The CVE Program's cvelistV5 repository on GitHub hosts every CVE record as downloadable JSON in the CVE Record Format, updated about every seven minutes from the official CVE Services API. Clone it or pull deltas to run your own monitoring without calling a rate-limited API for each lookup.
What the repository is
The README describes it as the official CVE List: a catalog of all CVE records identified by, or reported to, the CVE Program. It hosts downloadable files in the CVE Record Format, and the schema is published separately. The files are updated regularly, about every seven minutes, using the official CVE Services API.
Things the README warns about
The notes at the top of the README are worth reading, because they show how the data can change under you:
- Format versions: Records may be in format 5.0, 5.1 or later. A
dataversionfield shows which one, and the README advises validating a record against the schema version it declares, not the date it was published. - A second container: Since a 2024 change, records may contain a CVE Program Container with extra information such as references added by the Program. Tools may need to process two containers.
- Package URLs: Version 5.2.0 added support for Package URL identifiers in the affected entries.
- Date corrections: The README says about 27,000 records published before 2023 had incorrect reserved, published or updated dates, which were corrected. If you cached old records, refresh them.
- Date normalization: A normalization process ran in February 2026, and during it the delta log kept a shorter history.
The delta log
The README says a deltaLog.json file normally keeps a rolling 30 days of modification history, and the full history is available in the Git history. That makes it a natural poll target: read the delta log, find the records that changed, and fetch only those.
A monitoring pattern
- Clone the repository once for a full local copy.
- On a schedule, pull the latest changes, or read the delta log.
- For each changed record, read the affected products and versions, and the references.
- Match against your product and dependency inventory. Package URL fields make this easier when they are present.
- For matches, open a ticket. For records that changed from published to rejected, close related tickets.
- Keep the last processed commit so you can recover after a gap.
| Need | Approach |
|---|---|
| Full history for analysis | Clone and read the files |
| Daily changes | Read the delta log, or pull and diff |
| One CVE now | Fetch the single file by path |
Limits
CVE records say what the CNA chose to publish. Some lack version detail, or lack a severity. A record is a starting point. Compare it with the vendor advisory and with exploit signals before you decide. For how states differ, see CVE record states: reserved, published, rejected.
Where Safeguard fits
Safeguard's SBOM and dependency scanning keeps the inventory side of that match current, and its zero-day discovery work looks beyond published records. A free scan is at https://gold.safeguard.sh/scan.
Quick check
How fresh is the cvelistV5 data?
The README says it is updated about every seven minutes from the official CVE Services API.
Do all records use the same schema version?
No. Records may use different format versions, shown in a dataversion field. Validate against the declared version.
Sources
- CVEProject cvelistV5 README, fetched 19 October 2026.
Last reviewed: 19 October 2026.
