About CVEminer

A CVE isn't one advisory

The CVE ID names the vulnerability. The package-level detail you act on (which packages, which versions, which fix) mostly lives in GitHub Security Advisories. The two don't map one to one: a CVE can have several GHSAs, a GHSA can exist without a CVE, and unreviewed GHSAs appear on GitHub but not in OSV. Looking up a CVE in one place often gets you part of the picture.

Sources disagree

The CNA, GitHub and CISA can publish different CVSS vectors for the same CVE. OSV and GitHub can list different affected ranges. The commit an OSV range calls “fixed” is sometimes a release commit rather than the patch. A tool that quietly picks one value hides the disagreement from the person deciding what to do.

Provenance matters

When you're deciding whether to patch tonight, it matters whether a value came from the vendor, from GitHub's reviewers, from CISA, or was computed. Every CVEminer record names the source of each section and links the upstream API, so you can check the raw data yourself.

The first time anyone looks up an ID, CVEminer runs five steps and shows each one in the search box as it happens. After that, the stored record loads immediately.

1. 1

   Step 1: Resolve aliases

   For a CVE, CVEminer asks three places at once: OSV's record for the CVE, the GitHub Advisory Database filtered by that CVE, and CVE.org. The GitHub advisories (GHSAs) it finds are ranked: the ones OSV lists as aliases first, then GitHub-reviewed, unreviewed and malware advisories, with withdrawn ones last. The first becomes the headline advisory, and the others stay attached so you can switch between them. For a GHSA, the same happens in reverse: the advisory is loaded first and its CVE, if it has one, is resolved from it.

   The ranking matters because the sources don't cover the same ground. CVE-2024-26581, a Linux kernel netfilter bug, has one GitHub advisory, GHSA-92f7-c7hw-58cr, and it's unreviewed. OSV only carries reviewed GHSAs, so asking OSV alone finds no advisory at all. CVEminer falls back to GitHub's API, finds it, and still uses OSV's record for the CVE itself.

   OSV also lists related advisories, which by its definition are different vulnerabilities. CVE-2023-44487 (HTTP/2 Rapid Reset) has related GHSAs for other projects hit by the same attack. CVEminer links them from the record but never merges them into it.

2. 2

   Step 2: Fetch the advisory

   With the headline GHSA chosen, CVEminer loads its OSV record and its GitHub advisory in parallel. OSV supplies the affected packages, version ranges, enumerated versions and PURLs. GitHub supplies CVSS 3.x and 4.0 scores, CWE names, EPSS, first patched versions, vulnerable functions, credits and whether GitHub has reviewed the advisory.

3. 3

   Step 3: Enrich

   Then it adds what the advisory databases don't carry:

   • CVE.org CVE Services: the CNA's own record, plus CISA's ADP enrichment: the SSVC decision points (exploitation, automatable, technical impact) and a CVSS score where CISA added one.
   • CISA KEV catalog: whether the CVE is known to be exploited, the date it was added, the remediation due date, the required action and known ransomware use.
   • FIRST EPSS: the probability of exploitation in the next 30 days, fetched directly when GitHub's advisory doesn't include it.
   • Fix commits: for up to three patch commits on GitHub, the commit message, lines added and removed, and the files changed.
   • NVD: only when no other source has a CVSS score, which happens mostly with older CVEs.
4. 4

   Step 4: Check and normalise

   Upstream data is kept as published, but checked before it's shown:

   • Scores are computed from vectors. OSV publishes CVSS vectors without numbers, so CVEminer calculates the base score for CVSS 2.0, 3.0, 3.1 and 4.0 itself. Every vector is kept with its source, and the newest CVSS version is the headline, as on GitHub.
   • PURLs are validated against the purl-spec. When OSV has no PURL for a package, CVEminer builds one from the ecosystem and package name and labels it Derived.
   • Junk git tags are dropped. OSV records converted from CVE data can enumerate raw repository tags, such as second_try_with_osgi_giveup, as affected versions. Only tags that look like releases are kept.
   • Patch commits are separated from release commits. For CVE-2026-85058 in moquette-broker, the OSV range's fixed commit e8ce833 is “Version bump 0.18.1”; the change that fixes the bug is e23df01. A commit derived from a version number is listed as a release commit, and the patch is listed first.
5. 5

   Step 5: Store and serve

   The finished record is stored in MongoDB and served from there. When someone views a record more than 24 hours after it was fetched, CVEminer refreshes it from upstream in the background. Analysts can correct any section and publish intelligence. Corrections are stored separately from upstream data, so a refresh never overwrites them, and CVEminer flags an edited section when the upstream value changes afterwards.

CVEminer only uses public sources. Each record's data sources panel shows which of these answered for that ID, and links to the raw upstream response.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Every record is available as JSON at the same ID it has on the site. The API is read-only, needs no key, and allows requests from any origin (CORS), so you can call it from a browser.

Response fields

id

The canonical record ID: the GHSA when one exists, otherwise the CVE.

ghsaId, cveId

Both identifiers, or null when one doesn't exist.

record

The normalised record: title, description, severity (every CVSS entry with its source, plus the headline), CWEs, affected packages with PURLs and ranges, fix (versions and commits), references by type, SSVC, KEV, EPSS, other and related GHSAs, and provenance for each section.

intel

Published analyst intelligence: root cause, vulnerable functions, remediation and detection. An empty object when there is none.

fetchedAt

When CVEminer last fetched the record from upstream sources (ISO 8601).

Status codes

200

The record, from CVEminer's store or fetched live.

400

The ID isn't a valid CVE or GHSA ID.

404

No source has a record for this ID. Unknown CVEs are rechecked after an hour.

429

Too many new lookups from your network. The Retry-After header says how many seconds to wait.

502

The upstream sources couldn't be reached, so a new record couldn't be built. Retry later.

500

Something failed on CVEminer's side. Retry later, and tell us if it persists.

Limits and caching

• New IDs: 20 lookups per 10 minutes per network. A new ID makes CVEminer call up to eight upstream APIs, so these are limited.
• Cached records: unlimited within fair use.
• Successful responses may be cached for up to a minute (a few minutes while the cache revalidates). fetchedAt tells you how old the underlying data is.
• Errors return JSON with an error message that explains what went wrong.

If you need bulk or regular access, tell us what you're building.

• It isn't a scanner. CVEminer doesn't see your code, dependencies or infrastructure, and can't tell you whether you're affected. It tells you what's known about a vulnerability so you can check that yourself.
• It isn't a complete mirror of every CVE. The database holds records someone has looked up, plus batches of new GitHub-reviewed advisories and CISA known-exploited CVEs. Any valid CVE or GHSA ID can still be fetched on demand.
• It isn't the authority. The CNA, GitHub, OSV and CISA are. CVEminer shows what they publish and where it differs, and marks anything its analysts changed. Verify before acting.