CVE Record: Description, CVSS Scores, Affected Products and References (NVD)
nvd/cve-record
The National Vulnerability Database record for one CVE id: the description, every CVSS score (v4.0, v3.x and v2) with its severity band and vector, the CWE weakness class, the affected products and version ranges as CPE match expressions, the advisory and patch references, and, when CISA lists the CVE as known exploited, the date added and the required action. An id nobody has returns an empty list, not an error. National Vulnerability Database data, passed through unmodified and served by Eden Engine; not an official NIST or NVD product.
Price
$0.0026 per call
You pay the price shown. If a call turns out to cost more than its quote, you pay the actual price, capped at twice the quote. No monthly minimum. Top-ups start at $5.
Data source
National Vulnerability Database (NIST)
This product uses data from the NVD API but is not endorsed or certified by the NVD. Data from the National Vulnerability Database (NVD), National Institute of Standards and Technology, U.S. Department of Commerce; NIST information is public and may be distributed or copied, per nist.gov/oism/copyrights. Served by Eden Engine; not an official NIST product.
Use it
Five steps: search, inspect, learn, run, settle. No per-tool setup; your agent reaches this tool through the meta-tools it already has.
Connect once and your AI can find and run this tool, and any other it needs.
// 1. search: find the tool
omnial_search({ query: "what you need" })
// 2. inspect: price and input schema
omnial_inspect({ tool: "nvd/cve-record" })
// 3. learn: read the usage guide at runtime
omnial_learn({ tool: "nvd/cve-record" })
// 4. run: price the exact call first, then run it
omnial_execute({ tool: "nvd/cve-record", input: { /* see input_schema */ }, dry_run: true })
omnial_execute({ tool: "nvd/cve-record", input: { /* ... */ } })
// 5. settle: the call is charged when it finishes, nothing to doNot connected yet? Point your MCP client at https://mcp.eden-engine.com/mcp, then copy a config for your client.
Pricing
Every charge this tool can incur.
| Charge | Price |
|---|---|
Per call | $0.0026 |
- Updated
- Oct 20, 2026
Input and output schemas
Input schema
{
"type": "object",
"required": [
"cve_id"
],
"properties": {
"cve_id": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "The CVE id, upper case, for example CVE-2021-44228. Lower case is refused by NVD, so it is refused here."
}
},
"additionalProperties": false
}Output schema
{
"type": "object",
"required": [
"totalResults",
"vulnerabilities"
],
"properties": {
"format": {
"type": "string",
"description": "The NVD response format name."
},
"version": {
"type": "string",
"description": "The NVD API version."
},
"timestamp": {
"type": "string",
"description": "When NVD produced this response (UTC, no offset suffix)."
},
"startIndex": {
"type": "integer",
"description": "Zero-based offset of the first record on this page."
},
"totalResults": {
"type": "integer",
"description": "How many records match in all, across every page. 0 means nothing matched; that is an answer, not an error."
},
"resultsPerPage": {
"type": "integer",
"description": "How many records this page carries."
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve"
],
"properties": {
"cve": {
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The CVE identifier."
},
"cveTags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags such as disputed or unsupported-when-assigned."
},
"metrics": {
"type": "object",
"description": "Severity scores by CVSS version: `cvssMetricV40`, `cvssMetricV31`, `cvssMetricV30` and `cvssMetricV2`, each a list with one entry per scoring source (`type` Primary is NVD's, Secondary is the CNA's). `cvssData.baseScore` is the number and `cvssData.baseSeverity` the band. Absent for a CVE not yet scored, and a given version is absent where it was never scored.",
"additionalProperties": true
},
"affected": {
"type": "array",
"items": {
"type": "object",
"description": "One CNA-stated affected-product record.",
"additionalProperties": true
},
"description": "Vendor and product names as stated by the CNA."
},
"published": {
"type": "string",
"description": "When the CVE was published (UTC, no offset suffix)."
},
"references": {
"type": "array",
"items": {
"type": "object",
"description": "One reference.",
"additionalProperties": true
},
"description": "Advisories, patches and write-ups: `url`, `source` and `tags`."
},
"vulnStatus": {
"type": "string",
"description": "NVD processing status, for example Analyzed, Modified, Awaiting Analysis or Rejected."
},
"weaknesses": {
"type": "array",
"items": {
"type": "object",
"description": "One source's CWE list.",
"additionalProperties": true
},
"description": "CWE weakness classes, per source; the CWE id is `description[].value`."
},
"descriptions": {
"type": "array",
"items": {
"type": "object",
"description": "One description: `lang` and `value`.",
"additionalProperties": true
},
"description": "The CVE text, one entry per language; lang \"en\" is the English one."
},
"lastModified": {
"type": "string",
"description": "When the NVD record last changed (UTC, no offset suffix)."
},
"cisaActionDue": {
"type": "string",
"description": "CISA's remediation due date (YYYY-MM-DD). KEV entries only."
},
"cisaExploitAdd": {
"type": "string",
"description": "Date CISA added this CVE to its Known Exploited Vulnerabilities catalog (YYYY-MM-DD). Present only for a CVE in that catalog."
},
"configurations": {
"type": "array",
"items": {
"type": "object",
"description": "One configuration.",
"additionalProperties": true
},
"description": "The affected-product match expressions (CPE names and version ranges). Absent until NVD has analysed the CVE."
},
"sourceIdentifier": {
"type": "string",
"description": "Who assigned the CVE, usually an email address or a CNA identifier."
},
"cisaRequiredAction": {
"type": "string",
"description": "CISA's required action. KEV entries only."
},
"cisaVulnerabilityName": {
"type": "string",
"description": "CISA's name for the vulnerability. KEV entries only."
}
},
"additionalProperties": true
}
},
"additionalProperties": true
},
"description": "One entry per CVE; each is `{ cve: {...} }`."
}
},
"description": "The NVD CVE envelope: `vulnerabilities` holds one entry for a known id, none for an unknown one.",
"additionalProperties": true
}