Disclosure up front: I work on a patch-management product (TridentStack Control), and this is a free, standalone spin-off of the remediation data we already maintain. No account, nothing gated on the tool or the API. Putting it here rather than at the bottom because it should come before the pitch, not after.

tridentstack.com/cve

Two things send me to NVD constantly, and both have gotten painful. First, the REST API has been flaky for weeks (there was a whole r/cybersecurity thread on it), which is rough if you script against it. Second, NVD tells you a CVE exists but not how to actually fix it.

So the tool focuses on those two. For each CVE it shows the sourced remediation when one exists: the KB for Windows and Office, the fixed version for a package (npm, PyPI, Go, apt, and so on), or the Apple update train, each with a link back to the vendor advisory. When there is no published fix, it says so instead of guessing. It never fabricates a version or KB, which given how many "AI CVE" tools hallucinate fixes felt like the whole point.

There is also a public API, no key and no signup (60 requests/min, no key required):

• GET /api/v1/cve/CVE-2021-44228 (single CVE with remediation)
• GET /api/v1/cve?kev=true&fix=true&severity=critical (filtered list)
• bulk.jsonl for the whole catalog, an OSV export per CVE, and an OpenAPI 3.1 spec

Quick try: curl https://tridentstack.com/api/v1/cve/CVE-2021-44228

It is a cached read layer over NVD plus CISA KEV plus EPSS plus curated remediation sources, so it stays queryable on the days NVD's own API is having issues. That caching is also the point: freshness is bounded by our sync cadence, so it is not real-time, and I am not claiming it is fresher or more complete than NVD. The underlying data is derived from NVD.

For context on why I leaned on a cached layer: since NIST's April notice about record CVE growth, roughly 80% of new CVEs now land without full CVSS/CWE/CPE enrichment, and separately about 29,000 older backlogged CVEs were reclassified as won't-be-enriched. Leaning on a single live source felt fragile.

Sources are public-domain or CC and attributed on the /cve/about page. Sharing it because the "CVE exists, ok but what is the fix" gap and the NVD API flakiness are things I figure a lot of you hit too. Feedback and missing-fix reports welcome.