Automating CVE search

I was recently automating the search for CVEs affecting some assets. A real life saver for automating this process is to use CPE codes (Common Platform Enumeration). This standard indicates in different fields things like a vendor for a product, the product itself, its version, etc, following:

cpe:<cpe_version>:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>

(https://en.wikipedia.org/wiki/Common_Platform_Enumeration)

For example, part can have the values “a” (application), “o” (operating system) and “h” (hardware).

The following endpoint of NIST’s NVD returns CVEs discovered in a range of dates: …

cpe cve cybersecurity hacking vulnerability