nvd-json-data-feeds/README.md

# nvd-json-datafeeds

Community reconstruction of the soon-to-be deprecated JSON NVD Data Feeds. 
[Releases](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest) each day at 00:00 AM UTC.
Repository synchronizes with the NVD in 2 hour periods.

## Repository at a glance

### Last repository update

```plain
2023-04-27T08:00:28.423840+00:00
```

### Most recent CVE modification timestamp synchronized with NVD

```plain
2023-04-27T05:15:08.807000+00:00
```

### Last Data Feed release

Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest)

```plain
2023-04-27T00:00:20.965588+00:00
```

### Total numbers of included CVEs

```plai#n
213652
```

### CVEs added in the last commit

Recently added CVEs: `0`



### CVEs modified in the last commit

Recently modified CVEs: `1`

* CVE-2023-31290 (*2023-04-27T05:15:08.807*)


## Download and Usage

There are several ways you can work with the data in this repository:

### 1) Release Data Feed Packages

The most straightforward approach is to obtain the latest Data Feed release packages [here](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest).

Each day on 02:00 AM UTC we package and upload json files that aim to reconstruct the legacy NVD CVE Data Feeds.
Those are aggregated by the `year` part of the CVE identifier:

```
# CVE-<YEAR>.json
CVE-1999.json
CVE-2001.json
CVE-2002.json
CVE-2003.json
[...]
CVE-2023.json
```

Furthermore, we also upload the well-known `Recent` and `Modified` feeds.
Once your local copy is synced and the last sync was no older than 8 days, you can rely on these to stay up to date:

```plain
CVE-Recent.json   # CVEs that were added in the previous eight days
CVE-Modified.json # CVEs that were modified or added in the previous eight days
```

Note that all feeds are distributed in `xz`-compressed format to save storage and bandwidth on Github.
For decompression execute:

```sh
xz -d -k <feed>.json.xz
```


#### Automation using Release Data Feed Packages

You can fetch the latest releases for each package using the following static link layout:

```sh
https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-<YEAR>.json.xz
```

Example:

```sh
wget https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-2023.json.xz
xz -d -k CVE-2023.json.xz
```

### 2) Clone the repository (with git history)

As you can see by browsing this repository, there is a slight difference between the release packages format and the repo folder structure.
This is because we want to maintain explorability of the dataset.

Each CVE gets its own json file, e.g., `CVE-1999-0001.json`.
Here, each file is put into a folder layout that first sorts by CVE `year` identifier part and then by `number` part.
We mask (`xx`) the last two digits to create easily navigable folders that hold a maximum of 100 CVE jsons:

```plain
.
├── CVE-1999
│   ├── CVE-1999-00xx
│   │   ├── CVE-1999-0001.json
│   │   ├── CVE-1999-0002.json
│   │   └── [...]
│   ├── CVE-1999-01xx
│   │   ├── CVE-1999-0101.json
│   │   └── [...]
│   └── [...]
├── CVE-2000
│   ├── CVE-2000-00xx
│   ├── CVE-2000-01xx
│   └── [...]
└── [...]
```

A byproduct of managing and continuously updating this dataset via git is that we can track changes over time through the git history.

If you are interested in having the NVD data as organized above, including the historical data of changes, just clone this repo (large!):

```sh
git clone https://github.com/fkie-cad/nvd-json-datafeeds.git
```

### 3) Clone the repository (without git history)

Don't need the history? Then create a shallow copy:

```sh
git clone --depth 1 -b main https://github.com/fkie-cad/nvd-json-datafeeds.git
```

## Motivation

As of Sept. 2023, the NIST will retire all [json-based NVD Data Feeds](https://nvd.nist.gov/vuln/data-feeds#divRetirementBanner-1).
The new [NVD CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities) is, without a doubt, a great way to obtain CVE information.
However, we from [Fraunhofer FKIE - Cyber Analysis and Defense](https://www.fkie.fraunhofer.de/en/departments/cad.html) believe that the API does not cover a variety of use cases.

The legacy NVD Data Feeds provided a convenient way to quickly obtain a complete, file-based offline database snapshot; just download the `CVE-<YEAR>.tar.gz`, decompress it, and use it as you please, e.g.:

* Put the json feed into a document-based database and quickly leverage upon that data in your software project, ...
* Parse and analyze it using your favorite programming language, ...
* Put it on a USB stick and transfer it to a system without internet access, or ...
* Query the file using `jq`!

Unfortunately, the new NVD API 2.0 puts complexity into this process.
We want to preserve ease of use by reconstructing these data sources.

## Non-Endorsement Clause

This project uses and redistributes data from the NVD API but is not endorsed or certified by the NVD.