Next free-source hunt
We check for new free data every weekday.
Datasets / Cyber Threat
github.com/

CVE List V5

Freeauth: noneCustom#cyber-threat#vulnerabilities#historical-data#bulk-data✓ verified Nov 4, 2026

CVE List V5

The CVE Program's cvelistV5 repository is the supported bulk distribution of CVE Records in CVE JSON 5.x format. CNA-published records include the CVE ID, state, descriptions, affected products and versions, problem types, references, dates and CNA or ADP containers. The repository supports git synchronization, daily baseline release ZIPs, hourly delta ZIPs and a rolling delta log. No account or key is needed for HTTPS downloads.

Required Attribution:

Reproduce MITRE's CVE copyright designation and licence in any copy.

Coverage

Published and rejected CVE Records organized by year and identifier range. Granularity: one JSON file per CVE Record. The repository says it is updated "about every 7 minutes" from the official CVE Services API; daily baselines are issued at midnight and hourly release assets contain changes since the baseline. Free history depth: the repository and git history retain the records and their file history; the rolling delta log normally covers 30 days. Publication delay beyond the stated update cycle: Not stated.

Verdict

This is the upstream bulk signal for ingesting CNA-published CVE records before adding scoring, exploitability or asset context from sources such as NVD, EPSS, KEV or EUVD. Records can be revised or rejected, schemas can evolve within CVE JSON 5.x, and CNA content varies in detail, so preserve state, container provenance and update timestamps. CVE usage is royalty-free, but copies must reproduce MITRE's copyright designation and licence.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.

Use in your agent

Load the CVE List V5 rolling change log into Parquet. Checked against the provider's documentation on Nov 4, 2026.

Raw skill file (/skills/cve-list-v5.md)Also in our MCP server: call get_ingestion_skill with {"slug": "cve-list-v5"}.

Access

  • No account or key for raw GitHub files; use git or releases for a full mirror.

Request

bash
curl -O 'https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/deltaLog.json'

Format

JSON fetch batches with fetchTime, numberOfChanges, and new, updated and error arrays carrying CVE IDs and record URLs.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python
"""CVE List V5 rolling changes -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/deltaLog.json"
r = requests.get(URL, timeout=120)
r.raise_for_status()
batches = r.json()
rows = []
for batch in batches:
    for change_type in ("new", "updated", "error"):
        for item in batch.get(change_type, []):
            rows.append({"fetchTime": batch["fetchTime"], "changeType": change_type, **item})
df = pd.DataFrame(rows)
df.to_parquet("cve_v5_delta.parquet", index=False)
print(len(df), "change rows across", len(batches), "fetch batches; latest", batches[0]["fetchTime"])

Run by us on 2026-11-04 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 123804 change rows across 2700 fetch batches; latest 2026-11-04T18:00:22.301Z

Limits

  • Rate limits: Not stated.
  • The rolling delta log normally retains 30 days.

Quirks

  • Records can be revised or rejected.
  • Fetch each githubLink for the full record.
  • Daily baseline and hourly delta ZIPs can be large.

Terms and attribution

  • CVE use is royalty-free.
  • Copies must reproduce MITRE's copyright designation and licence.

Sources

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

Related entries