NIST API: Search vulnerabilities
Finds known vulnerabilities (CVEs) in the NVD that match a product or vendor name, newest first. Each CVE is flagged when it is in CISA's known exploited catalog.
Unofficial. Not affiliated with or endorsed by NIST.
Inputs
Values from the run on Oct 23, 2026, shown under Output.
- Product, required
product Product and/or vendor name, such as Apache Tomcat.
Apache Tomcat
- Severity optional
severity Severity to include, such as critical; any includes unrated flaws.
any (default)
One of
any,low,medium,high,critical.- Max Results optional
max_results Maximum number of results, such as 20 (up to 100).
20 (default)
Whole number from 1 to 100.
- Published After optional
published_after Include vulnerabilities published on or after this date (YYYY-MM-DD), such as 2025-01-01.
Not set
Input as JSON
{ "product": "Apache Tomcat"}Output
{ "vulnerabilities": [ { "nvd_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-93446" , "severity": "Unknown", "cve_number": "CVE-2026-93446", "cvss_score": null, "description": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 o…", "published_date": "2026-10-20", "affected_versions": "Apache Software Foundation Apache Tomcat: from 11.0.0-M21 through 11.0.26; Apache Software Foundation Apache Tomcat: from 10.1.25 through 10.1.60; Apache Software Foundation Apache Tomcat: from 9.0.90 through 9.0.122", "known_exploited_in_the_wild": false }, { "nvd_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-88041" , "severity": "Unknown", "cve_number": "CVE-2026-88041", "cvss_score": null, "description": "Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.\n\n\n\nUsers are recommended to upg…", "published_date": "2026-10-20", "affected_versions": "Apache Software Foundation Apache Tomcat: from 11.0.0-M23 through 11.0.26; Apache Software Foundation Apache Tomcat: from 10.1.27 through 10.1.60; Apache Software Foundation Apache Tomcat: from 9.0.92 through 9.0.122", "known_exploited_in_the_wild": false }, { "nvd_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-80353" , "severity": "Unknown", "cve_number": "CVE-2026-80353", "cvss_score": null, "description": "Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same…" , "published_date": "2026-10-20", "affected_versions": "Apache Software Foundation Apache Tomcat: from 9.0.47 through 9.0.122", "known_exploited_in_the_wild": false } ]}Code
curl https://api.fous.com/v1/runs \ -H "Authorization: Bearer $FOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"method":"nvd.nist.gov/search_vulnerabilities","input":{"product":"Apache Tomcat"}}' # Save as fous.py, then run: python3 fous.pyimport json, os, timefrom urllib.error import HTTPErrorfrom urllib.request import Request, urlopenAPI = "https://api.fous.com/v1/runs" KEY = os.environ["FOUS_API_KEY"]HEADERS = { "Authorization": f"Bearer {KEY}", "Content-Type": "application/json" ,}def call(url, body=None): data = json.dumps(body).encode() if body else None request = Request(url, data, HEADERS) try: with urlopen(request, timeout=120) as r: return r.status, json.load(r) except HTTPError as error: message = json.load(error)["error"]["message"] raise RuntimeError(message) from errorstatus, run = call(API, { "method": "nvd.nist.gov/search_vulnerabilities" , "input": { "product": "Apache Tomcat" }})# 202: still going after 30 s. Ask again until it ends.while status == 202: time.sleep(2) status, run = call(f"{API}/{run['id']}")print(json.dumps(run["data"], indent=2))// Save as fous.mjs, then run: node fous.mjsconst api = "https://api.fous.com/v1/runs" ;const headers = { Authorization: `Bearer ${process.env.FOUS_API_KEY}`, "Content-Type": "application/json" ,};let response = await fetch(api, { method: "POST", headers, body: JSON.stringify({ "method": "nvd.nist.gov/search_vulnerabilities" , "input": { "product": "Apache Tomcat" } }), signal: AbortSignal.timeout(120_000),});let run = await response.json();// 202: still going after 30 s. Ask again until it ends.while (response.status === 202) { await new Promise((done) => setTimeout(done, 2_000)); response = await fetch(`${api}/${run.id}`, { headers }); run = await response.json();}if (!response.ok) throw new Error(run.error.message);console.log(run.data);# Connect your agent to Fous once, over MCP (Streamable HTTP):# https://api.fous.com/mcp# Set FOUS_API_KEY first: create a key at https://app.fous.com/keys.# Claude Codeclaude mcp add \ --scope user \ --transport http fous https://api.fous.com/mcp \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Codexcodex mcp add fous \ --url https://api.fous.com/mcp \ --bearer-token-env-var FOUS_API_KEY# Cursor, VS Code, Windsurf, Cline and morenpx -y add-mcp https://api.fous.com/mcp -g -n fous \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Then ask your agent:# "Use Fous to run nvd.nist.gov/search_vulnerabilities# with {"product":"Apache Tomcat"}"Over HTTP, the answer’s data holds the output. A run still going after 30 seconds answers 202 with its id: ask GET /v1/runs/{id} until it ends.
Schema
Input schema
{ "type": "object", "required": [ "product" ], "properties": { "product": { "type": "string", "minLength": 1, "description": "Product and/or vendor name, such as Apache Tomcat." }, "severity": { "enum": [ "any", "low", "medium", "high", "critical" ], "type": "string", "default": "any", "description": "Severity to include, such as critical; any includes unrated flaws." }, "max_results": { "type": "integer", "default": 20, "maximum": 100, "minimum": 1, "description": "Maximum number of results, such as 20 (up to 100)." }, "published_after": { "type": "string", "description": "Include vulnerabilities published on or after this date (YYYY-MM-DD), such as 2025-01-01." } }}Output schema
{ "type": "object", "required": [ "vulnerabilities" ], "properties": { "vulnerabilities": { "type": "array", "items": { "type": "object", "required": [ "cve_number", "severity", "cvss_score", "description", "published_date", "affected_versions", "known_exploited_in_the_wild", "nvd_link" ], "properties": { "nvd_link": { "type": "string" }, "severity": { "type": "string" }, "cve_number": { "type": "string" }, "cvss_score": { "type": [ "number", "null" ] }, "description": { "type": [ "string", "null" ] }, "published_date": { "type": "string" }, "affected_versions": { "type": [ "string", "null" ] }, "known_exploited_in_the_wild": { "type": "boolean" } } } } }}- Price
- 1 credit per completed run (1¢ with pay as you go); failed runs are free.
- Method
nvd.nist.gov/search_vulnerabilities- Returns
- CVE number, severity, CVSS score, description, published date, affected versions, known-exploited flag, NVD link
Use it from your agent
Give your agent this line. It reads SKILL.md, gets a Fous API key and connects the Fous MCP server. Its run then takes the method nvd.nist.gov/search_vulnerabilities with the inputs above.
Ask your agent
- Show me the latest critical CVEs affecting Apache Tomcat published since 2025-01-01, up to 15 results.
- Are there any known exploited vulnerabilities in OpenSSL? List the newest ones with CVSS scores.
- Find high severity flaws for Microsoft Exchange Server from nist.gov, limit to 10 results.
- List every unrated vulnerability tied to the vendor Cisco published after 2024-06-01.
- Search the NVD for medium and higher issues in Fortinet FortiOS, returning 50 results newest first.
See more
All NIST methodsLooks up one CVE on the National Vulnerability Database and returns its description, CVSS score and vector, attack conditions, weakness number, affected products, exploitation flag, dates and references.
nvd.nist.gov/get_vulnerabilityFinds recorded data breaches whose title or website domain matches a company or website name, newest first.
haveibeenpwned.com/search_breachesFinds U.S. consumer product recalls matching a product type or brand, newest first, with hazards, remedies, incidents, sale details and photos when published.
cpsc.gov/search_recallsLists NHTSA safety recalls for a vehicle model, given a model year, make and model or a 17-character VIN. Results cover the model, not whether a specific car has been repaired.
nhtsa.gov/check_recallsFinds NIH research grants by topic, organisation, or researcher name. Searches the last five fiscal years by default.
reporter.nih.gov/search_grantsFinds FDA drug enforcement recalls by medicine or company name, newest first, with status, class, reason and quantity. Recent recalls may not yet appear.
open.fda.gov/search_drug_recallsSearches USAspending federal awards by keywords, awarding agency, state of performance and date across contracts, grants, loans and direct payments. Searches from October 1, 2007 onward.
usaspending.gov/search_federal_awardsFinds FDA food recall enforcement reports by product, brand, or allergen, newest first. Reports are updated weekly and recall statuses may lag.
open.fda.gov/search_food_recalls