# NIST API: Get vulnerability by CVE number > Looks up one CVE on the National Vulnerability Database and returns its description, CVSS score and vector, attack conditions, weakness number, affected products, exploitation flag, dates and references. Unofficial. Not affiliated with or endorsed by NIST. - Page: https://fous.com/methods/nvd.nist.gov/get-vulnerability - Method: `nvd.nist.gov/get_vulnerability`, version 1 - Website: nvd.nist.gov - Returns: description, severity, CVSS score and vector, attack method, weakness number, affected products, known exploitation, dates, references - Effect: read (it gets data and changes nothing) - Sign-in: none needed - Cost: 1 credit per completed run (1ยข with pay as you go); failed runs are free - Verified: Nov 2, 2026 ## Inputs | Field | Type | Required | In the run below | Description | |---|---|---|---|---| | `cve_number` | string | yes | `"2023-23397"` | The vulnerability number, such as CVE-2021-44228, 2021-44228, or cve-2021-44228. | ## Output From a run on Oct 23, 2026, shortened. Its input: ```json { "cve_number": "2023-23397" } ``` Its output: ```json { "nvd_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-23397", "severity": "Critical", "cve_number": "CVE-2023-23397", "cvss_score": 9.8, "cwe_number": "CWE-294", "references": [ { "link": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397", "source": "secure@microsoft.com" }, { "link": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23397", "source": "www.cisa.gov" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Microsoft Outlook Elevation of Privilege Vulnerability", "cvss_version": "3.1", "attack_method": "over the network, no login needed, no user action", "weakness_type": null, "published_date": "2023-03-14", "affected_products": [ "Microsoft 365 apps: version unspecified", "Microsoft office: version 2019", "Microsoft office long term servicing channel: version 2021" ], "last_modified_date": "2026-06-17", "known_exploited_in_the_wild": true } ``` ## Run it From code, with a Fous API key in `FOUS_API_KEY`; the answer's `data` holds the output: ```bash curl https://api.fous.com/v1/runs \ -H "Authorization: Bearer $FOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"method":"nvd.nist.gov/get_vulnerability","input":{"cve_number":"2023-23397"}}' ``` From an AI agent connected to the Fous MCP server: its `run` with the same method and input. To connect one, give it `set up https://fous.com/SKILL.md`. ## Ask your agent - What is the CVSS score and attack vector for CVE-2021-44228? - Show me the description and affected products for cve-2022-22965. - Has CVE-2017-0144 been actively exploited in the wild, and what are its dates? - Give me the weakness number (CWE) and reference links for CVE-2019-0708 on the NVD. - Look up 2023-34362 and tell me its severity rating and which software versions are impacted. ## Input schema ```json { "type": "object", "required": [ "cve_number" ], "properties": { "cve_number": { "type": "string", "description": "The vulnerability number, such as CVE-2021-44228, 2021-44228, or cve-2021-44228." } }, "additionalProperties": false } ``` ## Output schema ```json { "type": "object", "required": [ "cve_number", "description", "severity", "cvss_score", "cvss_version", "attack_method", "weakness_type", "published_date", "last_modified_date", "affected_products", "known_exploited_in_the_wild", "references", "nvd_link", "cvss_vector", "cwe_number" ], "properties": { "nvd_link": { "type": "string" }, "severity": { "type": [ "string", "null" ] }, "cve_number": { "type": "string" }, "cvss_score": { "type": [ "number", "null" ] }, "cwe_number": { "type": [ "string", "null" ], "x-fous-developer": true }, "references": { "type": "array", "items": { "type": "object", "required": [ "source", "link" ], "properties": { "link": { "type": "string" }, "source": { "type": "string" } }, "additionalProperties": false } }, "cvss_vector": { "type": [ "string", "null" ], "x-fous-developer": true }, "description": { "type": [ "string", "null" ] }, "cvss_version": { "type": [ "string", "null" ] }, "attack_method": { "type": [ "string", "null" ] }, "weakness_type": { "type": [ "string", "null" ] }, "published_date": { "type": [ "string", "null" ] }, "affected_products": { "type": "array", "items": { "type": "string" } }, "last_modified_date": { "type": [ "string", "null" ] }, "known_exploited_in_the_wild": { "type": "boolean" } }, "additionalProperties": false } ``` ## See more - [NIST API: Search vulnerabilities](https://fous.com/methods/nvd.nist.gov/search-vulnerabilities.md): Finds known vulnerabilities (CVEs) in the NVD that match a product or vendor name, newest first. Each CVE is flagged when it is in CISA's known exploited catalog. - [CDC API: Get disease facts](https://fous.com/methods/cdc.gov/get-disease-facts.md): Gets CDC facts about a disease by name, including symptoms, how it spreads, prevention, treatment and higher-risk groups when covered. A review date is returned only when CDC labels one. - [NHTSA API: Check vehicle recalls](https://fous.com/methods/nhtsa.gov/check-recalls.md): Lists NHTSA safety recalls for a vehicle model, given a model year, make and model or a 17-character VIN. Results cover the model, not whether a specific car has been repaired. - [NIH API: Get chemical facts by name or CAS number](https://fous.com/methods/pubchem.ncbi.nlm.nih.gov/get-chemical.md): Looks up a chemical on PubChem by common name or CAS number and returns its formula, molecular weight, names, description, SMILES, InChIKey and 2D structure image link. - [CPSC API: Search product recalls](https://fous.com/methods/cpsc.gov/search-recalls.md): Finds U.S. consumer product recalls matching a product type or brand, newest first, with hazards, remedies, incidents, sale details and photos when published. - [HHS API: Get provider by NPI](https://fous.com/methods/npiregistry.cms.hhs.gov/get-provider.md): Looks up a provider in the NPI Registry by 10-digit NPI number and returns the public name, specialties, addresses, contact details and registry dates. - [Have I Been Pwned API: Search breaches](https://fous.com/methods/haveibeenpwned.com/search-breaches.md): Finds recorded data breaches whose title or website domain matches a company or website name, newest first. - [NIH API: Search grants](https://fous.com/methods/reporter.nih.gov/search-grants.md): Finds NIH research grants by topic, organisation, or researcher name. Searches the last five fiscal years by default. - [All NIST methods](https://fous.com/methods/nist.gov.md)