CVEList v5 is a cache of the official CVE List in CVE JSON 5 format.
The repository serves as the authoritative source for vulnerability records in standardized JSON format. It maintains a comprehensive collection of CVE records that have been published through the CVE Program, allowing developers and security tools to access vulnerability data in a machine-readable format. The tool supports the evolving CVE Record Format specification, which defines how vulnerability information is structured and validated across the ecosystem.
This repository is essential for anyone building security tooling, vulnerability databases, or systems that need to consume official CVE data. It suits organizations that require programmatic access to the complete CVE catalog rather than querying individual APIs. The project maintains backward compatibility across schema updates, meaning tools built against earlier versions continue to function with newer records. The repository includes a deltaLog.json file that tracks recent modifications, enabling incremental updates rather than full re-downloads.
The project undergoes active maintenance with periodic schema updates to support new vulnerability metadata. The CVE Record Format has been updated to version 5.2.0 to include support for Package URL identifiers, allowing more precise specification of affected software components. Historical records have been corrected for accuracy, with approximately 27,000 records adjusted for incorrect date assignments during the transition to JSON 5.0. The project includes a CVE Program Container for program-added metadata such as references, requiring consumers to handle multiple data containers. Date normalization processes are conducted periodically to ensure consistency across the dataset, with temporary adjustments to retention policies during these maintenance windows.
