2023-04-27 15:02:47 +02:00
# nvd-json-data-feeds
2023-04-24 14:55:30 +02:00
Community reconstruction of the soon-to-be deprecated JSON NVD Data Feeds.
2023-05-17 08:57:59 +00:00
[Releases ](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest ) each day at 00:00 AM UTC.
2023-04-27 16:00:24 +02:00
Repository synchronizes with the NVD every 2 hours.
2023-04-24 14:55:30 +02:00
2023-04-27 16:00:24 +02:00
## Repository at a Glance
2023-04-24 14:55:30 +02:00
2023-04-27 16:00:24 +02:00
### Last Repository Update
2023-04-24 14:55:30 +02:00
```plain
2023-07-25 20:00:33 +00:00
2023-07-25T20:00:29.768653+00:00
2023-04-24 14:55:30 +02:00
```
2023-04-27 16:00:24 +02:00
### Most recent CVE Modification Timestamp synchronized with NVD
2023-04-24 14:55:30 +02:00
```plain
2023-07-25 20:00:33 +00:00
2023-07-25T19:55:53.177000+00:00
2023-04-24 14:55:30 +02:00
```
2023-04-27 16:00:24 +02:00
### Last Data Feed Release
2023-04-24 14:55:30 +02:00
2023-05-17 08:57:59 +00:00
Download and Changelog: [Click ](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest )
2023-04-24 14:55:30 +02:00
```plain
2023-07-25 02:00:29 +00:00
2023-07-25T00:00:13.559776+00:00
2023-04-24 14:55:30 +02:00
```
2023-04-27 16:00:24 +02:00
### Total Number of included CVEs
2023-04-24 14:55:30 +02:00
2023-04-27 15:02:47 +02:00
```plain
2023-07-25 20:00:33 +00:00
221008
2023-04-24 14:55:30 +02:00
```
2023-04-27 16:00:24 +02:00
### CVEs added in the last Commit
2023-04-24 14:55:30 +02:00
2023-07-25 20:00:33 +00:00
Recently added CVEs: `15`
* [CVE-2023-2626 ](CVE-2023/CVE-2023-26xx/CVE-2023-2626.json ) (`2023-07-25T18:15:10.690` )
* [CVE-2023-34235 ](CVE-2023/CVE-2023-342xx/CVE-2023-34235.json ) (`2023-07-25T18:15:10.800` )
* [CVE-2023-35929 ](CVE-2023/CVE-2023-359xx/CVE-2023-35929.json ) (`2023-07-25T18:15:10.897` )
* [CVE-2023-35941 ](CVE-2023/CVE-2023-359xx/CVE-2023-35941.json ) (`2023-07-25T18:15:10.993` )
* [CVE-2023-35942 ](CVE-2023/CVE-2023-359xx/CVE-2023-35942.json ) (`2023-07-25T19:15:11.050` )
* [CVE-2023-35943 ](CVE-2023/CVE-2023-359xx/CVE-2023-35943.json ) (`2023-07-25T19:15:11.153` )
* [CVE-2023-35944 ](CVE-2023/CVE-2023-359xx/CVE-2023-35944.json ) (`2023-07-25T19:15:11.240` )
* [CVE-2023-35980 ](CVE-2023/CVE-2023-359xx/CVE-2023-35980.json ) (`2023-07-25T19:15:11.327` )
* [CVE-2023-35981 ](CVE-2023/CVE-2023-359xx/CVE-2023-35981.json ) (`2023-07-25T19:15:11.410` )
* [CVE-2023-35982 ](CVE-2023/CVE-2023-359xx/CVE-2023-35982.json ) (`2023-07-25T19:15:11.480` )
* [CVE-2023-36806 ](CVE-2023/CVE-2023-368xx/CVE-2023-36806.json ) (`2023-07-25T19:15:11.550` )
* [CVE-2023-36826 ](CVE-2023/CVE-2023-368xx/CVE-2023-36826.json ) (`2023-07-25T19:15:11.640` )
* [CVE-2023-39128 ](CVE-2023/CVE-2023-391xx/CVE-2023-39128.json ) (`2023-07-25T19:15:11.740` )
* [CVE-2023-39129 ](CVE-2023/CVE-2023-391xx/CVE-2023-39129.json ) (`2023-07-25T19:15:11.800` )
* [CVE-2023-39130 ](CVE-2023/CVE-2023-391xx/CVE-2023-39130.json ) (`2023-07-25T19:15:11.857` )
2023-07-01 02:00:32 +00:00
2023-07-04 02:00:31 +00:00
2023-07-06 06:00:29 +00:00
### CVEs modified in the last Commit
2023-07-06 04:00:49 +00:00
2023-07-25 20:00:33 +00:00
Recently modified CVEs: `65`
* [CVE-2023-31819 ](CVE-2023/CVE-2023-318xx/CVE-2023-31819.json ) (`2023-07-25T19:03:18.877` )
* [CVE-2023-31820 ](CVE-2023/CVE-2023-318xx/CVE-2023-31820.json ) (`2023-07-25T19:03:34.687` )
* [CVE-2023-31822 ](CVE-2023/CVE-2023-318xx/CVE-2023-31822.json ) (`2023-07-25T19:03:50.593` )
* [CVE-2023-31825 ](CVE-2023/CVE-2023-318xx/CVE-2023-31825.json ) (`2023-07-25T19:04:20.037` )
* [CVE-2023-3690 ](CVE-2023/CVE-2023-36xx/CVE-2023-3690.json ) (`2023-07-25T19:09:50.323` )
* [CVE-2023-3686 ](CVE-2023/CVE-2023-36xx/CVE-2023-3686.json ) (`2023-07-25T19:11:35.773` )
* [CVE-2023-3687 ](CVE-2023/CVE-2023-36xx/CVE-2023-3687.json ) (`2023-07-25T19:11:50.817` )
* [CVE-2023-3684 ](CVE-2023/CVE-2023-36xx/CVE-2023-3684.json ) (`2023-07-25T19:12:31.023` )
* [CVE-2023-3683 ](CVE-2023/CVE-2023-36xx/CVE-2023-3683.json ) (`2023-07-25T19:12:48.627` )
* [CVE-2023-22033 ](CVE-2023/CVE-2023-220xx/CVE-2023-22033.json ) (`2023-07-25T19:23:31.577` )
* [CVE-2023-22008 ](CVE-2023/CVE-2023-220xx/CVE-2023-22008.json ) (`2023-07-25T19:23:57.457` )
* [CVE-2023-22007 ](CVE-2023/CVE-2023-220xx/CVE-2023-22007.json ) (`2023-07-25T19:24:25.677` )
* [CVE-2023-22005 ](CVE-2023/CVE-2023-220xx/CVE-2023-22005.json ) (`2023-07-25T19:24:46.737` )
* [CVE-2023-21950 ](CVE-2023/CVE-2023-219xx/CVE-2023-21950.json ) (`2023-07-25T19:25:20.693` )
* [CVE-2023-22053 ](CVE-2023/CVE-2023-220xx/CVE-2023-22053.json ) (`2023-07-25T19:26:36.587` )
* [CVE-2023-22048 ](CVE-2023/CVE-2023-220xx/CVE-2023-22048.json ) (`2023-07-25T19:26:57.163` )
* [CVE-2023-22046 ](CVE-2023/CVE-2023-220xx/CVE-2023-22046.json ) (`2023-07-25T19:27:45.300` )
* [CVE-2023-22038 ](CVE-2023/CVE-2023-220xx/CVE-2023-22038.json ) (`2023-07-25T19:28:07.100` )
* [CVE-2023-3685 ](CVE-2023/CVE-2023-36xx/CVE-2023-3685.json ) (`2023-07-25T19:28:29.557` )
* [CVE-2023-22054 ](CVE-2023/CVE-2023-220xx/CVE-2023-22054.json ) (`2023-07-25T19:30:25.787` )
* [CVE-2023-22056 ](CVE-2023/CVE-2023-220xx/CVE-2023-22056.json ) (`2023-07-25T19:30:37.157` )
* [CVE-2023-22057 ](CVE-2023/CVE-2023-220xx/CVE-2023-22057.json ) (`2023-07-25T19:30:48.877` )
* [CVE-2023-22058 ](CVE-2023/CVE-2023-220xx/CVE-2023-22058.json ) (`2023-07-25T19:33:36.430` )
* [CVE-2023-29984 ](CVE-2023/CVE-2023-299xx/CVE-2023-29984.json ) (`2023-07-25T19:45:53.773` )
* [CVE-2023-3595 ](CVE-2023/CVE-2023-35xx/CVE-2023-3595.json ) (`2023-07-25T19:55:53.177` )
2023-04-24 14:55:30 +02:00
## Download and Usage
There are several ways you can work with the data in this repository:
### 1) Release Data Feed Packages
2023-05-24 12:00:30 +00:00
The most straightforward approach is to obtain the latest Data Feed release packages [here ](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest ).
2023-04-24 14:55:30 +02:00
2023-04-27 16:00:24 +02:00
Each day at 00:00 AM UTC we package and upload JSON files that aim to reconstruct the legacy NVD CVE Data Feeds.
2023-04-24 14:55:30 +02:00
Those are aggregated by the `year` part of the CVE identifier:
```
# CVE-<YEAR>.json
CVE-1999.json
CVE-2001.json
CVE-2002.json
CVE-2003.json
[...]
CVE-2023.json
```
2023-04-27 15:02:47 +02:00
We also upload the well-known `Recent` and `Modified` feeds.
Furthermore, we provide the `All` feed, which contains a recent snapshot of all NVD records.
2023-04-27 16:00:24 +02:00
Once your local copy is synchronized and the last synchronization is no older than 8 days, you can rely on these to stay up to date:
2023-04-24 14:55:30 +02:00
```plain
CVE-Recent.json # CVEs that were added in the previous eight days
CVE-Modified.json # CVEs that were modified or added in the previous eight days
```
2023-04-27 16:00:24 +02:00
Note that all feeds are distributed in `xz` -compressed format to save storage and bandwidth.
2023-04-24 14:55:30 +02:00
For decompression execute:
```sh
xz -d -k < feed > .json.xz
```
#### Automation using Release Data Feed Packages
2023-04-27 16:00:24 +02:00
You can fetch the latest releases for each package with the following static link layout:
2023-04-24 14:55:30 +02:00
```sh
2023-04-27 15:02:47 +02:00
https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest/download/CVE-< YEAR > .json.xz
2023-04-24 14:55:30 +02:00
```
Example:
```sh
2023-04-27 15:02:47 +02:00
wget https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest/download/CVE-2023.json.xz
2023-04-24 14:55:30 +02:00
xz -d -k CVE-2023.json.xz
```
2023-04-27 16:00:24 +02:00
### 2) Clone the Repository (with Git History)
2023-04-24 14:55:30 +02:00
2023-04-27 16:00:24 +02:00
As you can see by browsing this repository, there is a slight difference between the release packages format and the repository folder structure.
2023-04-24 14:55:30 +02:00
This is because we want to maintain explorability of the dataset.
2023-04-27 16:00:24 +02:00
Each CVE gets its own JSON file, e.g., `CVE-1999-0001.json` .
2023-04-24 14:55:30 +02:00
Here, each file is put into a folder layout that first sorts by CVE `year` identifier part and then by `number` part.
2023-04-27 16:00:24 +02:00
We mask (`xx` ) the last two digits to create easily navigable folders that hold a maximum of 100 CVE JSON files:
2023-04-24 14:55:30 +02:00
```plain
.
├── CVE-1999
│ ├── CVE-1999-00xx
│ │ ├── CVE-1999-0001.json
│ │ ├── CVE-1999-0002.json
│ │ └── [...]
│ ├── CVE-1999-01xx
2023-04-25 17:08:25 +02:00
│ │ ├── CVE-1999-0101.json
│ │ └── [...]
2023-04-24 14:55:30 +02:00
│ └── [...]
├── CVE-2000
│ ├── CVE-2000-00xx
│ ├── CVE-2000-01xx
│ └── [...]
└── [...]
```
2023-04-27 16:00:24 +02:00
A byproduct of managing and continuously updating this dataset via Git is that we can track changes over time through the Git history.
2023-04-24 14:55:30 +02:00
2023-04-27 16:00:24 +02:00
If you are interested in having the NVD data as organized above, including the historical data of changes, just clone this repository (large!):
2023-04-24 14:55:30 +02:00
```sh
2023-04-27 15:02:47 +02:00
git clone https://github.com/fkie-cad/nvd-json-data-feeds.git
2023-04-24 14:55:30 +02:00
```
2023-04-27 16:00:24 +02:00
### 3) Clone the Repository (without Git History)
2023-04-24 14:55:30 +02:00
Don't need the history? Then create a shallow copy:
```sh
2023-04-27 15:02:47 +02:00
git clone --depth 1 -b main https://github.com/fkie-cad/nvd-json-data-feeds.git
2023-04-24 14:55:30 +02:00
```
## Motivation
2023-04-27 16:00:24 +02:00
As of September 2023, the NIST will retire all [JSON-based NVD Data Feeds ](https://nvd.nist.gov/vuln/data-feeds#divRetirementBanner-1 ).
2023-04-24 14:55:30 +02:00
The new [NVD CVE API 2.0 ](https://nvd.nist.gov/developers/vulnerabilities ) is, without a doubt, a great way to obtain CVE information.
However, we from [Fraunhofer FKIE - Cyber Analysis and Defense ](https://www.fkie.fraunhofer.de/en/departments/cad.html ) believe that the API does not cover a variety of use cases.
The legacy NVD Data Feeds provided a convenient way to quickly obtain a complete, file-based offline database snapshot; just download the `CVE-<YEAR>.tar.gz` , decompress it, and use it as you please, e.g.:
2023-04-27 16:00:24 +02:00
* Put the JSON feed into a document-based database and quickly leverage upon that data in your software project, ...
2023-04-24 14:55:30 +02:00
* Parse and analyze it using your favorite programming language, ...
* Put it on a USB stick and transfer it to a system without internet access, or ...
* Query the file using `jq` !
2023-04-27 16:00:24 +02:00
Unfortunately, the new NVD API 2.0 adds complexity to this process.
2023-04-24 14:55:30 +02:00
We want to preserve ease of use by reconstructing these data sources.
## Non-Endorsement Clause
This project uses and redistributes data from the NVD API but is not endorsed or certified by the NVD.