API

CVE database API: search vulnerabilities by product and version

Search NVD vulnerabilities by product and version from a local database, with CVSS and fixed-in ranges.

What it does

The CVE Database API searches known vulnerabilities by application name and version. Each result has the CVE id, description, severity, CVSS scores and vectors, CWE ids, affected products with version ranges, references and advisory links. Data comes from the NVD.
It solves the "are we exposed?" question for the software you run, without calling the NVD from every tool and hitting its throttling. Once the local database is loaded, search and recent-CVE lookups answer from it.
Freshness depends on the database load. A full first load takes hours. Until it finishes, some calls fall back to cached or live NVD data, and links from software to CVEs stay thin. Check /health and /preload/status to see where it stands. This is not a real-time feed.
Affordable by design. Start free* within platform limits for connected ShadowCradle organizations, with affordable pricing beyond that. *Free within platform limits; usage beyond limits may be charged to maintain the platform.

See how it works

Are we exposed? Ask the local database

Searches answer from a local database loaded from the NVD. The first full load takes hours; until it finishes, some calls fall back to cached or live NVD data. This is not a real-time feed.

Example use cases

Check a client stack on demand

An MSP searches "openssl" at the client's version and lists the CVEs that affect it, with the fixed version from the range bounds.

Daily "what is new" digest

Security teams call /recent for the last 7 days, filtered to CRITICAL or HIGH, and post the list to chat.

Inventory scanning

Ops tools run each installed package through the search and raise tickets for high-severity matches.

Typeahead for the right product

Use /software-suggest while a user types to pick the correct vendor and product pair before searching.

Link a CVE to what it breaks

Take a CVE id from an alert and ask which catalog software and release cycles it affects, plus CISA KEV and EPSS.

Try it

Search by application and version

curl -s "https://app.takelan.com/api/v1/cve/search/openssl?version=3.0.2&limit=20" \
  -H "X-API-Key: $TAKELAN_API_KEY"

Response (trimmed, fictional): { "application_name": "openssl", "total_vulnerabilities": 1, "vulnerabilities": [{ "cve_id": "CVE-2099-0001", "severity": "HIGH", "cvss_score": 7.5, "affected_products": [{ "vendor": "example", "product": "openssl", "version_end_excluding": "3.0.9" }] }], "cache_hit": false, "data_source": "NVD" }

Recent critical CVEs

curl -s "https://app.takelan.com/api/v1/cve/recent?days=7&severity=CRITICAL&limit=20" \
  -H "X-API-Key: $TAKELAN_API_KEY"

Endpoints

POST /api/v1/cve/search Search: by application_name, optional version, vendor, product, severity_filter, limit up to 500.
GET /api/v1/cve/search/{application_name} Search: same as a query string (version, limit up to 500).
GET /api/v1/cve/recent Search: CVEs from the last 1 to 30 days, optional severity filter.
GET /api/v1/cve/software-suggest Find the product: vendor and product suggestions with CVE counts.
GET /api/v1/cve/products/search Find the product: similar product names from previous searches.
GET /api/v1/cve/{cve_id}/software Impact: catalog software and release cycles a CVE affects, with CISA KEV entry and EPSS score.
GET /api/v1/cve/health Status: database and service health.
GET /api/v1/cve/cache/stats Status: cache statistics.
GET /api/v1/cve/scheduler/status Status: refresh scheduler.
GET /api/v1/cve/preload/status Status: progress of the database load.
POST /api/v1/cve/preload Admin: start a database load (admin role). Spends the platform NVD budget; a write, so off for agents by default.

MCP

Available as tools through /mcp/utils. Read tools work by default with an API key. Anything that writes is off until your tenant turns on the writes switch, and a read-only key never writes. Calls run with your own permissions. Starting a preload is a write and stays off until writes are enabled. About MCP

Common questions

How do I search CVEs by product and version with an API?

GET /api/v1/cve/search/{application_name}?version=... or POST /api/v1/cve/search. Results include severity, CVSS and affected version ranges.

Is there a CVE API that does not hit the NVD every time?

Yes. Once the local CVE database is loaded, search and recent-CVE calls answer from it. Before that, results come from cache or the NVD.

How fresh is the CVE data?

It depends on the load and refresh schedule. A full first load takes hours. Use /preload/status and /health to see the current state. Do not treat it as real time.

How do I find the fixed version of a vulnerability?

Read version_end_excluding on the affected product entry. That is the first fixed version. Many modern entries use ranges and leave version as an asterisk.

Can I list the latest critical CVEs?

Yes. GET /api/v1/cve/recent with severity=CRITICAL and days up to 30.

Does it include CISA KEV and EPSS?

Yes, on /api/v1/cve/{cve_id}/software and in the software catalog vulnerability routes.

What are the limits?

Search returns up to 500 results per call. Platform rate limits apply, and a 429 includes Retry-After. Exact numbers vary by environment.

Can my AI assistant query CVEs?

Yes, through /mcp/utils. Reads work by default; writes are off.

All API families | Takelan Utilities & APIs | Pricing