A Python command-line tool that queries the NIST NVD 2.0 API to retrieve CVE details and extract CWE weakness categories, enriched with names and descriptions from the MITRE CWE catalog and cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalog.
- CVE lookup via NVD 2.0 REST API with optional API key support
- CWE enrichment — resolves CWE IDs to full names and descriptions from the MITRE catalog
- CISA KEV cross-reference — flags actively exploited CVEs with date added, remediation due date, and ransomware classification
- CVSS scoring — displays v3.1, v3.0, and v2.0 base scores, severity ratings, and vector strings
- Disk cache — CWE and KEV catalogs cached locally for 24 hours to minimize repeat downloads
- Export — results exportable to JSON or CSV for use in risk registers, dashboards, or downstream tooling
- CLI support — accepts CVE IDs as command-line arguments with a built-in default list fallback
- Python 3.10+
requestspython-dotenv
Install dependencies:
pip install requests python-dotenvAn NVD API key is optional but recommended. Without one, requests are rate-limited to 5 per 30 seconds. With a key, the limit increases to 50 per 30 seconds.
Get a free key at: https://nvd.nist.gov/developers/request-an-api-key
Create a .env file in the project directory:
NVD_API_KEY=your-api-key-here
Note: Add
.envto your.gitignoreto avoid accidentally committing your API key.
# Single CVE
python "NIST NVD CVE-to-CWE Mapper.py" CVE-2021-44228
# Multiple CVEs
python "NIST NVD CVE-to-CWE Mapper.py" CVE-2021-44228 CVE-2022-22965 CVE-2023-44487
# No args — runs built-in default list of 4 CVEs
python "NIST NVD CVE-to-CWE Mapper.py"
# Export to JSON
python "NIST NVD CVE-to-CWE Mapper.py" CVE-2021-44228 CVE-2022-22965 --output results.json
# Export to CSV
python "NIST NVD CVE-to-CWE Mapper.py" CVE-2021-44228 CVE-2022-22965 --output results.csv
# Built-in help
python "NIST NVD CVE-to-CWE Mapper.py" --help======================================================================
CVE ID : CVE-2021-44228
Published: 2021-12-10 Last Modified: 2026-02-20
======================================================================
DESCRIPTION
----------------------------------------------------------------------
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases
2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log
messages, and parameters do not protect against attacker controlled
LDAP and other JNDI related endpoints...
WEAKNESS CATEGORIES (CWE)
----------------------------------------------------------------------
ID : CWE-917
Name : Improper Neutralization of Special Elements used in an
Expression Language Statement ('Expression Language Injection')
Description: The product constructs all or part of an expression
language (EL) statement in a framework such as a Java
Server Page (JSP) using externally-influenced input...
Type : Secondary Source: nvd@nist.gov
CVSS SCORES
----------------------------------------------------------------------
CVSS v3.1: 10.0 (CRITICAL) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0: 9.3 (HIGH) | AV:N/AC:M/Au:N/C:C/I:C/A:C
CISA KEV STATUS
----------------------------------------------------------------------
Status : KNOWN EXPLOITED
Date Added : 2021-12-10
CISA Due Date: 2021-12-24
Ransomware : Known
===========================================================================
CWE SUMMARY TABLE
===========================================================================
CVE ID CWE ID KEV Name
---------------------------------------------------------------------------
CVE-2021-44228 CWE-20 [KEV] Improper Input Validation
CWE-400 Uncontrolled Resource Consumption
CWE-502 Deserialization of Untrusted Data
CWE-917 Improper Neutralization of Special Elements...
CVE-2022-22965 CWE-94 [KEV] Improper Control of Generation of Code
One object per CVE containing KEV status, KEV details, CWE list, and CVSS scores.
[
{
"cve_id": "CVE-2021-44228",
"kev": true,
"kev_details": {
"dateAdded": "2021-12-10",
"dueDate": "2021-12-24",
"ransomwareUse": "Known"
},
"cwes": [...],
"cvss_scores": {...}
}
]One row per CWE mapping with the following columns:
| Column | Description |
|---|---|
| CVE ID | CVE identifier |
| KEV | Yes / No |
| KEV Date Added | Date CISA added to KEV catalog |
| KEV Due Date | CISA remediation due date |
| Ransomware Use | Known / Unknown |
| CWE ID | CWE identifier |
| CWE Name | Full CWE name |
| CWE Type | Primary or Secondary |
| CVSS v3.1 Score | Base score (0.0–10.0) |
| CVSS v3.1 Severity | LOW / MEDIUM / HIGH / CRITICAL |
On first run, the MITRE CWE catalog (~3MB) and CISA KEV catalog are downloaded and stored in a .cache/ directory next to the script. Subsequent runs load from cache and complete significantly faster. Cache files are automatically refreshed after 24 hours.
.cache/
cwe_catalog.json
kev_catalog.json
.cache/can be added to.gitignoresince it is auto-regenerated on demand.
| Source | URL |
|---|---|
| NIST NVD API | https://nvd.nist.gov/developers/vulnerabilities |
| MITRE CWE Catalog | https://cwe.mitre.org/data/downloads.html |
| CISA KEV Catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
- REST API integration (NVD 2.0, CISA KEV)
- XML parsing of third-party data feeds (MITRE CWE)
- Data enrichment and cross-referencing across multiple sources
- Disk-based caching with TTL logic
- CLI design with
argparse - Structured data export (JSON, CSV)
- Environment variable management with
python-dotenv - GRC-relevant tooling: vulnerability classification, exploitability tracking, risk prioritization
Aaron Dutton
License: MIT