Data

Downloads

Files

Both datasets are published one file per CVE year, as gzip-compressed CSV and Parquet. There is no combined "all years" file: the history only grows, and a single file would eventually break the deploy. Grab the years you need, or loop over all of them (see Using with dbt or Using with a posture collector below), or fetch manifest.json for a machine-readable list of each table's schema and full file list, keyed by cve_summary and cve_cpe. Generated 2026-09-17 21:39:08 UTC.

cve_summary is one row per CVE. cve_cpe is a child table keyed by cve_id, with one row per CPE match and multiple rows per CVE where a CVE affects multiple CPEs (see the schema).

🗜️ = gzip-compressed CSV  ·  📦 = Parquet

Year cve_summary cve_cpe
csv.gz parquet csv.gz parquet
1999 🗜️ cve_summary_1999.csv.gz 📦 cve_summary_1999.parquet 🗜️ cve_cpe_1999.csv.gz 📦 cve_cpe_1999.parquet
2000 🗜️ cve_summary_2000.csv.gz 📦 cve_summary_2000.parquet 🗜️ cve_cpe_2000.csv.gz 📦 cve_cpe_2000.parquet
2001 🗜️ cve_summary_2001.csv.gz 📦 cve_summary_2001.parquet 🗜️ cve_cpe_2001.csv.gz 📦 cve_cpe_2001.parquet
2002 🗜️ cve_summary_2002.csv.gz 📦 cve_summary_2002.parquet 🗜️ cve_cpe_2002.csv.gz 📦 cve_cpe_2002.parquet
2003 🗜️ cve_summary_2003.csv.gz 📦 cve_summary_2003.parquet 🗜️ cve_cpe_2003.csv.gz 📦 cve_cpe_2003.parquet
2004 🗜️ cve_summary_2004.csv.gz 📦 cve_summary_2004.parquet 🗜️ cve_cpe_2004.csv.gz 📦 cve_cpe_2004.parquet
2005 🗜️ cve_summary_2005.csv.gz 📦 cve_summary_2005.parquet 🗜️ cve_cpe_2005.csv.gz 📦 cve_cpe_2005.parquet
2006 🗜️ cve_summary_2006.csv.gz 📦 cve_summary_2006.parquet 🗜️ cve_cpe_2006.csv.gz 📦 cve_cpe_2006.parquet
2007 🗜️ cve_summary_2007.csv.gz 📦 cve_summary_2007.parquet 🗜️ cve_cpe_2007.csv.gz 📦 cve_cpe_2007.parquet
2008 🗜️ cve_summary_2008.csv.gz 📦 cve_summary_2008.parquet 🗜️ cve_cpe_2008.csv.gz 📦 cve_cpe_2008.parquet
2009 🗜️ cve_summary_2009.csv.gz 📦 cve_summary_2009.parquet 🗜️ cve_cpe_2009.csv.gz 📦 cve_cpe_2009.parquet
2010 🗜️ cve_summary_2010.csv.gz 📦 cve_summary_2010.parquet 🗜️ cve_cpe_2010.csv.gz 📦 cve_cpe_2010.parquet
2011 🗜️ cve_summary_2011.csv.gz 📦 cve_summary_2011.parquet 🗜️ cve_cpe_2011.csv.gz 📦 cve_cpe_2011.parquet
2012 🗜️ cve_summary_2012.csv.gz 📦 cve_summary_2012.parquet 🗜️ cve_cpe_2012.csv.gz 📦 cve_cpe_2012.parquet
2013 🗜️ cve_summary_2013.csv.gz 📦 cve_summary_2013.parquet 🗜️ cve_cpe_2013.csv.gz 📦 cve_cpe_2013.parquet
2014 🗜️ cve_summary_2014.csv.gz 📦 cve_summary_2014.parquet 🗜️ cve_cpe_2014.csv.gz 📦 cve_cpe_2014.parquet
2015 🗜️ cve_summary_2015.csv.gz 📦 cve_summary_2015.parquet 🗜️ cve_cpe_2015.csv.gz 📦 cve_cpe_2015.parquet
2016 🗜️ cve_summary_2016.csv.gz 📦 cve_summary_2016.parquet 🗜️ cve_cpe_2016.csv.gz 📦 cve_cpe_2016.parquet
2017 🗜️ cve_summary_2017.csv.gz 📦 cve_summary_2017.parquet 🗜️ cve_cpe_2017.csv.gz 📦 cve_cpe_2017.parquet
2018 🗜️ cve_summary_2018.csv.gz 📦 cve_summary_2018.parquet 🗜️ cve_cpe_2018.csv.gz 📦 cve_cpe_2018.parquet
2019 🗜️ cve_summary_2019.csv.gz 📦 cve_summary_2019.parquet 🗜️ cve_cpe_2019.csv.gz 📦 cve_cpe_2019.parquet
2020 🗜️ cve_summary_2020.csv.gz 📦 cve_summary_2020.parquet 🗜️ cve_cpe_2020.csv.gz 📦 cve_cpe_2020.parquet
2021 🗜️ cve_summary_2021.csv.gz 📦 cve_summary_2021.parquet 🗜️ cve_cpe_2021.csv.gz 📦 cve_cpe_2021.parquet
2022 🗜️ cve_summary_2022.csv.gz 📦 cve_summary_2022.parquet 🗜️ cve_cpe_2022.csv.gz 📦 cve_cpe_2022.parquet
2023 🗜️ cve_summary_2023.csv.gz 📦 cve_summary_2023.parquet 🗜️ cve_cpe_2023.csv.gz 📦 cve_cpe_2023.parquet
2024 🗜️ cve_summary_2024.csv.gz 📦 cve_summary_2024.parquet 🗜️ cve_cpe_2024.csv.gz 📦 cve_cpe_2024.parquet
2025 🗜️ cve_summary_2025.csv.gz 📦 cve_summary_2025.parquet 🗜️ cve_cpe_2025.csv.gz 📦 cve_cpe_2025.parquet
2026 🗜️ cve_summary_2026.csv.gz 📦 cve_summary_2026.parquet 🗜️ cve_cpe_2026.csv.gz 📦 cve_cpe_2026.parquet
Using with dbt

To use a dataset as a dbt seed, stitch the year files together into your project's seeds/ directory. Rather than guessing at a year range, fetch manifest.json and download every file it lists under the table's files.csv, decompressing and appending each in turn (keeping the header from the first file only). Requires jq. 

table=cve_summary  # or cve_cpe
dest="seeds/${table}.csv"
: > "$dest"
for url in $(curl -fsSL https://cve-db.pages.dev/manifest.json | jq -r ".${table}.files.csv[]"); do
    if [ -s "$dest" ]; then
        curl -fsSL "$url" | gunzip | tail -n +2 >> "$dest"
    else
        curl -fsSL "$url" | gunzip > "$dest"
    fi
done
dbt seed --select "$table"
Using with a posture collector

posture ships a cve_db collector that reads manifest.json directly and pulls each table's Parquet files straight into a pandas.DataFrame — no download step, no credential (this dataset is public): 

from posture import CCM

ccm = CCM("cve_db")                    # no credentials needed — public dataset
df = ccm.collect("cve_summary")        # or "cve_cpe"
💡 What's next?

Once you've got the files, see Now What? for worked queries that turn this data into an actual remediation priority list.