nvdlib

library0.8.3pypypi✓ verified 84d ago

A Python library for the National Vulnerability Database (NVD) CPE/CVE API. Provides easy search and retrieval of CVEs, CPEs, and CPE match strings with support for pagination and generators. Current version 0.8.3, requires Python >=3.11.0. Maintained actively with monthly releases.

http-networking data serialization

pip install nvdlib

github ↗package ↗

INSTALL

IMPORT

SIG · NVDLIB

nvdlib

http-networkingpythonv0.8.3

Install

2.3s avg

Import

636ms

Disk

19MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.7.7 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.676s · 21.1MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.3s · import 0.596s · 22MB

19MB installed

● package 19MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

nvdlib

✓ import nvdlib

✗ from nvdlib import searchCVE

Common mistake: trying direct import of functions; they are only available after 'import nvdlib'

Basic usage to search for CVEs by keyword and print ID, score, and title.

import nvdlib import os # Use environment variable for API key ( optional but recommended) api_key = os.environ.get('NVD_API_KEY', '') # Search for CVEs with keyword cves = list(nvdlib.searchCVE(keyword='openssl', key=api_key, delay=0.6)) for cve in cves[:2]: print(cve.id, cve.score, cve.title)

Debug

Known issues

gotchaThe NVD API has rate limits (5 requests per 30 seconds without API key, 50 per 30 seconds with key). Set 'delay' parameter to at least 0.6 (no key) or 0.03 (with key) seconds between requests to avoid 403 errors.

fix

Always pass a 'delay' parameter (e.g., delay=0.6) and consider using an API key via 'key' parameter.

affects: >=0.7.0

breakingIn v0.8.0, boolean parameters 'hasKev', 'hasOval', 'hasCertAlerts', 'hasCertNotes', 'keywordExactMatch' are no longer passed in the URL as 'True'/'False' strings. If you relied on their presence in the URL, behavior changed.

fix

Upgrade code to not depend on URL parameter presence for boolean flags; they are now handled internally.

affects: >=0.8.0

gotchaWhen using datetime objects for 'pubStartDate' or 'pubEndDate', ensure timezone is set. The library replaces '+' with '%2B', but incorrect timezone strings can cause 404 errors.

fix

Use timezone-aware datetime objects (e.g., from datetime import timezone, datetime; dt = datetime.now(timezone.utc)).

affects: >=0.7.3

gotchaThe generator functions searchCVE_V2 and searchCPE_V2 yield results as they fetch pages, but they do not retry on rate limit errors; a single 403 will break the generator.

fix

For reliable iteration, collect into list (list(searchCVE_V2(...))) or implement custom retry logic.

affects: >=0.7.4

Errors

Common errors & fixes

ImportError: cannot import name 'searchCVE' from 'nvdlib'

Trying to import searchCVE directly instead of importing the module.

fix

Use 'import nvdlib' then call nvdlib.searchCVE(...)

nvdlib.error.AuthenticationError: (401) Unauthorized

Invalid or missing API key when trying to access API v2.1 endpoints that require key.

fix

Provide a valid API key via the 'key' parameter or set NVD_API_KEY environment variable.

TypeError: 'NoneType' object is not subscriptable' when accessing CVE attributes

Some CVE objects may have missing fields (e.g., 'metrics' or 'descriptions') depending on NVD API response.

fix

Check for None before accessing nested attributes (e.g., if cve.description: ...)

Upgrade

Version history

0.8.3latest on PyPI · released Aug 6, 2025

Audit

Dependencies

requestsrequiredHTTP requests to NVD API

Agent activity

10 hits · last 30 days

node

Resources

githubhttps://github.com/Vehemont/nvdlib ↗

packagehttps://pypi.org/project/nvdlib/ ↗