National Vulnerability Database

About National Vulnerability Database

The National Vulnerability Database (NVD) is a U.S. government repository operated by NIST that publishes standards-based vulnerability data, including CVE records, CVSS scores, and CPE product identifiers. This page documents the changelog for the NVD's JSON data feed schemas, tracking revisions to the CVE feed, CVSS v2.0/v3.x, and CPE-related JSON schemas from a 2017 beta release through version 1.1 in 2019.

The changelog records schema-level modifications such as renamed files, added or removed required fields, updated regex patterns for CVSS vector strings, new boolean and array properties, and corrections to how certain fields were populated. It also documents versioning support additions, such as CVSS 3.1 alongside 3.0.

This resource is intended for developers and security tooling maintainers who consume NVD's JSON data feeds and need to track breaking or non-breaking schema changes over time to maintain compatibility with their parsers and integrations.

Key features

• Publishes versioned JSON schemas for CVE and CVSS vulnerability data feeds
• Supports CVSS v2.0, v3.0, and v3.1 scoring formats
• Documents CPE (Common Platform Enumeration) matching and version range properties
• Tracks reference tags such as 'Third Party Advisory' and 'VDB Entry'
• Maintains a changelog of schema revisions dating back to 2017

Frequently asked questions