Methodology

API

Conventions

Collection routes. They follow the conventions of the NVD 2.0 API, which PatchCVE already consumes to fill itself: /api/referentiel/{module} et /api/referentiel/cpe/{id}/cve.

Envelope. { resultsPerPage, startIndex, totalResults, format, version, timestamp }, then the array named after the resource: vulnerabilities, products or weaknesses. Each element is wrapped under its own key: { "cve": { … } }. totalResults covers the whole filter, resultsPerPage the number of elements actually returned.

Pagination. startIndex, from 0, and resultsPerPage, capped at 2000 for CVE and CWE, 10000 for CPE. An out-of-range value is rejected, not silently clamped.

Date windows. lastModStartDate and lastModEndDate, ISO-8601, on CVE and CPE; pubStartDate and pubEndDate on CVE as well. Both bounds are required together — one alone is an error, not an implicit « until now » — and their span is capped at 120 days. Under a window the sort is tie-broken by identifier, so a multi-page sweep neither skips nor duplicates a row. CWE have no window, see below.

Errors. An unknown parameter is rejected, not ignored: 404, Invalid parameter: XXX. Without that rule, a typo on lastModStartDate would silently pull down the whole set. The reason appears in the message HTTP header and in the body { "message": "…" }.

Multi-valued filters. Comma-separated values: severity=CRITICAL,HIGH. Criteria combine with AND.

Reference data

GET/api/referentiel/{module}

Paginated list of one collection. {module} is cwe, cpe or cve.

Parameter	Role	Modules
q	Full-text search (FTS5), prefix match on each word.	all
startIndex, resultsPerPage	Offset pagination.	all
lastModStartDate, lastModEndDate	Last-modified window, paired and capped at 120 days.	cpe, cve
pubStartDate, pubEndDate	Same, on the publication date.	cve
id	Partial match on the identifier.	cwe, cve
abstraction, status	CWE abstraction level and status.	cwe
uri	Partial match on the CPE 2.3 string.	cpe
deprecated	0 (current) or 1 (deprecated).	cpe
severity, status	Base CVSS severity and NVD analysis status.	cve
vector, temporalVector	Partial match on the vector. The value N/A instead isolates CVE that have no such vector.	cve
scoreOp, scoreValue	Comparison on the base score. The operator is gt, lt or eq, and only takes effect with a numeric value.	cve
temporalScoreOp, temporalScoreValue	Same, on the temporal score.	cve

CVE are sorted by descending last-modified date. On top of the table columns, each element carries the attached temporal scores: Microsoft (msrc_temporal_*), the application's own estimate (estimated_temporal_*) and CVSS-BT 4.0 (cvss4_threat_*).

CWE: no date window. MITRE publishes no API and republishes the whole catalogue without dating its entries; no upstream modification date exists, and lastModStartDate is rejected there like any unknown parameter. The catalogue fits in a single page anyway — 969 weaknesses — and is taken in full every time, with no state to keep between runs. The numeric identifier sort is unique and stable.

GET/api/referentiel/{module}/facets

Distinct values of the filterable columns, with their counts. They cover the whole collection and ignore the request filters.

GET/api/referentiel/stats

For cwe, cpe and cve: record count, synchronisation state and last job.

GET/api/referentiel/cpe/{id}/cve

The CVE that actually cover a given CPE. {id} is the cpe_name_id, not the CPE string.

Same parameters and same response as the CVE list. Matching confronts the CPE with the NVD configuration criteria and their version ranges; it is not a plain string equality. Returns 404 when the CPE is unknown, which differs from an empty list.

GET/api/referentiel/cpe/{id}/cve/facets

Facets restricted to the CVE of this CPE.

Examples

Commands run as written; the counts quoted are those measured on this database.

CWE

The whole catalogue in one call: 969 weaknesses.

curl "https://patchcve.example/api/referentiel/cwe?resultsPerPage=1000"

Stable weaknesses at the Base abstraction level (21).

curl "https://patchcve.example/api/referentiel/cwe\
?abstraction=Base&status=Stable&resultsPerPage=5"

Full-text search over identifier, name and description (20 for injection).

curl "https://patchcve.example/api/referentiel/cwe?q=injection&resultsPerPage=5"

CPE

Keyword search, deprecated CPE excluded (2,668 for nginx).

curl "https://patchcve.example/api/referentiel/cpe\
?q=nginx&deprecated=0&resultsPerPage=5"

Partial match on the CPE 2.3 string (683).

curl "https://patchcve.example/api/referentiel/cpe\
?uri=redhat:enterprise_linux&resultsPerPage=5"

A 120-day window: 144,022 CPE modified, to be swept in pages of 10,000 by incrementing startIndex.

curl "https://patchcve.example/api/referentiel/cpe\
?lastModStartDate=2026-05-01T00:00:00.000Z\
&lastModEndDate=2026-08-29T00:00:00.000Z\
&startIndex=0&resultsPerPage=10000"

CVE

Critical CVE under active exploitation, most recent first (1,578).

curl "https://patchcve.example/api/referentiel/cve\
?severity=CRITICAL&temporalVector=E:H&resultsPerPage=5"

What changed over a window, page by page (20,287 in August).

curl "https://patchcve.example/api/referentiel/cve\
?lastModStartDate=2026-08-01T00:00:00.000Z\
&lastModEndDate=2026-08-31T00:00:00.000Z\
&startIndex=0&resultsPerPage=2000"

The same window on the publication date: newly published CVE, without the merely revised ones (12,356 against 20,287).

curl "https://patchcve.example/api/referentiel/cve\
?pubStartDate=2026-08-01T00:00:00.000Z\
&pubEndDate=2026-08-31T00:00:00.000Z&resultsPerPage=5"

Base score above 9, on CVE already analysed by the NVD (10,445).

curl "https://patchcve.example/api/referentiel/cve\
?scoreOp=gt&scoreValue=9&status=Analyzed&resultsPerPage=5"

Errors

A date bound without its twin is rejected; the reason sits in the message header.

curl -sD- -o /dev/null \
  "https://patchcve.example/api/referentiel/cpe?lastModStartDate=2026-08-01T00:00:00.000Z"
# HTTP/1.1 404
# message: Both lastModStartDate and lastModEndDate are required when either is present.

On CWE the date window does not exist: the parameter falls under the general rule.

curl -sD- -o /dev/null \
  "https://patchcve.example/api/referentiel/cwe?lastModStartDate=2026-08-01T00:00:00.000Z"
# HTTP/1.1 404
# message: Invalid parameter: lastModStartDate.