NVD Datafeed Mirror

Static mirror of the NVD API datafeed (gzipped JSON files) for use with OWASP Dependency-Check — no NVD API key, no pagination, no rate limiting. Updated daily.

Last update (UTC): 2026-08-21 22:11

Usage

dependency-check --updateonly \
  --nvdDatafeed https://nvd.epicsoft.one/nvdcve-{0}.json.gz

The {0} placeholder is replaced by the year for each file.

Files

• nvdcve-2002.json.gz … nvdcve-<year>.json.gz
• nvdcve-modified.json.gz
• cache.properties

NVD data is US Government public domain. Generated with open-vulnerability-cli (vulnz).

Open source & transparent

This mirror's infrastructure is public: gitlab.com/epicsoft-networks/nvd-mirror (MIT License).

Operated by epicsoft LLC.