NIST API: Get vulnerability by CVE number
Looks up one CVE on the National Vulnerability Database and returns its description, CVSS score and vector, attack conditions, weakness number, affected products, exploitation flag, dates and references.
Unofficial. Not affiliated with or endorsed by NIST.
Inputs
Values from the run on Oct 23, 2026, shown under Output.
- Cve Number, required
cve_number The vulnerability number, such as CVE-2021-44228, 2021-44228, or cve-2021-44228.
2023-23397
Input as JSON
{ "cve_number": "2023-23397"}Output
{ "nvd_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-23397" , "severity": "Critical", "cve_number": "CVE-2023-23397", "cvss_score": 9.8, "cwe_number": "CWE-294", "references": [ { "link": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397" , "source": "secure@microsoft.com" }, { "link": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23397" , "source": "www.cisa.gov" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" , "description": "Microsoft Outlook Elevation of Privilege Vulnerability", "cvss_version": "3.1", "attack_method": "over the network, no login needed, no user action", "weakness_type": null, "published_date": "2023-03-14", "affected_products": [ "Microsoft 365 apps: version unspecified", "Microsoft office: version 2019", "Microsoft office long term servicing channel: version 2021" ], "last_modified_date": "2026-06-17", "known_exploited_in_the_wild": true}Code
curl https://api.fous.com/v1/runs \ -H "Authorization: Bearer $FOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"method":"nvd.nist.gov/get_vulnerability","input":{"cve_number":"2023-23397"}}' # Save as fous.py, then run: python3 fous.pyimport json, os, timefrom urllib.error import HTTPErrorfrom urllib.request import Request, urlopenAPI = "https://api.fous.com/v1/runs" KEY = os.environ["FOUS_API_KEY"]HEADERS = { "Authorization": f"Bearer {KEY}", "Content-Type": "application/json" ,}def call(url, body=None): data = json.dumps(body).encode() if body else None request = Request(url, data, HEADERS) try: with urlopen(request, timeout=120) as r: return r.status, json.load(r) except HTTPError as error: message = json.load(error)["error"]["message"] raise RuntimeError(message) from errorstatus, run = call(API, { "method": "nvd.nist.gov/get_vulnerability" , "input": { "cve_number": "2023-23397" }})# 202: still going after 30 s. Ask again until it ends.while status == 202: time.sleep(2) status, run = call(f"{API}/{run['id']}")print(json.dumps(run["data"], indent=2))// Save as fous.mjs, then run: node fous.mjsconst api = "https://api.fous.com/v1/runs" ;const headers = { Authorization: `Bearer ${process.env.FOUS_API_KEY}`, "Content-Type": "application/json" ,};let response = await fetch(api, { method: "POST", headers, body: JSON.stringify({ "method": "nvd.nist.gov/get_vulnerability" , "input": { "cve_number": "2023-23397" } }), signal: AbortSignal.timeout(120_000),});let run = await response.json();// 202: still going after 30 s. Ask again until it ends.while (response.status === 202) { await new Promise((done) => setTimeout(done, 2_000)); response = await fetch(`${api}/${run.id}`, { headers }); run = await response.json();}if (!response.ok) throw new Error(run.error.message);console.log(run.data);# Connect your agent to Fous once, over MCP (Streamable HTTP):# https://api.fous.com/mcp# Set FOUS_API_KEY first: create a key at https://app.fous.com/keys.# Claude Codeclaude mcp add \ --scope user \ --transport http fous https://api.fous.com/mcp \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Codexcodex mcp add fous \ --url https://api.fous.com/mcp \ --bearer-token-env-var FOUS_API_KEY# Cursor, VS Code, Windsurf, Cline and morenpx -y add-mcp https://api.fous.com/mcp -g -n fous \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Then ask your agent:# "Use Fous to run nvd.nist.gov/get_vulnerability# with {"cve_number":"2023-23397"}"Over HTTP, the answer’s data holds the output. A run still going after 30 seconds answers 202 with its id: ask GET /v1/runs/{id} until it ends.
Schema
Input schema
{ "type": "object", "required": [ "cve_number" ], "properties": { "cve_number": { "type": "string", "description": "The vulnerability number, such as CVE-2021-44228, 2021-44228, or cve-2021-44228." } }, "additionalProperties": false}Output schema
{ "type": "object", "required": [ "cve_number", "description", "severity", "cvss_score", "cvss_version", "attack_method", "weakness_type", "published_date", "last_modified_date", "affected_products", "known_exploited_in_the_wild", "references", "nvd_link", "cvss_vector", "cwe_number" ], "properties": { "nvd_link": { "type": "string" }, "severity": { "type": [ "string", "null" ] }, "cve_number": { "type": "string" }, "cvss_score": { "type": [ "number", "null" ] }, "cwe_number": { "type": [ "string", "null" ], "x-fous-developer": true }, "references": { "type": "array", "items": { "type": "object", "required": [ "source", "link" ], "properties": { "link": { "type": "string" }, "source": { "type": "string" } }, "additionalProperties": false } }, "cvss_vector": { "type": [ "string", "null" ], "x-fous-developer": true }, "description": { "type": [ "string", "null" ] }, "cvss_version": { "type": [ "string", "null" ] }, "attack_method": { "type": [ "string", "null" ] }, "weakness_type": { "type": [ "string", "null" ] }, "published_date": { "type": [ "string", "null" ] }, "affected_products": { "type": "array", "items": { "type": "string" } }, "last_modified_date": { "type": [ "string", "null" ] }, "known_exploited_in_the_wild": { "type": "boolean" } }, "additionalProperties": false}- Price
- 1 credit per completed run (1¢ with pay as you go); failed runs are free.
- Method
nvd.nist.gov/get_vulnerability- Returns
- description, severity, CVSS score and vector, attack method, weakness number, affected products, known exploitation, dates, references
Use it from your agent
Give your agent this line. It reads SKILL.md, gets a Fous API key and connects the Fous MCP server. Its run then takes the method nvd.nist.gov/get_vulnerability with the inputs above.
Ask your agent
- What is the CVSS score and attack vector for CVE-2021-44228?
- Show me the description and affected products for cve-2022-22965.
- Has CVE-2017-0144 been actively exploited in the wild, and what are its dates?
- Give me the weakness number (CWE) and reference links for CVE-2019-0708 on the NVD.
- Look up 2023-34362 and tell me its severity rating and which software versions are impacted.
See more
All NIST methodsFinds known vulnerabilities (CVEs) in the NVD that match a product or vendor name, newest first. Each CVE is flagged when it is in CISA's known exploited catalog.
nvd.nist.gov/search_vulnerabilitiesGets CDC facts about a disease by name, including symptoms, how it spreads, prevention, treatment and higher-risk groups when covered. A review date is returned only when CDC labels one.
cdc.gov/get_disease_factsLists NHTSA safety recalls for a vehicle model, given a model year, make and model or a 17-character VIN. Results cover the model, not whether a specific car has been repaired.
nhtsa.gov/check_recallsLooks up a chemical on PubChem by common name or CAS number and returns its formula, molecular weight, names, description, SMILES, InChIKey and 2D structure image link.
pubchem.ncbi.nlm.nih.gov/get_chemicalFinds U.S. consumer product recalls matching a product type or brand, newest first, with hazards, remedies, incidents, sale details and photos when published.
cpsc.gov/search_recallsLooks up a provider in the NPI Registry by 10-digit NPI number and returns the public name, specialties, addresses, contact details and registry dates.
npiregistry.cms.hhs.gov/get_providerFinds recorded data breaches whose title or website domain matches a company or website name, newest first.
haveibeenpwned.com/search_breachesFinds NIH research grants by topic, organisation, or researcher name. Searches the last five fiscal years by default.
reporter.nih.gov/search_grants