Use git if you want the freshest CVE data with the least code: clone cvelistV5 once, then pull. Use the release zips if you cannot run git on the machine. The repository says it updates about every 7 minutes, with a daily baseline zip at midnight UTC and hourly delta zips.
What the repository is
cvelistV5 is the official CVE List, hosted by the CVE Program. It holds CVE Records in the CVE Record Format, updated about every 7 minutes from the official CVE Services API. The legacy download formats (CSV, HTML, XML, CVRF) ended on 30 June 2024, so JSON 5 is the format to build on. The repository does not accept pull requests, and use is subject to the CVE Program Terms of Use.
The two ways to sync
| git clone and pull | Release zips | |
|---|---|---|
| Freshness | Whatever the last pull fetched, up to about 7 minutes behind | Daily baseline, or hourly delta |
| Setup | One clone, then a scheduled pull | Download and unpack each time |
| Size per run | Only changes | Baseline is large; deltas are small |
| Needs git | Yes | No |
| Good for | Servers, CI, anything running often | Locked-down hosts, simple jobs |
The repository calls git the fastest way to keep the list up to date. For zips, the baseline is issued at the end of each day at midnight UTC and stays unchanged for 24 hours. Hourly files are named by date and hour, and contain only the deltas since the baseline, so an hourly consumer needs the baseline plus the latest delta.
A simple design
- Clone the repository once on a worker.
- Pull on a schedule, for example every 15 minutes.
- After each pull, list changed files with git, and parse only those.
- For each record, read the CNA container and the CVE Program container, plus any ADP containers.
- Store the record's modified date, and compare it with what you saw last time.
- Alert yourself if a pull fails or returns nothing for longer than a day.
The repository also keeps a deltaLog.json file. It normally holds a rolling 30 days of record modification history, though it held only 15 days during the February 2026 date normalization. Do not rely on it for deep history. Git history has the full record.
Pitfalls
- After 31 July 2024, all information about a vulnerability can sit in more than one container, so read both the CNA and Program containers.
- References can be duplicated between those containers. See our post on why a CVE record lists the same reference twice.
- Validate against the schema version in the record's data version field, because records may be 5.0, 5.1 and later formats.
- Publication and update date issues have been documented for some records. Read the repository's known issues before using dates for metrics.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, so you can use it instead of building your own pipeline. If you do build one, the free scan at gold.safeguard.sh/scan gives you a reference result to compare your pipeline's output against.
Quick check
How often does cvelistV5 update?
The repository says about every 7 minutes, using the official CVE Services API.
Which zip do I use for hourly freshness?
The hourly delta zip, together with the latest midnight UTC baseline, since deltas only contain changes since the baseline.
Can I send fixes to cvelistV5 by pull request?
No. Pull requests are not accepted. Content issues go through the CVE Program request form.
Sources
- CVE Program, cvelistV5 repository README, fetched 19 October 2026.
Last reviewed: 19 October 2026.
