chain.
- Build a security dashboard that retrieves and displays the latest high-severity vulnerabilities by keyword or CPE.
- Automate compliance checks by querying CVE severity scores and CVSS vectors for risk assessment reports.
- Integrate vulnerability data into a CI/CD pipeline to flag dependencies with critical security issues.
- Research a specific CVE by ID to pull its full description, severity rating, and affected CPE names.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Wrapper library for the NIST National Vulnerability Database API that retrieves CVEs and CPEs as Python objects with built-in rate limiting.

Yes, if you need programmatic access to NIST vulnerability data. The library has low install friction, permissive licensing, and no known vulnerabilities. The aging maintenance status (last commit 373 days ago) is a minor concern but not a blocker since the NVD API itself is stable. Requires Python 3.11.0+. Get a free NIST API key to avoid the 6-second default rate limit.

## Install

pip install nvdlib
uv add nvdlib
poetry add nvdlib

## Installing nvdlib

Before you install: Low install friction with a single runtime dependency (requests). Maintenance status is aging—last commit was 2025-08-06, over 373 days from release, though the repository remains active and not archived.

License in practice: MIT license permits unrestricted use, modification, and distribution with minimal obligations—suitable for commercial and private projects.

Quickstart:

pip install nvdlib

import nvdlib
r = nvdlib.searchCVE(cveId='CVE-2021-26855')[0]
print(r.v31severity, r.v31score)

Requires Python 3.11.0 or later. NIST NVD API key recommended for faster rate limiting (default is 6 seconds between requests).

Verify before relying:

- Whether the library supports all NVD API v2 parameters beyond the examples shown in the description.
- Current state of CPE search functionality and whether it reliably retrieves associated CVE IDs.
- Performance characteristics when querying large result sets or running repeated searches.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 169.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

NIST NVD API wrapper, CVE vulnerability lookup, CPE search library, vulnerability database client, NIST vulnerability data, CVE severity scoring, security vulnerability API, vulnerability-management, security-scanning, nist-nvd

[View on SkillFed](https://skillfed.io/packages/nvdlib) · [View on PyPI](https://pypi.org/project/nvdlib/)