Send a GET request to the CVE Services API with the CVE ID in the path. The reply holds a cveMetadata block, then containers with the assigning CNA's data and any ADP additions. It is the source record that NVD and other databases build on.
The request
curl -s https://cveawg.mitre.org/api/cve/CVE-2021-44228
Fetched on 18 October 2026, the metadata for this record read: state PUBLISHED, assigner short name apache, reserved 26 November 2021, published 10 December 2021, last updated 21 October 2025. The containers key held cna and adp, and the ADP list had two providers, shown as CVE and CISA-ADP.
What each part is
| Part | What it holds |
|---|---|
| cveMetadata | The ID, state, assigner, and reserved, published and updated dates, which CVE Services controls |
| containers.cna | The data from the one assigning CNA: description, affected products, references, problem types |
| containers.adp | One container per Authorized Data Publisher, each naming its provider |
The record format says there can be only one CNA container per record, since there is only one assigning CNA, while several ADPs can add their own. That is why a score can show up from a source other than the CNA. Our post on CNA containers and where scores live goes into this.
Why two update dates differ
For the same ID, NVD's own API showed a last modified date of 11 August 2026, while the CVE record showed an update in October 2025. Different systems track different changes. NVD updates its records for its own analysis, so its modified date can be later than the CVE record's. When you log "last changed", write down which system you read.
When to read CVE Services first
- You want the CNA's own statement, before any analysis by others.
- You want to see exactly who contributed what.
- You are checking whether a record is published or rejected.
- NVD shows an unexpected status or has not caught up.
When NVD and the CVE record disagree on affected versions or scores, read both, then the vendor advisory. See read CVE JSON 5 records.
A short parsing recipe
- Read
cveMetadata.state. If it is REJECTED, stop and follow anyreplacedBylist. - Read
containers.cna.descriptionsfor the text. - Read
containers.cna.affectedfor products, versions and default status. - Loop over
containers.adpand note each provider short name. - Store the response with the fetch time.
Do not parse by position. Containers and ADP lists vary from record to record.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how information about one vulnerability builds up over time from different contributors.
Safeguard offers zero day discovery and SBOM and dependency scanning, so new records are checked against your components. A free scan shows your current exposure.
Quick check
Can one CVE record have several CNA containers?
No. The format allows one CNA container, because only one CNA assigns the ID. ADP containers can be many.
Why did NVD and CVE show different last updated dates?
They are separate systems with separate edits. NVD changes its own analysis data without changing the CVE record.
Sources
- CVE Services record for CVE-2021-44228, 18 October 2026
- NVD CVE API 2.0 record for CVE-2021-44228
- CVE Record Format JSON schema
Last reviewed: 19 October 2026.
