Data source
Data from National Vulnerability Database (NIST), delivered clean.
1 dataset pulled from National Vulnerability Database (NIST)'s releases, checked field by field and shipped the way you want them — daily, weekly, or hourly, your call.
- 1 dataset
- 1 industry
- Real rows on request
What Datadory delivers from National Vulnerability Database (NIST)
1NVD CVE & CPE Data Feeds and APIs
Pick a catch, see the rows.
Name any National Vulnerability Database (NIST) dataset and we send real rows from it — not a screenshot of rows. 1,744 datasets. Pick your catch.
Get a sampleAPI, files, or your warehouse. Daily, weekly, or hourly.
Straight answers about National Vulnerability Database (NIST) data
How many CVE records are in the data?
Roughly 381,000 standardized CVE records at the August 2026 read, each carrying CVSS severity metrics, CWE weakness mappings and hierarchical CPE applicability statements, with yearly volumes running from 2002 through the present on one schema.
What is the CPE applicability statement good for?
It is the join between a vulnerability and your inventory. Each record's configurations tree holds OR/AND logic whose leaves are cpeMatch entries with a vulnerable flag and a criteria string naming vendor, product and version range - so "which of our servers is in scope" becomes a string match rather than a prose comprehension test.
How far back does the history go?
2002 through the present, about twenty-four years on one schema. The living-ledger property matters as much as the depth: one sample record was published in April 2019 and still carried a Modified status in June 2026.
Why does vulnStatus matter when analyzing records?
Because the corpus is a ledger, not a press feed. Awaiting Analysis marks records still moving through review, Analyzed marks settled ones, Rejected marks withdrawn entries that should drop out of counts entirely. Screening on status keeps fresh-but-unsettled records from distorting trend lines.