cvelistV5

What the repository stores

cvelistv5 is a cache of the official CVE List expressed in the CVE JSON 5 format. Rather than being a tool or a service, it is a data repository: the records that describe publicly disclosed vulnerabilities are published here as structured JSON so that consumers can clone or fetch them instead of calling an API for every lookup. The repository README documents the schema and notes that the data format is governed by the CVE Record Format, which has gone through several versions over time. Because the content is the CVE records themselves, the value of the repository is freshness and structure. Security tooling, researchers, and vendors can build local indexes, run offline analysis, or mirror the data on their own schedule. The README also records operational notes from the CVE Program about processing changes, which tells consumers when to expect churn in the data. Treating this as a source of truth for CVE identifiers and descriptions is the intended use, and the JSON 5 layout is meant to be parsed by standard tooling. The repository is the practical outlet for the CVE Program's published data, and the README is where the program communicates format and processing changes to the people who depend on that data daily. It is less a codebase to compile and more a dataset to mirror, which shapes how a consumer should plan to use it.

Schema versions and PURL support

The README tracks format updates that change how records are shaped. One noted update, CVE Record Format 5.2.0 from late October 2025, added support for Package URL identifiers through a packageURL property on affected items, and it set additionalProperties to false for those items. The same update shipped example records, documentation, and infrastructure changes meant to ease future format updates. An earlier update, format 5.1.1 from December 2024, was described as backwards compatible, so previously published records still validate. These notes matter to anyone parsing the files, because a parser must understand which schema version a given record uses. The repository points readers to the cve-schema and cve-services release notes for the full picture. By recording these transitions in the README, the maintainers give downstream consumers a clear signal about when the shape of the data shifted and what new fields became available for querying. The PURL addition in particular matters to teams that map vulnerabilities to specific packages, because it gives a standard identifier instead of free text. Knowing that 5.1.1 was non breaking while 5.2.0 added fields helps a consumer decide whether old parsing code still works or needs adjustment before the next pull. The README also notes that the 5.2.0 changes were described as non breaking, which reassures consumers that existing records would keep validating even as the format grew, and that framing is what lets a team upgrade a parser on its own schedule rather than under pressure when a record suddenly fails to parse.

Tracking recent changes

To help consumers stay current without re pulling the entire set, the repository maintains a deltaLog.json file that normally keeps a rolling 30 days of CVE record modification history. The README explains that during a date normalization process in February 2026 the window was temporarily reduced to 15 days to limit file size while a large number of records were modified, with the full history still available in Git history. This detail shows how the project balances convenience against size: a short delta window lets tools pick up recent edits cheaply, while Git history remains the complete audit trail. The README also notes that consumers can read the delta log to see what changed day to day. For automation, this means a daily job can fetch the delta rather than diffing the whole corpus, which saves bandwidth and compute. The temporary reduction is itself a useful signal that the data was undergoing a bulk cleanup, and the README's candor about it means a consumer will not be surprised when the delta shrinks for a period. The data lives at github.com/CVEProject/cvelistv5 and is offered as the canonical CVE JSON 5 cache for the community, with the README serving as the changelog that explains why the numbers in the delta log moved.

Editorial conclusion

The CVE records are published in the CVE JSON 5 format and hosted in the CVEProject/cvelistv5 repository on GitHub.