NVD vulnerabilities (CVEs)

Every CVE published in the US National Vulnerability Database: severity, CVSS v3 and v4 scores and vectors, the affected vendor and product, weakness (CWE) IDs and references.

Table: demo.security.nvd_vulnerabilities
Source: National Vulnerability Database (NIST)
Rows
Updated

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT cve_id, published_at, severity, cvss_score, vendor, product
  FROM demo.security.nvd_vulnerabilities
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

Which vendors have the most critical CVEs?

SELECT vendor, COUNT(*) AS critical_cves
  FROM demo.security.nvd_vulnerabilities
 WHERE severity = 'CRITICAL' AND vendor IS NOT NULL
 GROUP BY vendor
 ORDER BY critical_cves DESC, vendor
 LIMIT 10

Edit in Studio

What are the most recently published CVEs?

SELECT cve_id, published_at, severity, cvss_score, vendor, product
  FROM demo.security.nvd_vulnerabilities
 ORDER BY published_at DESC
 LIMIT 10

Edit in Studio

How are CVEs spread across severity ratings?

SELECT severity, COUNT(*) AS cves
  FROM demo.security.nvd_vulnerabilities
 WHERE severity IS NOT NULL
 GROUP BY severity
 ORDER BY cves DESC

Edit in Studio

Schema

Columns

Column	Type
cve_id	VARCHAR
published_at	TIMESTAMP
severity	VARCHAR
cvss_score	FLOAT64
cvss_vector	VARCHAR
vendor	VARCHAR
product	VARCHAR
description	VARCHAR
cwes	VARCHAR
references	VARCHAR
cvss_v4_severity	VARCHAR
cvss_v4_score	FLOAT64
cvss_v4_vector	VARCHAR