MITRE Recent CVEs

Fetch the latest CVEs directly from MITRE's CVE List V5 delta feed. MITRE publishes CVEs approximately 24 hours before they appear in NVD, making this endpoint ideal for early detection.

Endpoint

GET /api/v1/mitre/recent

Parameters

Parameter	Type	Required	Description
limit	number	No	Maximum CVEs to return (default: 50, max: 100)

Response

{
  "success": true,
  "source": "mitre-cve-list-v5",
  "fetchTime": "2026-02-06T02:10:25.863Z",
  "summary": {
    "total": 17959,
    "new": 439,
    "updated": 7415
  },
  "cves": [
    {
      "id": "CVE-2026-1974",
      "cve_id": "CVE-2026-1974",
      "summary": "A vulnerability was identified in Free5GC up to 4.1.0...",
      "severity": "medium",
      "publishedAt": "2026-02-06T02:02:10.925Z",
      "upstreamAvailableAt": "2026-02-06T02:10:25.863Z",
      "change": "new",
      "source": "cve-list-v5",
      "affected": [
        {
          "vendor": "n/a",
          "product": "Free5GC",
          "versions": [
            { "version": "4.0", "status": "affected" },
            { "version": "4.1.0", "status": "affected" }
          ],
          "cpes": []
        }
      ],
      "cvssScore": 5.3,
      "cvssVersion": "3.1",
      "ssvc": null
    }
  ],
  "timestamp": "2026-02-06T03:05:43.663Z"
}

Response Fields

The list is cached whole for ten minutes and cut to limit on the way out. Two writers fill that cache, the scheduler's delta sync and this route, and the body carries the union of what either knew: summary and the flat newCount and updatedCount say the same thing twice, the flat pair being kept for clients written against the older shape. A field the writer did not know is null rather than absent.

Top level

Field	Type	Description
source	string	Always mitre-cve-list-v5
fetchTime	string|null	When the list was read from MITRE
summary	object	The counts below
newCount, updatedCount	number|null	The same counts as summary.new and summary.updated
lastSync	string|null	When the scheduler last refreshed the list; null when this route fetched it itself
cves	array	The records, at most limit

Summary

Field	Type	Description
total	number	Records in the cached list before the cut to limit
new	number|null	Count of newly published CVEs
updated	number|null	Count of updated CVEs

CVE Object

This is the lightweight shape the scheduler's delta sync actually writes every five minutes, which is what almost every call to this endpoint returns. A cold cache (nothing synced yet) falls back to fetching MITRE's own delta log directly, which carries additional fields (title, description, cvssVector, references, problemTypes, state, dateUpdated, dateReserved) not listed here — that fallback is rare enough in practice that this page documents only the common shape.

Field	Type	Description
id, cve_id	string	CVE identifier (e.g., CVE-2026-1974); both carry the same value
summary	string	Vulnerability description
severity	string	Severity level (critical, high, medium, low, unknown)
publishedAt	string	ISO 8601 publication timestamp
upstreamAvailableAt	string	When this record became available from MITRE
change	string	new or updated
source	string	Always cve-list-v5
affected	array	Affected products and versions
cvssScore	number|null	CVSS base score (0.0-10.0), when known
cvssVersion	string|null	CVSS version, when known
ssvc	object|null	SSVC decision data, when known

Example

# Get 10 most recent CVEs
curl "https://api.vulnpatch.dev/api/v1/mitre/recent?limit=10"

# Get default (50) recent CVEs
curl "https://api.vulnpatch.dev/api/v1/mitre/recent"

Code Examples

JavaScript

async function getRecentCVEs(limit = 20) {
  const response = await fetch(
    `https://api.vulnpatch.dev/api/v1/mitre/recent?limit=${limit}`
  );
  const data = await response.json();

  console.log(`MITRE Delta: ${data.summary.new} new, ${data.summary.updated} updated`);

  for (const cve of data.cves) {
    console.log(`[${cve.severity}] ${cve.id}: ${cve.summary}`);
  }

  return data.cves;
}

getRecentCVEs(10);

Python

import requests

def get_recent_cves(limit=20):
    response = requests.get(
        f"https://api.vulnpatch.dev/api/v1/mitre/recent?limit={limit}"
    )
    data = response.json()

    print(f"MITRE Delta: {data['summary']['new']} new, {data['summary']['updated']} updated")

    for cve in data['cves']:
        print(f"[{cve['severity']}] {cve['id']}: {cve['summary']}")

    return data['cves']

get_recent_cves(10)

Use Cases

• Early Warning: Get CVEs ~24 hours before they appear in NVD
• Security Monitoring: Track newly published vulnerabilities
• Threat Intelligence: Feed into security dashboards
• Automated Scanning: Check for new CVEs affecting your stack

Data Source

This endpoint fetches directly from MITRE's CVE List V5 repository, specifically the deltaLog.json file which contains recent changes.

The delta log is updated approximately hourly and contains:

• Newly published CVEs
• Updated CVE records
• Rejected CVEs

Caching

The scheduler polls the delta feed and rewrites this cache every 5 minutes; the rest of the enrichment runs every 30. The cached value's own KV expiry is a one-hour safety net in case the scheduler stops running, not the refresh interval — in practice the content turns over roughly every 5 minutes, not every hour.

For what that actually amounts to, see Service status, which publishes the measured latency rather than the schedule.

Related Endpoints

• GET /api/v1/cve/:id - Lookup specific CVE by ID
• POST /api/v1/cve/batch - Bulk CVE lookup
• GET /api/v1/search - Full-text CVE search