MITRE Recent CVEs

Fetch the latest CVEs directly from MITRE's CVE List V5 delta feed. MITRE publishes CVEs approximately 24 hours before they appear in NVD, making this endpoint ideal for early detection.

Endpoint

GET /api/v1/mitre/recent

Parameters

Parameter	Type	Required	Description
limit	number	No	Maximum CVEs to return (default: 50, max: 100)

Response

{
  "success": true,
  "source": "mitre-cve-list-v5",
  "fetchTime": "2026-02-06T02:10:25.863Z",
  "summary": {
    "total": 17959,
    "new": 439,
    "updated": 7415
  },
  "cves": [
    {
      "id": "CVE-2026-1974",
      "state": "PUBLISHED",
      "datePublished": "2026-02-06T02:02:10.925Z",
      "dateUpdated": "2026-02-06T02:02:10.925Z",
      "dateReserved": "2026-02-05T13:33:48.056Z",
      "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
      "title": "Free5GC SMF datapath.go ResolveNodeIdToIp denial of service",
      "description": "A vulnerability was identified in Free5GC up to 4.1.0...",
      "severity": "medium",
      "cvssScore": 5.3,
      "cvssVersion": "3.1",
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
      "affected": [
        {
          "vendor": "n/a",
          "product": "Free5GC",
          "versions": [
            { "version": "4.0", "status": "affected" },
            { "version": "4.1.0", "status": "affected" }
          ],
          "cpes": []
        }
      ],
      "references": [
        {
          "url": "https://vuldb.com/?id.344496",
          "name": "VDB-344496 | Free5GC SMF datapath.go ResolveNodeIdToIp denial of service",
          "tags": ["vdb-entry", "technical-description"]
        }
      ],
      "problemTypes": [
        {
          "cweId": "CWE-404",
          "description": "Denial of Service"
        }
      ],
      "source": "cve-list-v5"
    }
  ],
  "timestamp": "2026-02-06T03:05:43.663Z"
}

Response Fields

The list is cached whole for ten minutes and cut to limit on the way out. Two writers fill that cache, the scheduler's delta sync and this route, and the body carries the union of what either knew: summary and the flat newCount and updatedCount say the same thing twice, the flat pair being kept for clients written against the older shape. A field the writer did not know is null rather than absent.

Top level

Field	Type	Description
source	string	Always mitre-cve-list-v5
fetchTime	string|null	When the list was read from MITRE
summary	object	The counts below
newCount, updatedCount	number|null	The same counts as summary.new and summary.updated
lastSync	string|null	When the scheduler last refreshed the list; null when this route fetched it itself
cves	array	The records, at most limit

Summary

Field	Type	Description
total	number	Records in the cached list before the cut to limit
new	number|null	Count of newly published CVEs
updated	number|null	Count of updated CVEs

CVE Object

Field	Type	Description
id	string	CVE identifier (e.g., CVE-2026-1974)
state	string	CVE state (PUBLISHED, REJECTED, etc.)
datePublished	string	ISO 8601 publication timestamp
dateUpdated	string	ISO 8601 last update timestamp
title	string	Short CVE title
description	string	Full vulnerability description
severity	string	Severity level (critical, high, medium, low, unknown)
cvssScore	number	CVSS base score (0.0-10.0)
cvssVersion	string	CVSS version (3.0 or 3.1)
cvssVector	string	Full CVSS vector string
affected	array	Affected products and versions
references	array	Reference URLs
problemTypes	array	CWE identifiers

Example

# Get 10 most recent CVEs
curl "https://api.vulnpatch.dev/api/v1/mitre/recent?limit=10"

# Get default (50) recent CVEs
curl "https://api.vulnpatch.dev/api/v1/mitre/recent"

Code Examples

JavaScript

async function getRecentCVEs(limit = 20) {
  const response = await fetch(
    `https://api.vulnpatch.dev/api/v1/mitre/recent?limit=${limit}`
  );
  const data = await response.json();

  console.log(`MITRE Delta: ${data.summary.new} new, ${data.summary.updated} updated`);

  for (const cve of data.cves) {
    console.log(`[${cve.severity}] ${cve.id}: ${cve.title}`);
  }

  return data.cves;
}

getRecentCVEs(10);

Python

import requests

def get_recent_cves(limit=20):
    response = requests.get(
        f"https://api.vulnpatch.dev/api/v1/mitre/recent?limit={limit}"
    )
    data = response.json()

    print(f"MITRE Delta: {data['summary']['new']} new, {data['summary']['updated']} updated")

    for cve in data['cves']:
        print(f"[{cve['severity']}] {cve['id']}: {cve['title']}")

    return data['cves']

get_recent_cves(10)

Use Cases

• Early Warning: Get CVEs ~24 hours before they appear in NVD
• Security Monitoring: Track newly published vulnerabilities
• Threat Intelligence: Feed into security dashboards
• Automated Scanning: Check for new CVEs affecting your stack

Data Source

This endpoint fetches directly from MITRE's CVE List V5 repository, specifically the deltaLog.json file which contains recent changes.

The delta log is updated approximately hourly and contains:

• Newly published CVEs
• Updated CVE records
• Rejected CVEs

Caching

Results are cached for 5 minutes. New CVEs are polled from the delta feed every 5 minutes, and the rest of the enrichment runs every 30.

For what that actually amounts to, see Service status, which publishes the measured latency rather than the schedule.

Related Endpoints

• GET /api/v1/cve/:id - Lookup specific CVE by ID
• POST /api/v1/cve/batch - Bulk CVE lookup
• GET /api/v1/search - Full-text CVE search