jackwener--opencli/docs/adapters/browser/nvd.md

NVD (NIST National Vulnerability Database)

Mode: 🌐 Public · Domain: services.nvd.nist.gov

Fetch a single CVE record from the NIST National Vulnerability Database via the public CVE 2.0 API.

Commands

Command	Description
opencli nvd cve <id>	Fetch a CVE detail (description, CVSS, CWE, KEV flag)

Usage Examples

# Log4Shell
opencli nvd cve CVE-2021-44228

# Heartbleed
opencli nvd cve CVE-2014-0160

# JSON output for downstream tooling
opencli nvd cve CVE-2021-44228 -f json

Output Columns

Column	Description
id	Canonical CVE id
published	First published date (YYYY-MM-DD)
lastModified	Last modified date (YYYY-MM-DD)
vulnStatus	NVD analysis status (e.g. Analyzed, Awaiting Analysis)
baseScore	CVSS base score (numeric, 0–10)
severity	CVSS severity (CRITICAL / HIGH / MEDIUM / LOW / NONE)
attackVector	CVSS attack vector (NETWORK / LOCAL / PHYSICAL / ADJACENT)
cwe	Comma-separated CWE id(s)
kevAdded	CISA KEV (Known Exploited Vulnerabilities) date if present
description	English description
url	Canonical NVD detail URL

Options

Option	Description
id (positional)	CVE identifier (CVE-YYYY-N…, case-insensitive). Validated upfront.

Caveats

• The CVE id is validated against ^CVE-\d{4}-\d{4,}$; bad input raises ArgumentError.
• CVSS columns prefer v3.1, fall back to v3.0, then v2 if neither v3 record is present.
• NVD enforces aggressive rate limits without an API key. HTTP 403 and HTTP 429 both surface as typed CommandExecutionError with a retry hint.
• Empty / unanalyzed records (no CVSS payload) leave baseScore / severity / attackVector as null / empty rather than fabricating defaults.

Prerequisites

• No browser required — uses services.nvd.nist.gov/rest/json/cves/2.0.