{"swagger": "2.0", "basePath": "/api", "paths": {"/banner": {"put": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Banner"}}, "400": {"description": "Invalid banner."}, "401": {"description": "Authentication required."}, "403": {"description": "Admin permission required."}}, "summary": "Set the site notice", "description": "Only available to administrators.\n\nGuarded by ``admin:access`` rather than a notice-specific permission, and\nthat is deliberate. A new permission is created by the RBAC seed but not\nadded to any existing role -- roles keep their configured permission sets\nunless the seed is run with ``reset``, which would discard an instance's\ncustomisations. The endpoint would then be callable by nobody on precisely\nthe instances that have been running longest, and would be found out during\nthe incident someone was trying to announce.", "operationId": "put_banner", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"type": "object", "properties": {"enabled": {"type": "boolean", "description": "Whether a maintenance notice should be displayed."}, "message": {"type": "string", "default": "", "description": "The notice to display (at most 2000 characters). Stored and returned verbatim; this instance's own pages render a small Markdown subset of it -- emphasis, code, lists and links -- and strip everything else."}}, "required": ["enabled"]}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["banner"]}, "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Banner"}}}, "summary": "Read the site notice", "operationId": "get_banner", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["banner"]}}, "/browse/": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the known vendors", "description": "Deprecated: use GET /api/browse/vendors instead. Get the known vendors.\nDeprecated in favor of /api/browse/vendors.", "operationId": "get_vendors", "deprecated": true, "tags": ["browse"]}}, "/browse/vendors": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the known vendors with their last vulnerability change date", "description": "Get the known vendors with the date of their most recent vulnerability change, most recently changed first. Vendors without a known last change date are listed last with a null last_change.", "operationId": "get_vendors_last_change", "parameters": [{"name": "q", "in": "query", "type": "string", "description": "Case-insensitive substring filter on the name."}, {"name": "since", "in": "query", "type": "string", "description": "Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded."}, {"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return (capped at 1000).", "default": 100}], "tags": ["browse"]}}, "/browse/vendors/{vendor}/products": {"parameters": [{"name": "vendor", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the products of a vendor with their last vulnerability change date", "description": "Get the known products of a vendor with the date of their most recent vulnerability change, most recently changed first. Products without a known last change date are listed last with a null last_change.", "operationId": "get_vendor_products_last_change", "parameters": [{"name": "q", "in": "query", "type": "string", "description": "Case-insensitive substring filter on the name."}, {"name": "since", "in": "query", "type": "string", "description": "Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded."}, {"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return (capped at 1000).", "default": 100}], "tags": ["browse"]}}, "/browse/{vendor}": {"parameters": [{"name": "vendor", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the known products for a vendor", "description": "Deprecated: use GET /api/browse/vendors/<vendor>/products instead. Get the known products for a vendor.\nDeprecated in favor of /api/browse/vendors/<vendor>/products.", "operationId": "get_vendor_products", "deprecated": true, "tags": ["browse"]}}, "/bundle/": {"post": {"responses": {"201": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/BundlesList"}}}, "400": {"description": "JSON validation failed or incorrect payload to instantiate a bundle."}, "403": {"description": "Administrator permission required."}}, "description": "Create a bundle.", "operationId": "post_bundles_list", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/Bundle"}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["bundle"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/BundlesList"}}}}, "summary": "List all bundles", "operationId": "list_bundles", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the bundle."}, {"name": "author", "in": "query", "type": "string", "description": "Author (login) of the bundle."}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Id of a vulnerability referenced by the bundle."}, {"name": "meta", "in": "query", "type": "string", "description": "Query for the meta JSON field. Example: meta=[{'tags': ['tcp']}]"}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the bundles must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the bundles must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["bundle"]}, "delete": {"responses": {"200": {"description": "Deleted bundles successfully."}, "400": {"description": "Invalid UUID format."}, "403": {"description": "Admin permission required."}, "404": {"description": "No bundles matched the filter."}}, "summary": "Delete bundles by vulnerability_lookup_origin", "description": "Delete bundles by vulnerability_lookup_origin (admin only).", "operationId": "delete_bundles_list", "parameters": [{"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "required": true, "description": "Delete bundles from this origin instance UUID."}], "tags": ["bundle"]}}, "/bundle/{bundle_uuid}": {"parameters": [{"name": "bundle_uuid", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Bundle"}}, "404": {"description": "Bundle not found."}}, "description": "Get a bundle with its UUID.", "operationId": "get_bundle_item", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["bundle"]}, "delete": {"responses": {"204": {"description": "Success."}, "403": {"description": "Administrator permission required or not the author of the bundle."}, "404": {"description": "Bundle not found."}}, "summary": "Endpoint for deleting a bundle", "description": "Delete a bundle.\nOnly an admin can delete a bundle.", "operationId": "delete_bundle_item", "tags": ["bundle"]}}, "/capec/": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/CAPECsList"}}}}, "summary": "List all CAPECs", "operationId": "list_capecs", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["capec"]}}, "/capec/{capec_id}": {"parameters": [{"name": "capec_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get detailed information about a CAPEC", "description": "Get detailed information about a CAPEC.", "operationId": "get_capec_item", "tags": ["capec"]}}, "/cna/cve": {"get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "A filtered list of CVE Records, along with pagination fields if results span multiple pages of data", "schema": {"$ref": "#/definitions/CveListUnionResponse"}}}, "summary": "Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)", "operationId": "get_cve", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "time_modified.lt", "in": "query", "type": "string", "format": "date-time", "description": "Most recent CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)"}, {"name": "time_modified.gt", "in": "query", "type": "string", "format": "date-time", "description": "Earliest CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)"}, {"name": "state", "in": "query", "type": "string", "description": "Filter by state", "enum": ["PUBLISHED", "REJECTED"]}, {"name": "assigner_short_name", "in": "query", "type": "string", "description": "Filter by assignerShortName"}, {"name": "assigner", "in": "query", "type": "string", "description": "Filter by assigner org UUID"}, {"name": "page", "in": "query", "type": "integer", "description": "The current page in the paginator", "default": 1}, {"name": "adp_short_name", "in": "query", "type": "string", "description": "Filter by ADP short name"}, {"name": "count_only", "in": "query", "type": "boolean", "description": "Get count of records that match query"}, {"name": "cna_modified", "in": "query", "type": "boolean", "description": "Only get CVE records with cnaContainers modified/created within the time_modified range"}], "tags": ["cna"]}}, "/cna/cve-id": {"post": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "206": {"description": "Partially Reserved CVE IDs", "schema": {"$ref": "#/definitions/PartialReservedCveIdsResponseModel"}}, "200": {"description": "Reseved CVE IDs", "schema": {"$ref": "#/definitions/ReservedCveIdsResonseModel"}}}, "summary": "Reserves CVE IDs for the organization provided in the short_name query parameter (accessible to CNAs and Secretariat)", "operationId": "post_cve_id_info", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "amount", "in": "query", "type": "integer", "required": true, "description": "Quantity of CVE IDs to reserve"}, {"name": "batch_type", "in": "query", "type": "string", "description": "Required when amount is greater than one", "enum": ["sequential", "non-sequential", "nonsequential"]}, {"name": "cve_year", "in": "query", "type": "integer", "required": true, "description": "The year the CVE IDs will be reserved for"}, {"name": "short_name", "in": "query", "type": "string", "description": "The CNA that will own the reserved CVE IDs"}], "tags": ["cna"]}, "get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "Filtered CVE IDs", "schema": {"$ref": "#/definitions/CveIdListResponseModel"}}}, "summary": "Retrieves information about CVE IDs after applying the query parameters as filters (accessible to all registered users)", "operationId": "get_cve_id_info", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "state", "in": "query", "type": "string", "description": "Filter by state", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, {"name": "cve_id_year", "in": "query", "type": "string", "description": "Filter by the year of the CVE IDs"}, {"name": "time_reserved.lt", "in": "query", "type": "string", "format": "date-time", "description": "Most recent reserved timestamp to retrieve"}, {"name": "time_reserved.gt", "in": "query", "type": "string", "format": "date-time", "description": "Earliest CVE ID reserved timestamp to retrieve"}, {"name": "time_modified.lt", "in": "query", "type": "string", "format": "date-time", "description": "Most recent modified timestamp to retrieve"}, {"name": "time_modified.gt", "in": "query", "type": "string", "format": "date-time", "description": "Earliest CVE ID modified timestamp to retrieve"}, {"name": "page", "in": "query", "type": "integer", "description": "The current page in the paginator", "default": 1}, {"name": "sort_by", "in": "query", "type": "string", "description": "Sort field (default: modified)", "default": "modified", "enum": ["created", "modified"]}, {"name": "sort_dir", "in": "query", "type": "string", "description": "Sort direction (default: desc)", "default": "desc", "enum": ["asc", "desc"]}, {"name": "search", "in": "query", "type": "string", "description": "Substring filter on vuln_id (case-insensitive)"}], "tags": ["cna"]}}, "/cna/cve-id-range/{year}": {"parameters": [{"name": "year", "in": "path", "required": true, "type": "integer"}], "post": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE-ID-Range was created"}}, "summary": "Creates a CVE-ID-Range for the specified year (accessible to Secretariat)", "operationId": "post_cve_id_range", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}], "tags": ["cna"]}}, "/cna/cve-id/{id}": {"parameters": [{"name": "id", "in": "path", "required": true, "type": "string"}], "put": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The requested CVE ID information is returned", "schema": {"$ref": "#/definitions/CveIdUpdateModel"}}}, "summary": "Updates information related to the specified CVE ID (accessible to CNAs and Secretariat)", "operationId": "put_cve_id_by_id", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "org", "in": "query", "type": "string", "description": "The shortname of the new owning_cna for the CVE ID"}, {"name": "state", "in": "query", "type": "string", "description": "The id of the CVE ID to update", "enum": ["RESERVED", "REJECTED"]}], "tags": ["cna"]}, "get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "429": {"description": "Too Many Requests", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "200": {"description": "The requested CVE ID information is returned", "schema": {"$ref": "#/definitions/CveIdGetModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}}, "summary": "Retrieves information about the specified CVE ID (accessible to all users)", "operationId": "get_cve_id_by_id", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}], "tags": ["cna"]}}, "/cna/cve/{id}": {"parameters": [{"name": "id", "in": "path", "required": true, "type": "string"}], "post": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CveRecordResponseModel"}}}, "summary": "Creates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat", "description": ")", "operationId": "post_cve_id", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}], "tags": ["cna"]}, "put": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CveRecordUpdateresponseModel"}}}, "summary": "Updates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat", "description": ")", "operationId": "put_cve_id", "tags": ["cna"]}, "get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "429": {"description": "Too Many Requests", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}, "headers": {"RateLimit-Limit": {"description": "Indicates the service limit associated with the client in the current time window.", "type": "string"}, "RateLimit-Policy": {"description": "Indicates a service policy currently associated with the client.", "type": "string"}, "RateLimit-Remaining": {"description": "Indicates the remaining quota units associated with the expiring-limit.", "type": "string"}, "RateLimit-Reset": {"description": "Indicates the number of seconds until the quota resets.", "type": "string"}}}, "200": {"description": "The requested CVE Record", "schema": {"$ref": "#/definitions/CveGetUnionResponse"}}}, "summary": "Returns a CVE Record by CVE ID (accessible to all users)", "operationId": "get_cve_id", "tags": ["cna"]}, "delete": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}}, "operationId": "delete_cve_id", "tags": ["cna"]}}, "/cna/cve/{id}/adp": {"parameters": [{"name": "id", "in": "path", "required": true, "type": "string"}], "put": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CreateCveRecordModel"}}}, "summary": "Inserts or replaces the ADP container for the caller org on an existing CVE Record", "operationId": "put_cve_adp", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/CnaRequestModel"}}], "tags": ["cna"]}}, "/cna/cve/{id}/cna": {"parameters": [{"name": "id", "in": "path", "required": true, "type": "string"}], "post": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CreateCveRecordModel"}}}, "summary": "Creates a CVE Record from CNA Container JSON for the specified ID (accessible to CNAs and Secretariat)", "operationId": "post_cve_cna", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "erlcheck", "in": "query", "type": "boolean", "description": "Enable ERL check"}, {"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/CnaRequestModel"}}], "tags": ["cna"]}, "put": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CreateCveRecordModel"}}}, "operationId": "put_cve_cna", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "erlcheck", "in": "query", "type": "boolean", "description": "Enable ERL check"}, {"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/CnaRequestModel"}}], "tags": ["cna"]}}, "/cna/cve/{id}/reject": {"parameters": [{"name": "id", "in": "path", "required": true, "type": "string"}], "post": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CreateCveRecordModel"}}}, "summary": "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)", "operationId": "post_cve_reject", "tags": ["cna"]}, "put": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "The CVE Record created", "schema": {"$ref": "#/definitions/CreateCveRecordModel"}}}, "operationId": "put_cve_reject", "tags": ["cna"]}}, "/cna/cve_count": {"get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "\tA count of the total number of filtered CVE records", "schema": {"$ref": "#/definitions/RecordCountModel"}}}, "summary": "Retrieves the count of all the CVE Records after applying the query parameters as filters (accessible to all users)", "operationId": "get_cve_count", "parameters": [{"name": "state", "in": "query", "type": "string", "description": "Filter by state", "enum": ["PUBLISHED", "REJECTED"]}], "tags": ["cna"]}}, "/cna/cve_cursor": {"get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}, "200": {"description": "A filtered list of CVE Records, along with pagination fields if results span multiple pages of data", "schema": {"$ref": "#/definitions/CveCursorUnionResponse"}}}, "summary": "Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)", "operationId": "get_cve_cursor", "parameters": [{"name": "time_modified.lt", "in": "query", "type": "string", "format": "date-time", "description": "Most recent CVE record modified timestamp to retrieve"}, {"name": "time_modified.gt", "in": "query", "type": "string", "format": "date-time", "description": "Earliest CVE record modified timestamp to retrieve"}, {"name": "state", "in": "query", "type": "string", "description": "Filter by state", "enum": ["PUBLISHED", "REJECTED"]}, {"name": "count_only", "in": "query", "type": "boolean", "description": "Get count of records that match query"}, {"name": "assigner_short_name", "in": "query", "type": "string", "description": "Filter by assignerShortName"}, {"name": "assigner", "in": "query", "type": "string", "description": "Filter by assigner org UUID"}, {"name": "cna_modified", "in": "query", "type": "boolean", "description": "Only get CVE records with cnaContainers that have been modified/created within the set time_modified range"}, {"name": "adp_short_name", "in": "query", "type": "string", "description": "Only get CVE records that have an adpContainer owned by this org"}, {"name": "next_page", "in": "query", "type": "string", "description": "Key returned by a GET /cve_cursor call that must be used to get the next page of results in a subsequent call"}, {"name": "previous_page", "in": "query", "type": "string", "description": "Key returned by a GET /cve_cursor call that must be used to get the previous page of results in a subsequent call"}, {"name": "limit", "in": "query", "type": "integer", "description": "Maximum number of records to return"}], "tags": ["cna"]}}, "/cna/health-check": {"get": {"responses": {"200": {"description": "Returns a 200 respose code"}}, "summary": "Check that the system is running", "description": "Checks that the system is running (accessible to all users)", "operationId": "get_health_check", "tags": ["cna"]}}, "/cna/org": {"get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}}, "operationId": "get_org", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "page", "in": "query", "type": "integer", "description": "The current page in the paginator", "default": 1}], "tags": ["cna"]}}, "/cna/org/{identifier}": {"parameters": [{"name": "identifier", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}}, "operationId": "get_org_id", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}], "tags": ["cna"]}}, "/cna/users": {"get": {"responses": {"500": {"description": "Internal Server Error", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "404": {"description": "Not Found", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "403": {"description": "Forbidden", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "401": {"description": "Not Authenticated", "schema": {"$ref": "#/definitions/GenericErrorModel"}}, "400": {"description": "Bad Request", "schema": {"$ref": "#/definitions/BadRequestModel"}}}, "operationId": "get_users", "parameters": [{"name": "CVE-API-ORG", "in": "header", "type": "string", "description": "Organization shortname is required"}, {"name": "CVE-API-USER", "in": "header", "type": "string", "description": "Username is required"}, {"name": "CVE-API-KEY", "in": "header", "type": "string", "description": "API key is required"}, {"name": "page", "in": "query", "type": "integer", "description": "The current page in the paginator", "default": 1}], "tags": ["cna"]}}, "/cna_credential/": {"get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/CNACredentialsList"}}}, "403": {"description": "Admin permission required."}}, "summary": "List the CNA credentials", "description": "Only available to administrators.", "operationId": "list_cna_credentials", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 10}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["cna_credential"]}}, "/cna_credential/{credential_id}": {"parameters": [{"name": "credential_id", "in": "path", "required": true, "type": "integer"}], "put": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/CNACredential"}}, "403": {"description": "Admin permission required."}, "404": {"description": "CNA credential not found."}}, "summary": "Enable or disable CNA publication for the user bound to a credential", "description": "Enable or disable CNA publication for the user bound to a credential. Only available to administrators.", "operationId": "put_cna_credential_item", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"type": "object", "properties": {"enabled": {"type": "boolean", "description": "Whether CNA publication is allowed for the user bound to this credential."}}, "required": ["enabled"]}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["cna_credential"]}, "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/CNACredential"}}, "403": {"description": "Admin permission required."}, "404": {"description": "CNA credential not found."}}, "summary": "Get a CNA credential", "description": "Get a CNA credential. Only available to administrators.\nOnly available to administrators.", "operationId": "get_cna_credential_item", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["cna_credential"]}}, "/comment/": {"post": {"responses": {"201": {"description": "Comment created or updated.", "schema": {"type": "array", "items": {"$ref": "#/definitions/CommentsList"}}}, "400": {"description": "Invalid comment payload or comment update failed."}, "403": {"description": "Insufficient permission."}}, "summary": "Create a new comment or update an existing one", "description": "Create or update a comment related to a security advisory.", "operationId": "post_comments_list", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/Comment"}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["comment"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/CommentsList"}}}}, "summary": "List all comments", "operationId": "list_comments", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the comment."}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Vulnerability related to the comment."}, {"name": "author", "in": "query", "type": "string", "description": "Author of the comment."}, {"name": "meta", "in": "query", "type": "string", "description": "Query for the meta JSON field. Tags are matched exactly. Example: meta=[{'tags': ['vulnerability:information=PoC']}]"}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the comments must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the comments must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["comment"]}, "delete": {"responses": {"200": {"description": "Deleted comments successfully."}, "400": {"description": "Invalid UUID format."}, "403": {"description": "Admin permission required."}, "404": {"description": "No comments matched the filter."}}, "summary": "Delete comments by vulnerability_lookup_origin", "description": "Delete comments by vulnerability_lookup_origin (admin only).", "operationId": "delete_comments_list", "parameters": [{"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "required": true, "description": "Delete comments from this origin instance UUID."}], "tags": ["comment"]}}, "/comment/{comment_uuid}": {"parameters": [{"name": "comment_uuid", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Comment"}}, "404": {"description": "Comment not found."}}, "description": "Get a comment with its UUID.", "operationId": "get_comment_item", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["comment"]}, "delete": {"responses": {"204": {"description": "Success."}, "403": {"description": "Commenter permission required or not the author of the comment."}, "404": {"description": "Comment not found."}}, "summary": "Delete a comment", "description": "Delete a comment.", "operationId": "delete_comment_item", "tags": ["comment"]}}, "/cpe_editor/status/{vulnerability_id}": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the CPE Editor catalog status for a vulnerability's affected products", "description": "Check whether the CPEs referenced by a cvelistv5 vulnerability already exist in the CPE Editor catalog.", "operationId": "get_cpe_editor_status", "tags": ["cpe_editor"]}}, "/cwe/": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/CWEsList"}}}}, "summary": "List all CWEs", "operationId": "list_cwes", "parameters": [{"name": "vuln_id", "in": "query", "type": "string", "description": "ID of a vulnerability that references one or more CWE identifiers."}, {"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "exclude_discouraged", "in": "query", "type": "boolean", "description": "Exclude CWEs whose Mapping_Notes Usage is Discouraged.", "default": false}, {"name": "exclude_prohibited", "in": "query", "type": "boolean", "description": "Exclude CWEs whose Mapping_Notes Usage is Prohibited.", "default": false}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["cwe"]}}, "/cwe/{cwe_id}": {"parameters": [{"name": "cwe_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get detailed information about a CWE", "description": "Get detailed information about a CWE.", "operationId": "get_cwe_item", "tags": ["cwe"]}}, "/emb3d/": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/EMB3DsList"}}}}, "summary": "List all Adversarial Techniques from MITRE EMB3D", "operationId": "list_emb3ds", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Vulnerability identifier."}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["emb3d"]}}, "/emb3d/{emb3d_id}": {"parameters": [{"name": "emb3d_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get detailed information about a MITRE EMB3D Adversarial Technique", "description": "Get detailed information about a MITRE EMB3D Adversarial Technique.", "operationId": "get_emb3_d_item", "tags": ["emb3d"]}}, "/epss/{vulnerability_id}": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}, "404": {"description": "EPSS score not found."}, "502": {"description": "Bad Gateway: Invalid response from EPSS service."}, "503": {"description": "Service Unavailable: Unable to reach EPSS service or misconfigured."}}, "summary": "Get the EPSS score of a vulnerability", "description": "Get the EPSS score of a vulnerability.", "operationId": "get_epss_item", "tags": ["epss"]}}, "/euvd/": {"get": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/EUVDList"}}, "503": {"description": "The exploited-vulnerability data is unavailable.", "schema": {"$ref": "#/definitions/EUVDError"}}}, "summary": "List EUVD entries, most recently updated first", "operationId": "get_euvd_list", "parameters": [{"name": "limit", "in": "query", "type": "integer", "minimum": 1, "maximum": 100, "description": "Maximum number of entries to return (1 to 100).", "default": 10}, {"name": "coordinated", "in": "query", "type": "boolean", "description": "Only entries whose linked CVE was assigned by a coordinated (EU CSIRT) CNA.", "default": false}, {"name": "cvss_min", "in": "query", "type": "string", "description": "Only entries whose linked CVE has a CVSS base score strictly above this."}, {"name": "exploited", "in": "query", "type": "boolean", "description": "Only entries whose linked CVE is listed in a KEV catalog.", "default": false}, {"name": "with_products", "in": "query", "type": "boolean", "description": "Include the affected-product rows (one per affected version).", "default": false}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["euvd"]}}, "/euvd/advisory/{identifier}": {"parameters": [{"description": "The advisory's tracking id, e.g. TEST-SA-2026-0001.", "name": "identifier", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDAdvisory"}}, "404": {"description": "No advisory with this identifier.", "schema": {"$ref": "#/definitions/EUVDError"}}}, "summary": "One CSAF advisory, by its own tracking id", "operationId": "get_euvd_advisory", "parameters": [{"name": "with_products", "in": "query", "type": "boolean", "description": "Include the advisory's affected-product rows.", "default": true}], "tags": ["euvd"]}}, "/euvd/assigners/names": {"get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"type": "string", "description": "Assigner name."}}}}, "summary": "List the coordinated assigner names", "operationId": "get_euvd_assigner_names", "tags": ["euvd"]}}, "/euvd/search": {"get": {"responses": {"503": {"description": "The exploited-vulnerability data is unavailable.", "schema": {"$ref": "#/definitions/EUVDError"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDError"}}, "200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDSearchResult"}}}, "summary": "Search EUVD entries", "operationId": "get_euvd_search_endpoint", "parameters": [{"name": "page", "in": "query", "type": "integer", "minimum": 1, "maximum": 1000, "description": "Page number (1 to 1000).", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "minimum": 1, "maximum": 100, "description": "Entries per page (1 to 100).", "default": 10}, {"name": "sort", "in": "query", "type": "string", "description": "Dimension to order by. 'published' and 'reserved' also restrict the result to entries that carry that date, so they can return fewer entries than 'updated'; 'updated' is set for every entry and never restricts.", "default": "updated", "enum": ["updated", "published", "reserved"]}, {"name": "order", "in": "query", "type": "string", "description": "Ordering direction.", "default": "desc", "enum": ["asc", "desc"]}, {"name": "published_from", "in": "query", "type": "string", "description": "Earliest publication date (ISO-8601)."}, {"name": "published_to", "in": "query", "type": "string", "description": "Latest publication date (ISO-8601)."}, {"name": "updated_from", "in": "query", "type": "string", "description": "Earliest update date (ISO-8601)."}, {"name": "updated_to", "in": "query", "type": "string", "description": "Latest update date (ISO-8601)."}, {"name": "exploited_from", "in": "query", "type": "string", "description": "Earliest exploited-since date (ISO-8601)."}, {"name": "exploited_to", "in": "query", "type": "string", "description": "Latest exploited-since date (ISO-8601)."}, {"name": "text", "in": "query", "type": "string", "description": "Free text matched against the linked CVE's indexed content. Requires full-text search to be enabled on the instance."}, {"name": "assigner", "in": "query", "type": "string", "description": "Assigner (CNA) of the linked CVE. Matched exactly, as upstream does."}, {"name": "cvss_min", "in": "query", "type": "string", "description": "Lowest CVSS base score (0..10) to include. Entries whose linked CVE has no score at all are excluded, since nothing about them can satisfy a lower bound."}, {"name": "cvss_max", "in": "query", "type": "string", "description": "Highest CVSS base score (0..10) to include. Unscored entries are kept, so cvss_max=10 is a no-op rather than a filter."}, {"name": "epss_min", "in": "query", "type": "string", "description": "Lowest EPSS probability (0..1) to include. Entries with no EPSS score are excluded, as for cvss_min."}, {"name": "epss_max", "in": "query", "type": "string", "description": "Highest EPSS probability (0..1) to include. Unscored entries are kept, so epss_max=1 is a no-op."}, {"name": "exploited", "in": "query", "type": "boolean", "description": "Restrict to entries listed (true) or not listed (false) in a KEV catalog."}, {"name": "kev_catalog", "in": "query", "type": "string", "description": "Restrict to entries exploited in this KEV catalog."}, {"name": "vendor", "in": "query", "type": "string", "description": "Affected vendor. Matches any vendor starting with this."}, {"name": "product", "in": "query", "type": "string", "description": "Affected product. Matches any product starting with this."}, {"name": "with_products", "in": "query", "type": "boolean", "description": "Include the affected-product rows (one per affected version).", "default": false}], "tags": ["euvd"]}}, "/euvd/stats/assigners/ranking": {"get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/EUVDStatsAssignerRank"}}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "List the top assigners", "operationId": "get_euvd_stats_assigners_ranking", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "How many entries to return, capped at 100.", "default": 10}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/count": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsCount"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Count the catalogue per year, or per month within one year", "operationId": "get_euvd_stats_count", "parameters": [{"name": "granularity", "in": "query", "type": "string", "description": "Period granularity of the counts.", "default": "year", "enum": ["year", "month"]}, {"name": "period", "in": "query", "type": "string", "description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/cvss/scores": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsDistribution"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Distribution of records by severity band", "operationId": "get_euvd_stats_cvss_scores", "parameters": [{"name": "period", "in": "query", "type": "string", "description": "Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/cvss/versions": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsDistribution"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Distribution of records by CVSS version", "operationId": "get_euvd_stats_cvss_versions", "parameters": [{"name": "period", "in": "query", "type": "string", "description": "Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/kev": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsKEV"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Report known-exploited inclusion, in total or per period", "operationId": "get_euvd_stats_kev", "parameters": [{"name": "granularity", "in": "query", "type": "string", "description": "Omit for the known-exploited membership counts. With year or month, the number of records each catalogue listed per period instead.", "default": "", "enum": ["", "year", "month"]}, {"name": "period", "in": "query", "type": "string", "description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused otherwise, where the answer already carries every year.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/status": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsStatus"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Report the catalogue's lifecycle split, whole or for one year", "operationId": "get_euvd_stats_status", "parameters": [{"name": "period", "in": "query", "type": "string", "description": "Restrict the figure to one publication year (YYYY). Omit for the whole catalogue.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/stats/time_to_exploit": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDStatsTimeToExploit"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "Report the publication-to-exploitation summary, whole, for one year, or per year", "operationId": "get_euvd_stats_time_to_exploit", "parameters": [{"name": "period", "in": "query", "type": "string", "description": "Restrict the figure to one publication year (YYYY). Omit for the whole catalogue.", "default": ""}, {"name": "granularity", "in": "query", "type": "string", "description": "year for every publication year at once, each with its own summary and count. Not combined with period.", "default": "", "enum": ["", "year"]}], "tags": ["euvd-stats"]}}, "/euvd/stats/vendors/ranking": {"get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/EUVDStatsVendorRank"}}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/EUVDStatsError"}}}, "summary": "List the top vendors", "operationId": "get_euvd_stats_vendors_ranking", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "How many entries to return, capped at 100.", "default": 10}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.", "default": ""}], "tags": ["euvd-stats"]}}, "/euvd/{identifier}": {"parameters": [{"description": "An EUVD id, a CVE id, or any alias the entry covers.", "name": "identifier", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/EUVDDetail"}}, "404": {"description": "No EUVD entry for this identifier.", "schema": {"$ref": "#/definitions/EUVDError"}}}, "summary": "One EUVD entry in full, by its own id or by any identifier it covers", "operationId": "get_euvd_detail", "tags": ["euvd"]}}, "/exploit-hazard": {"post": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid model parameters."}, "503": {"description": "Storage backend unavailable."}}, "description": "Compute the local exploit hazard for a vulnerability instance from an ELM probability such as EPSS, user-provided control effectiveness, optional KEV policy parameters, and exponential or Weibull hazard settings.", "operationId": "post_exploit_hazard", "tags": ["exploit-hazard"]}}, "/exploit-hazard/": {"post": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid model parameters."}, "503": {"description": "Storage backend unavailable."}}, "description": "Compute the local exploit hazard for a vulnerability instance from an ELM probability such as EPSS, user-provided control effectiveness, optional KEV policy parameters, and exponential or Weibull hazard settings.", "operationId": "post_exploit_hazard", "tags": ["exploit-hazard"]}}, "/exploit-hazard/batch": {"post": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid request or model parameters."}, "503": {"description": "Storage backend unavailable."}}, "description": "Aggregate the local exploit hazard of a set of vulnerability instances (section 3.6 of the referenced paper): per-instance hazards, their sum as the aggregate daily hazard, and the Poisson probability of at least one exploitation event over the common horizon. Instances are the same objects the single endpoint accepts \u2014 or plain vulnerability-id strings \u2014 and optional shared 'parameters' (controls, KEV policy, Weibull shape) apply to every instance.", "operationId": "post_exploit_hazard_batch", "tags": ["exploit-hazard"]}}, "/gcve/publication": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "List the GCVE published by the local Vulnerability-Lookup instance", "operationId": "List the GCVE published by the local Vulnerability-Lookup instance (as a GNA).", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 30}, {"name": "date_sort", "in": "query", "type": "string", "description": "Field to sort by (published, updated, reserved).", "default": "updated"}, {"name": "sort_order", "in": "query", "type": "string", "description": "Sort order: asc or desc.", "default": "desc"}, {"name": "since", "in": "query", "type": "string", "description": "Retrieve vulnerabilities published/updated after this date.", "default": ""}], "tags": ["gcve"]}}, "/gcve/registry": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/GNAsList"}}}}, "summary": "List the GNAs from the local GCVE registry of the Vulnerability-Lookup instance", "operationId": "List the GNAs from the local GCVE registry of the Vulnerability-Lookup instance.", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 100}, {"name": "short_name", "in": "query", "type": "string", "description": "Short name of the organization.", "default": ""}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["gcve"]}}, "/gcve/registry/integrity": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Verify the integrity of the local registry", "operationId": "Verify the integrity of the registry.", "tags": ["gcve"]}}, "/kev": {"post": {"responses": {"200": {"description": "Success"}}, "summary": "Create new KEV entry", "operationId": "post_kev_list", "tags": ["kev"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/KEVList"}}}, "summary": "List KEV entries with pagination and filtering", "operationId": "get_kev_list", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Page number", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Items per page (max 1000)", "default": 100}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Filter by vulnerability ID"}, {"name": "status_reason", "in": "query", "type": "string", "enum": ["confirmed", "suspected", "disputed", "historical", "unknown", "withdrawn"]}, {"name": "exploited", "in": "query", "type": "string", "enum": ["true", "false", "all"], "description": "Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all."}, {"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "description": "Filter by origin instance UUID"}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "Filter from date (YYYY-MM-DD)"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "Filter to date (YYYY-MM-DD)"}, {"name": "author", "in": "query", "type": "string", "description": "Filter by author login"}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["kev"]}}, "/kev/": {"post": {"responses": {"200": {"description": "Success"}}, "summary": "Create new KEV entry", "operationId": "post_kev_list", "tags": ["kev"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/KEVList"}}}, "summary": "List KEV entries with pagination and filtering", "operationId": "get_kev_list", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Page number", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Items per page (max 1000)", "default": 100}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Filter by vulnerability ID"}, {"name": "status_reason", "in": "query", "type": "string", "enum": ["confirmed", "suspected", "disputed", "historical", "unknown", "withdrawn"]}, {"name": "exploited", "in": "query", "type": "string", "enum": ["true", "false", "all"], "description": "Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all."}, {"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "description": "Filter by origin instance UUID"}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "Filter from date (YYYY-MM-DD)"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "Filter to date (YYYY-MM-DD)"}, {"name": "author", "in": "query", "type": "string", "description": "Filter by author login"}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["kev"]}}, "/kev/catalog/{catalog_uuid}": {"parameters": [{"name": "catalog_uuid", "in": "path", "required": true, "type": "string"}], "delete": {"responses": {"200": {"description": "Success"}}, "summary": "Delete all KEV entries from a specific catalog", "operationId": "delete_kev_catalog_batch", "tags": ["kev"]}}, "/kev/origin/{origin_uuid}/{vuln_id}": {"parameters": [{"name": "origin_uuid", "in": "path", "required": true, "type": "string"}, {"name": "vuln_id", "in": "path", "required": true, "type": "string"}], "put": {"responses": {"200": {"description": "Success"}}, "summary": "Update KEV entry by (origin_uuid, vulnId) (author or admin only)", "operationId": "put_kev_detail_by_identifier", "tags": ["kev"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/KEVEntry"}}}, "summary": "Get single KEV entry by (origin_uuid, vulnId)", "operationId": "get_kev_detail_by_identifier", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["kev"]}, "delete": {"responses": {"200": {"description": "Success"}}, "summary": "Delete KEV entry by (origin_uuid, vulnId) (admin only)", "operationId": "delete_kev_detail_by_identifier", "tags": ["kev"]}}, "/kev/{kev_uuid}": {"parameters": [{"name": "kev_uuid", "in": "path", "required": true, "type": "string"}], "put": {"responses": {"200": {"description": "Success"}}, "summary": "Update KEV entry (author or admin only)", "operationId": "put_kev_detail", "tags": ["kev"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/KEVEntry"}}}, "summary": "Get single KEV entry", "operationId": "get_kev_detail", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["kev"]}, "delete": {"responses": {"200": {"description": "Success"}}, "summary": "Delete KEV entry (admin only)", "operationId": "delete_kev_detail", "tags": ["kev"]}}, "/organization/": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/OrganizationsList"}}}}, "summary": "List all organizations", "operationId": "list_organizations", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 1000}, {"name": "id", "in": "query", "type": "integer", "description": "ID of the organization."}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the organization."}, {"name": "name", "in": "query", "type": "string", "description": "The name of the organization."}, {"name": "gna_id", "in": "query", "type": "integer", "description": "The reserved GNA identifier of the organization."}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["organization"]}}, "/product/": {"get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/ProductsList"}}}}, "summary": "List all products", "operationId": "list_products", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 1000}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the product."}, {"name": "name", "in": "query", "type": "string", "description": "The name of the product."}, {"name": "organization_name", "in": "query", "type": "string", "description": "The name of the organization related to the product."}, {"name": "organization_id", "in": "query", "type": "string", "description": "The id of the organization related to the product."}, {"name": "organization_uuid", "in": "query", "type": "string", "description": "The uuid of the organization related to the product."}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["product"]}}, "/rulezet/search_rules_by_vulnerabilities/{vulnerability_id}": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/RulesList"}}}, "404": {"description": "Rule not found in Rulezet."}, "502": {"description": "Bad Gateway: Invalid response from Rulezet."}, "503": {"description": "Service Unavailable: Unable to reach Rulezet or misconfigured."}}, "summary": "Get rules from Rulezet by vulnerability id", "description": "Get rules from Rulezet by vulnerability id.", "operationId": "get_rulezet_item", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 50}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["rulezet"]}}, "/sighting": {"post": {"responses": {"201": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/SightingsList"}}}, "400": {"description": "Incorrect payload to instantiate a sighting."}, "409": {"description": "Duplicate sighting."}}, "summary": "Create a new sighting", "description": "Create a new sighting.", "operationId": "post_sightings_list", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/Sighting"}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["sighting"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/SightingsList"}}}}, "summary": "List all sightings", "operationId": "list_sightings", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 1000}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the sighting."}, {"name": "type", "in": "query", "type": "string", "description": "Type of sightings:\n     - Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.\n     - Published Proof of Concept: A public proof of concept is available for this vulnerability.\n     - Exploited: This vulnerability was exploited and seen by the user reporting the sighting.\n     - Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.\n     - Confirmed: The vulnerability is confirmed from an analyst perspective.\n     - Not confirmed: The user expresses doubt about the veracity of the vulnerability.\n     - Patched: This vulnerability was successfully patched by the user reporting the sighting.\n     - Not patched: This vulnerability was not successfully patched by the user reporting the sighting.", "enum": ["seen", "published-proof-of-concept", "exploited", "not-exploited", "confirmed", "not-confirmed", "patched", "not-patched"]}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Vulnerability related to the sighting."}, {"name": "author", "in": "query", "type": "string", "description": "Author of the sighting (login)."}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "source", "in": "query", "type": "string", "description": "Source of the sighting."}, {"name": "advisory_status", "in": "query", "type": "string", "description": "Filter sightings by the status of the related advisory.", "enum": ["unpublished"]}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["sighting"]}, "delete": {"responses": {"200": {"description": "Deleted sightings successfully."}, "403": {"description": "Not allowed to delete these sightings."}, "404": {"description": "No sightings matched the filters."}}, "summary": "Delete sightings by filters (author, source, date)", "description": "Delete sightings by filters (author, source, date). At least one filter must be specified.\nAt least one filter must be specified.", "operationId": "delete_sightings_list", "parameters": [{"name": "author", "in": "query", "type": "string", "description": "Author of the sightings to delete (login). Only the author themselves or an admin can delete."}, {"name": "source", "in": "query", "type": "string", "description": "Source of the sightings (supports partial match using ilike)."}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "Delete sightings from this date (inclusive). Format: YYYY-MM-DD."}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "Delete sightings up to this date (inclusive). Format: YYYY-MM-DD."}, {"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "description": "Delete sightings from this origin instance UUID."}], "tags": ["sighting"]}}, "/sighting/": {"post": {"responses": {"201": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/SightingsList"}}}, "400": {"description": "Incorrect payload to instantiate a sighting."}, "409": {"description": "Duplicate sighting."}}, "summary": "Create a new sighting", "description": "Create a new sighting.", "operationId": "post_sightings_list", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/Sighting"}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["sighting"]}, "get": {"responses": {"200": {"description": "Success", "schema": {"type": "array", "items": {"$ref": "#/definitions/SightingsList"}}}}, "summary": "List all sightings", "operationId": "list_sightings", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 1000}, {"name": "uuid", "in": "query", "type": "string", "description": "UUID of the sighting."}, {"name": "type", "in": "query", "type": "string", "description": "Type of sightings:\n     - Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.\n     - Published Proof of Concept: A public proof of concept is available for this vulnerability.\n     - Exploited: This vulnerability was exploited and seen by the user reporting the sighting.\n     - Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.\n     - Confirmed: The vulnerability is confirmed from an analyst perspective.\n     - Not confirmed: The user expresses doubt about the veracity of the vulnerability.\n     - Patched: This vulnerability was successfully patched by the user reporting the sighting.\n     - Not patched: This vulnerability was not successfully patched by the user reporting the sighting.", "enum": ["seen", "published-proof-of-concept", "exploited", "not-exploited", "confirmed", "not-confirmed", "patched", "not-patched"]}, {"name": "vuln_id", "in": "query", "type": "string", "description": "Vulnerability related to the sighting."}, {"name": "author", "in": "query", "type": "string", "description": "Author of the sighting (login)."}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "source", "in": "query", "type": "string", "description": "Source of the sighting."}, {"name": "advisory_status", "in": "query", "type": "string", "description": "Filter sightings by the status of the related advisory.", "enum": ["unpublished"]}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["sighting"]}, "delete": {"responses": {"200": {"description": "Deleted sightings successfully."}, "403": {"description": "Not allowed to delete these sightings."}, "404": {"description": "No sightings matched the filters."}}, "summary": "Delete sightings by filters (author, source, date)", "description": "Delete sightings by filters (author, source, date). At least one filter must be specified.\nAt least one filter must be specified.", "operationId": "delete_sightings_list", "parameters": [{"name": "author", "in": "query", "type": "string", "description": "Author of the sightings to delete (login). Only the author themselves or an admin can delete."}, {"name": "source", "in": "query", "type": "string", "description": "Source of the sightings (supports partial match using ilike)."}, {"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "Delete sightings from this date (inclusive). Format: YYYY-MM-DD."}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "Delete sightings up to this date (inclusive). Format: YYYY-MM-DD."}, {"name": "vulnerability_lookup_origin", "in": "query", "type": "string", "description": "Delete sightings from this origin instance UUID."}], "tags": ["sighting"]}}, "/sighting/stats": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Aggregated sighting counts over a date range. Returns pre-grouped (no pagination) rows so the homepage can render the top-N charts and the evolution table without fetching raw sightings.", "operationId": "sightings_stats", "parameters": [{"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "Inclusive lower bound of creation date. Format: YYYY-MM-DD."}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "Inclusive upper bound of creation date. Format: YYYY-MM-DD."}, {"name": "type", "in": "query", "type": "string", "description": "Optional filter on sighting type.", "enum": ["seen", "published-proof-of-concept", "exploited", "not-exploited", "confirmed", "not-confirmed", "patched", "not-patched"]}, {"name": "group_by", "in": "query", "type": "string", "required": true, "description": "Grouping dimensions. 'type,vulnerability' returns per-type vulnerability counts (charts); 'vulnerability,date' returns daily counts per vulnerability (table).", "enum": ["type,vulnerability", "vulnerability,date"]}], "tags": ["sighting"]}}, "/sighting/{sighting_uuid}": {"parameters": [{"name": "sighting_uuid", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Sighting"}}, "404": {"description": "Sighting not found."}}, "description": "Get a sighting with its UUID.", "operationId": "get_sighting_item", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["sighting"]}, "delete": {"responses": {"200": {"description": "Sighting deleted successfully."}, "403": {"description": "Not allowed to delete this sighting."}, "404": {"description": "Sighting not found."}}, "summary": "Delete a single sighting by UUID", "description": "Delete a single sighting by its UUID.", "operationId": "delete_sighting_item", "tags": ["sighting"]}}, "/sighting/{sighting_uuid}/correlations": {"parameters": [{"name": "sighting_uuid", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/SourceCorrelations"}}, "404": {"description": "Sighting not found."}}, "summary": "Get the correlations of a sighting's source", "description": "The vulnerabilities sighted by the same source as this sighting: every vulnerability the sighting's source filed sightings of, most sighted first, each with the source's latest sighting of it. The source is matched exactly. A sighting that named no source has no correlations. The correlations page of a sighting draws this document.", "operationId": "get_sighting_correlations", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "Vulnerabilities listed, most sighted first (1 to 500).", "default": 100}], "tags": ["sighting"]}}, "/stats/assigners/ranking": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the assigners ranking.", "operationId": "get_assigners_ranking", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "The top elements to take into account in the query (at most 100).", "default": 10}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}, {"name": "period", "in": "query", "type": "string", "description": "The period of the stats. Format: YYYY[-MM]", "default": ""}, {"name": "source", "in": "query", "type": "string", "description": "The source of the vulnerability advisories.", "default": "cvelistv5", "enum": ["cvelistv5", "certfr_avis", "certfr_alerte", "euvd"]}], "tags": ["stats"]}}, "/stats/credits/ranking": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the credits ranking.", "operationId": "get_credits_ranking", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "Number of credits to return (default: 10, maximum: 1000).", "default": 10}, {"name": "offset", "in": "query", "type": "integer", "minimum": 0, "description": "Number of ranked credits to skip, to page through the ranking.", "default": 0}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}, {"name": "period", "in": "query", "type": "string", "description": "The period of the stats. Format: YYYY[-MM]", "default": ""}, {"name": "source", "in": "query", "type": "string", "description": "Optional feeder name. If omitted, the combined ranking across all credit-indexing sources (the CVE list and the CSAF feeders) is returned."}], "tags": ["stats"]}}, "/stats/cvss/scores": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsDistribution"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the severity band distribution of a source.", "operationId": "get_cvss_scores", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the distribution to one publication year (YYYY). Omit for the whole source.", "default": ""}], "tags": ["stats"]}}, "/stats/cvss/versions": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsDistribution"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the CVSS version distribution of a source.", "operationId": "get_cvss_versions", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the distribution to one publication year (YYYY). Omit for the whole source.", "default": ""}], "tags": ["stats"]}}, "/stats/cwe/most_used": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the most used CWEs based on sightings", "operationId": "get_cwe_most_used", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "The top elements to take into account in the query (at most 100).", "default": 10}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}, {"name": "period", "in": "query", "type": "string", "description": "The period of the stats. Format: YYYY[-MM]", "default": ""}], "tags": ["stats"]}}, "/stats/kev": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsKEV"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns known-exploited inclusion for a source. Without granularity, the membership counts: how many of its records appear in each catalogue. With granularity=year or month, how many each catalogue listed per period, bucketed on the date the catalogue listed the record rather than on the record's publication date.", "operationId": "get_kev_inclusion", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "granularity", "in": "query", "type": "string", "description": "Omit for the known-exploited membership counts. With year or month, the number of records each catalogue listed per period instead.", "default": "", "enum": ["", "year", "month"]}, {"name": "period", "in": "query", "type": "string", "description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused otherwise, where the answer already carries every year.", "default": ""}], "tags": ["stats"]}}, "/stats/scorecard/assigner": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/ScorecardAssigner"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns one assigner's scorecard.", "operationId": "get_scorecard_assigner", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "assigner", "in": "query", "type": "string", "required": true, "description": "The assigner short name (a CNA), or the GNA source name (gna-<id>) for a GNA source."}], "tags": ["stats"]}}, "/stats/scorecard/catalogue": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/KEVScorecardCatalogue"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns one catalogue's scorecard.", "operationId": "get_kev_scorecard_catalogue", "parameters": [{"name": "catalogue", "in": "query", "type": "string", "required": true, "description": "The catalogue's UUID, as carried by its entries (vulnerability_lookup_origin)."}], "tags": ["stats"]}}, "/stats/scorecard/catalogues": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/KEVScorecardRanking"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the catalogue scorecard ranking.", "operationId": "get_kev_scorecard_ranking", "parameters": [{"name": "period", "in": "query", "type": "string", "description": "'window' (the rolling window the ranking is built on, the default), 'all', or a listing year (YYYY).", "default": "window"}, {"name": "limit", "in": "query", "type": "integer", "description": "The most entries to return, at most 100.", "default": 100}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/scorecard/gnas": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/ScorecardGNARanking"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the cross-GNA scorecard ranking.", "operationId": "get_scorecard_gn_as", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "'window' (the rolling window the ranking is built on, the default), 'all', or a publication year (YYYY).", "default": "window"}, {"name": "limit", "in": "query", "type": "integer", "description": "The most entries to return, at most 500.", "default": 100}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/scorecard/ranking": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/ScorecardRanking"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the assigner scorecard ranking of a source.", "operationId": "get_scorecard_ranking", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "'window' (the rolling window the ranking is built on, the default), 'all', or a publication year (YYYY).", "default": "window"}, {"name": "limit", "in": "query", "type": "integer", "description": "The most entries to return, at most 500.", "default": 100}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/scorecard/signals": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/ScorecardSignals"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the scorecard signals of a source.", "operationId": "get_scorecard_signals", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}], "tags": ["stats"]}}, "/stats/sighting/exploitation_ratio": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Per publication year, the share of CVEs that have at least one exploitation sighting (type 'exploited' or 'published-proof-of-concept') over the total number of CVEs published that year. Both sides of the ratio are bucketed by the CVE Program publication date, not by the year in the CVE id, so a CVE-2023-* record published in 2025 counts in 2025. Sighted ids that the CVE Program never published are left out; their number is reported in the metadata. Useful to track whether the proportion of exploited vulnerabilities evolves over time, independently of the raw discovery volume. With 'year', the same ratio is returned per publication month of that year instead. Note: recent years are undercounted, as sightings accumulate over time.", "operationId": "get_exploitation_ratio", "parameters": [{"name": "year_from", "in": "query", "type": "integer", "description": "Inclusive lower bound of the CVE year range. Format: YYYY.", "default": 1999}, {"name": "year_to", "in": "query", "type": "integer", "description": "Inclusive upper bound of the CVE year range. Defaults to the current year."}, {"name": "year", "in": "query", "type": "integer", "description": "Break one publication year down per month (YYYY). The months after the current one are omitted for the current year. Overrides year_from and year_to."}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/sighting/exploitation_ratio_cumulative": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Cumulative share of published CVEs that have received at least one exploitation sighting ('exploited' or 'published-proof-of-concept'), bucketed by the date of the sighting rather than the CVE year. Each bucket reports the running totals up to that point, so the series is monotonic in its inputs and reflects how the overall exploited fraction evolves over time. Returns the trailing 'window' buckets (default 30).", "operationId": "get_exploitation_ratio_cumulative", "parameters": [{"name": "granularity", "in": "query", "type": "string", "description": "Bucket size of the cumulative series.", "default": "month", "enum": ["month", "year"]}, {"name": "window", "in": "query", "type": "integer", "description": "Number of trailing buckets to return. Use 0 for the full history.", "default": 30}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/time_to_exploit": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsTimeToExploit"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the publication-to-exploitation summary of a source, over the whole source, over the records it published in one year, or per publication year with granularity=year.", "operationId": "get_time_to_exploit", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the figure to one publication year (YYYY). Omit for the whole source.", "default": ""}, {"name": "granularity", "in": "query", "type": "string", "description": "year for every publication year at once, each with its own summary and count. Not combined with period.", "default": "", "enum": ["", "year"]}], "tags": ["stats"]}}, "/stats/vendors/ranking": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the vendors ranking.", "operationId": "get_vendors_ranking", "parameters": [{"name": "limit", "in": "query", "type": "integer", "description": "The top elements to take into account in the query (at most 100).", "default": 10}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}, {"name": "period", "in": "query", "type": "string", "description": "The period of the stats. Format: YYYY[-MM]", "default": ""}, {"name": "source", "in": "query", "type": "string", "description": "The source of the vulnerability advisories.", "default": "cvelistv5", "enum": ["cvelistv5", "certfr_avis", "certfr_alerte", "euvd"]}], "tags": ["stats"]}}, "/stats/vulnerability/count": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the number of published/reserved vulnerabilities for a specific period.", "operationId": "get_vulnerability_count", "parameters": [{"name": "state", "in": "query", "type": "string", "description": "The state of the advisory.", "default": "published", "enum": ["published", "reserved"]}, {"name": "period", "in": "query", "type": "string", "required": true, "description": "The period of the stats. Format: YYYY[-MM]", "default": ""}, {"name": "source", "in": "query", "type": "string", "required": true, "description": "The source of the vulnerability advisories.", "default": "cvelistv5", "enum": ["cvelistv5", "github", "pysec", "tailscale", "ossf_malicious_packages", "variot", "euvd"]}], "tags": ["stats"]}}, "/stats/vulnerability/counts": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsCounts"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the record count per publication period.", "operationId": "get_vulnerability_counts", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "granularity", "in": "query", "type": "string", "description": "Period granularity of the counts.", "default": "year", "enum": ["year", "month"]}, {"name": "period", "in": "query", "type": "string", "description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.", "default": ""}, {"name": "state", "in": "query", "type": "string", "description": "Count records by publication date (default) or by reservation date.", "default": "published", "enum": ["published", "reserved"]}], "tags": ["stats"]}}, "/stats/vulnerability/most_commented": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the most commented vulnerabilities.", "operationId": "get_vulnerability_most_commented", "parameters": [{"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "limit", "in": "query", "type": "integer", "description": "The top elements to take into account in the query.", "default": 10}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/vulnerability/most_sighted": {"get": {"responses": {"200": {"description": "Success"}}, "description": "Returns the most sighted vulnerabilities.", "operationId": "get_vulnerability_most_sighted", "parameters": [{"name": "date_from", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD"}, {"name": "date_to", "in": "query", "type": "string", "format": "date", "description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD"}, {"name": "sighting_type", "in": "query", "type": "string", "description": "The type of the sighting.", "default": "", "enum": ["seen", "exploited", "published-proof-of-concept", "not-exploited", "confirmed", "not-confirmed", "patched", "not-patched"]}, {"name": "limit", "in": "query", "type": "integer", "description": "The top elements to take into account in the query.", "default": 10}, {"name": "output", "in": "query", "type": "string", "description": "The format of the output.", "default": "json", "enum": ["json", "markdown"]}], "tags": ["stats"]}}, "/stats/vulnerability/sources": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsSourceDistribution"}}}, "description": "Compare the number of records each source holds. Sources overlap -- several describe the same CVE -- so the counts are not additive and no share of their sum is given. Sources holding no records are omitted.", "operationId": "get_vulnerability_sources", "tags": ["stats"]}}, "/stats/vulnerability/status": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/StatsStatus"}}, "400": {"description": "The request could not be satisfied.", "schema": {"$ref": "#/definitions/StatsError"}}}, "description": "Returns the lifecycle split of a source, whole or for one year.", "operationId": "get_vulnerability_status", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "The source to report on, e.g. cvelistv5 or euvd.", "default": "cvelistv5"}, {"name": "period", "in": "query", "type": "string", "description": "Restrict the figure to one publication year (YYYY). Omit for the whole source.", "default": ""}], "tags": ["stats"]}}, "/system/checkProcess": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Checks the heartbeats of the various processes", "description": "Checks the heartbeats of the various processes.", "operationId": "get_check_process", "tags": ["system"]}}, "/system/checkSMTP": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Checks the SMTP connection", "description": "Checks the SMTP connection.", "operationId": "get_check_smtp", "tags": ["system"]}}, "/system/configInfo": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Returns non-sensitive information about the configuration of the system", "description": "Returns non-sensitive information about the configuration of the system.", "operationId": "get_config_info", "tags": ["system"]}}, "/system/dbInfo": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Returns information about the current sources in the Kvrocks database in use and when it was updated", "description": "Returns information about the current sources in the Kvrocks database in use and when it was updated.", "operationId": "get_info", "tags": ["system"]}}, "/system/pgInfo": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Returns information about the PostgreSQL database", "description": "Returns information about the PostgreSQL database.", "operationId": "get_pg_info", "tags": ["system"]}}, "/system/redis_up": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Check if Valkey/Redis is up and running", "description": "Alias for /api/system/redis_up", "operationId": "get_redis_up_/system/redis_up", "deprecated": true, "tags": ["system"]}}, "/system/valkey_up": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Check if Valkey/Redis is up and running", "description": "Check if Valkey/Redis is up and running.", "operationId": "get_redis_up", "tags": ["system"]}}, "/user/": {"post": {"responses": {"200": {"description": "Success", "schema": {"$ref": "#/definitions/UserFull"}}, "201": {"description": "Success."}, "403": {"description": "Self-registration is disabled."}, "422": {"description": "Email address not accepted (disposable email detected, blocked domain, or invalid domain)."}, "429": {"description": "Too many requests (maximum 3 registrations/hour per IP)"}}, "description": "Create a non-admin user.", "operationId": "post_users_list", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 10}, {"name": "payload", "required": true, "in": "body", "schema": {"type": "object", "properties": {"login": {"type": "string", "description": "Login."}, "name": {"type": "string", "description": "Display name (firstname, lastname)."}, "organisation": {"type": "string", "description": "Organisation."}, "email": {"type": "string", "description": "Email."}}, "required": ["login", "name", "email"]}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["user"]}, "get": {"responses": {"200": {"description": "Success.", "schema": {"type": "array", "items": {"$ref": "#/definitions/UsersList"}}}, "403": {"description": "Admin permission required."}}, "summary": "List all users", "description": "Only available to administrators.", "operationId": "list_users", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 10}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["user"]}}, "/user/api_key": {"post": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/UserFull"}}, "403": {"description": "Wrong API key submitted."}, "404": {"description": "User not found."}}, "summary": "Regenerating the API key of the authenticated user with the current API key", "description": "Regenerating the API key of the authenticated user with the current API key.", "operationId": "post_user_new_api_key", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/API%20Key"}}, {"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["user"]}}, "/user/me": {"get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/UserFull"}}, "404": {"description": "User not found."}}, "summary": "Get information about the currently authenticated user", "description": "Get information about the currently authenticated user.", "operationId": "get_user_self", "parameters": [{"name": "X-Fields", "in": "header", "type": "string", "format": "mask", "description": "An optional fields mask"}], "tags": ["user"]}}, "/user/{user_id}": {"parameters": [{"name": "user_id", "in": "path", "required": true, "type": "integer"}], "delete": {"responses": {"204": {"description": "Success."}, "403": {"description": "Administrator permission required or not the current user."}, "404": {"description": "User not found."}, "500": {"description": "Internal server error."}}, "summary": "Endpoint for deleting a user", "description": "Delete a user.", "operationId": "delete_user_item", "tags": ["user"]}}, "/vex/": {"get": {"responses": {"200": {"description": "Success."}}, "summary": "Browse VEX records and pivot to the related vulnerability", "description": "Browse the VEX records available in vulnerability-lookup, newest first.", "operationId": "get_vex_browse", "parameters": [{"name": "source", "in": "query", "type": "string", "description": "Filter by VEX metadata source."}, {"name": "q", "in": "query", "type": "string", "description": "Case-insensitive substring filter on the vulnerability id, document title, or source name."}, {"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of VEX records to return (capped at 1000).", "default": 100}], "tags": ["vex"]}}, "/vex/{vulnerability_id}": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}}, "summary": "Get the VEX statements attached to a vulnerability", "description": "Get the VEX statements attached to a vulnerability.", "operationId": "get_vex_list", "tags": ["vex"]}}, "/vex/{vulnerability_id}/{meta_source}/csaf": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}, {"name": "meta_source", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}, "404": {"description": "No stored VEX document for this vulnerability and source."}}, "summary": "Get the full CSAF VEX document stored for a vulnerability", "description": "Get the full CSAF VEX document stored for a vulnerability.", "operationId": "get_vex_document", "tags": ["vex"]}}, "/vlai/attack-techniques": {"post": {"responses": {"200": {"description": "Success."}, "401": {"description": "Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented)."}, "500": {"description": "Unexpected error."}, "502": {"description": "Bad content: Invalid response from ML-Gateway."}, "503": {"description": "Connection Error: Unable to reach ML-Gateway."}}, "description": "Suggest MITRE ATT&CK techniques based on vulnerability descriptions.", "operationId": "post_vlai_attack_techniques", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"type": "object", "properties": {"description": {"type": "string", "default": "", "description": "Description of the vulnerability."}, "top_k": {"type": "integer", "default": 5, "description": "Maximum number of ATT&CK techniques to return."}}}}], "tags": ["vlai"]}}, "/vlai/attack-techniques/catalog": {"get": {"responses": {"200": {"description": "Success."}, "500": {"description": "Unexpected error."}, "502": {"description": "Bad content: Invalid response from ML-Gateway."}, "503": {"description": "Connection Error: Unable to reach ML-Gateway."}}, "description": "Every MITRE ATT&CK technique the bi-encoder similarity search can rank vulnerabilities for, sorted by id: the techniques the model was trained on (`in_vocabulary` true) and the other enterprise techniques, scored from their official ATT&CK text. Backs the technique index page.", "operationId": "get_vlai_attack_technique_catalog", "tags": ["vlai"]}}, "/vlai/attack-techniques/{technique_id}/vulnerabilities": {"parameters": [{"in": "path", "description": "MITRE ATT&CK technique id, e.g. T1190 or T1059.004.", "name": "technique_id", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid technique id or top_k."}, "404": {"description": "Unknown technique."}, "500": {"description": "Unexpected error."}, "502": {"description": "Bad content: Invalid response from ML-Gateway."}, "503": {"description": "Connection Error: Unable to reach ML-Gateway."}}, "description": "Vulnerabilities whose description is nearest to one MITRE ATT&CK technique in the CIRCL bi-encoder space, best first. A similarity search over the indexed descriptions, not a classification: only the vulnerability -> technique direction has measured accuracy. `in_vocabulary` is false for techniques the model was not trained on, which rank noticeably worse. `score` is the training-time probability sigmoid(logit_scale * cosine + logit_bias).", "operationId": "get_vlai_attack_technique_vulnerabilities", "parameters": [{"name": "top_k", "in": "query", "type": "integer", "minimum": 1, "maximum": 100, "description": "Number of vulnerabilities to return (1-100).", "default": 10}], "tags": ["vlai"]}}, "/vlai/related/{vulnerability_id}": {"parameters": [{"in": "path", "description": "Identifier of a stored vulnerability, e.g. CVE-2021-44077.", "name": "vulnerability_id", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid top_k."}, "404": {"description": "Unknown vulnerability."}, "422": {"description": "The record has no description to search with."}, "500": {"description": "Unexpected error."}, "502": {"description": "Bad content: Invalid response from ML-Gateway."}, "503": {"description": "Connection Error: Unable to reach ML-Gateway."}}, "description": "Vulnerabilities whose description is nearest to this one in the CIRCL ATT&CK bi-encoder space, by plain cosine, best first. A similarity search with no measured accuracy, not a classification. The search runs on the vulnerability's stored vector when it is indexed (`query.by` is `id`); otherwise its description is embedded on the fly (`query.by` is `text`, `query.indexed` is false). `query.id` is the identifier the record is indexed under.", "operationId": "get_vlai_related_vulnerabilities", "parameters": [{"name": "top_k", "in": "query", "type": "integer", "minimum": 1, "maximum": 100, "description": "Number of vulnerabilities to return (1-100).", "default": 10}], "tags": ["vlai"]}}, "/vlai/severity-classification": {"post": {"responses": {"200": {"description": "Success."}, "401": {"description": "Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented)."}, "500": {"description": "Unexpected error."}, "502": {"description": "Bad content: Invalid response from ML-Gateway."}, "503": {"description": "Connection Error: Unable to reach ML-Gateway."}}, "description": "Classify vulnerabilities by severity based on their descriptions.", "operationId": "post_vlai_severity_classification", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"type": "object", "properties": {"description": {"type": "string", "default": "", "description": "Description of the vulnerability."}, "model": {"type": "string", "default": "CIRCL/vulnerability-severity-classification-RoBERTa-base", "description": "AI model to use."}}}}], "tags": ["vlai"]}}, "/vulnerability/": {"parameters": [{"default": "", "in": "query", "description": "Optional product name to filter vulnerabilities (case-insensitive). When provided, results are returned for the product across all vendors.", "name": "product", "type": "string"}, {"default": "false", "in": "query", "description": "If 'true', include sightings for each result. Ignored in light mode.", "name": "with_sightings", "type": "string"}, {"default": "false", "in": "query", "description": "If 'true', include bundles for each result. Ignored in light mode.", "name": "with_bundles", "type": "string"}, {"default": "false", "in": "query", "description": "If 'true', include comments for each result. Ignored in light mode.", "name": "with_comments", "type": "string"}, {"default": "false", "in": "query", "description": "If 'true', include linked vulnerabilities for each result. Ignored in light mode.", "name": "with_linked", "type": "string"}, {"default": "false", "in": "query", "description": "If 'true', include metadata for each vulnerability. Ignored in light mode.", "name": "with_meta", "type": "string"}, {"default": "0", "in": "query", "description": "If '1', returns only vulnerability ID and source", "name": "light", "type": "string"}, {"in": "query", "description": "Filter vulnerabilities by a specific CWE ID", "name": "cwe", "type": "string"}, {"default": "", "in": "query", "description": "Retrieve vulnerabilities reported after the specified date.", "name": "since", "type": "string"}, {"default": "desc", "in": "query", "description": "Sort order: 'asc' or 'desc'", "name": "sort_order", "type": "string"}, {"default": "updated", "in": "query", "description": "Sort field: '', 'published', 'updated', 'reserved'", "name": "date_sort", "type": "string"}, {"default": 30, "in": "query", "description": "Maximum number of results (capped at 100)", "name": "per_page", "type": "string"}, {"default": 1, "in": "query", "description": "Pagination page number", "name": "page", "type": "string"}, {"in": "query", "description": "Optional data source to filter vulnerabilities (e.g., 'cvelistv5', 'github', 'nvd')", "name": "source", "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities with optional filters", "description": "Retrieve vulnerabilities with optional filtering and pagination.\n\nSupports light mode for minimal data (returns only vulnerability ID and source).\nReturns full vulnerability details by default, or only IDs and sources in light mode.\n\nQuery Parameters\n----------------\nsource : str\n    Optional source to filter vulnerabilities (e.g., 'CVE', 'GHSA', 'PySec').\nper_page : int, default=30\n    Maximum number of results (capped at 100).\ndate_sort : str\n    Field to sort by. Options: '', 'published', 'updated', 'reserved'.\nsort_order : str\n    Sort order: 'asc' or 'desc'.\nsince : str\n    Retrieve vulnerabilities published/updated after the specified date.\npage : int\n    Pagination page number.\ncwe : str\n    Filter vulnerabilities by a specific CWE ID.\nproduct : str\n    Optional product name to filter vulnerabilities (case-insensitive). If set, the endpoint returns vulnerabilities related to this product across all vendors. Use with `assigner` to further narrow results.\nassigner : str\n    Optional CNA/assigner short name to filter results (case-insensitive). Only effective when used with `product` or `vendor` filters.\nlight : str\n    If '1', returns only `(vulnerability_id, source)` instead of full details.\nwith_meta : str\n    If 'true', includes metadata for each vulnerability. Ignored in light mode.\nwith_linked : str\n    If 'true', includes linked vulnerabilities for each result. Ignored in light mode.\nwith_comments : str\n    If 'true', includes comments for each result. Ignored in light mode.\nwith_bundles : str\n    If 'true', includes bundles for each result. Ignored in light mode.\nwith_sightings : str\n    If 'true', includes sightings for each result. Ignored in light mode.\n\nReturns\n-------\nlist[dict[str, Any]] | list[tuple[str, str | None]]\n    Full vulnerability details or minimal tuples if light mode is enabled.", "operationId": "get_vulnerabilities_list", "tags": ["vulnerability"]}}, "/vulnerability/browse/": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the known vendors", "description": "Deprecated: use GET /api/browse/vendors instead. Get the known vendors.\nDeprecated in favor of /api/browse/vendors.", "operationId": "get_vendors", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/browse/assigners": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Get the known CNAs", "description": "Get the known CNAs.", "operationId": "get_assigners", "tags": ["vulnerability"]}}, "/vulnerability/bulk": {"post": {"responses": {"200": {"description": "Success."}, "400": {"description": "Invalid request payload."}}, "description": "Retrieve up to 100 vulnerabilities by identifier in one request. `data` keeps the input order, one entry per identifier asked, with `vulnerability` null for an identifier that is not present; `metadata` counts the identifiers requested and found. Duplicate identifiers are looked up only once. `with_linked` serves every linked record whole, as GET /<id> does, so it is accepted for at most 10 identifiers.", "operationId": "post_vulnerabilities_bulk", "parameters": [{"name": "payload", "required": true, "in": "body", "schema": {"$ref": "#/definitions/VulnerabilityBulkLookup"}}], "tags": ["vulnerability"]}}, "/vulnerability/cpesearch/{cpe}": {"parameters": [{"default": "desc", "in": "query", "description": "Sort order: 'asc' or 'desc'", "name": "sort_order", "type": "string"}, {"default": "updated", "in": "query", "description": "Sort field: '', 'published', 'updated', 'reserved'", "name": "date_sort", "type": "string"}, {"default": 30, "in": "query", "description": "Maximum number of results (capped at 100)", "name": "per_page", "type": "string"}, {"default": 1, "in": "query", "description": "Pagination page number", "name": "page", "type": "string"}, {"default": "cvelistv5", "in": "query", "description": "Optional source to filter vulnerabilities (e.g., 'cvelistv5', 'nvd')", "name": "source", "type": "string"}, {"name": "cpe", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success."}, "404": {"description": "No match found in the CPE string."}}, "summary": "Get vulnerabilities by CPE (based on the extracted CPE vendor and product)", "description": "Get vulnerabilities by CPE (based on the extracted CPE vendor and product).", "operationId": "get_cpe_search", "tags": ["vulnerability"]}}, "/vulnerability/fulltext": {"get": {"responses": {"200": {"description": "Success."}, "400": {"description": "Missing or empty query parameter."}, "503": {"description": "Fulltext search is not enabled on this instance."}}, "summary": "Search vulnerabilities using fulltext search", "description": "Fulltext search across all indexed vulnerability sources.", "operationId": "get_fulltext_search", "parameters": [{"name": "q", "in": "query", "type": "string", "required": true, "description": "Fulltext search query string."}, {"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return (capped at 100).", "default": 10}, {"name": "sources", "in": "query", "type": "string", "description": "Comma-separated list of sources to search (e.g., 'cvelistv5', 'variot', 'certfr_alerte', 'certfr_avis', 'jvndb'). Defaults to 'cvelistv5'."}], "tags": ["vulnerability"]}}, "/vulnerability/last": {"parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "cwe", "in": "query", "type": "string", "description": "CWE mentioned in the vulnerability."}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results", "description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.", "operationId": "get_last", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/last/{number}": {"parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "cwe", "in": "query", "type": "string", "description": "CWE mentioned in the vulnerability."}, {"name": "number", "in": "path", "required": true, "type": "integer"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results", "description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.", "operationId": "get_last", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/last/{source}": {"parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "cwe", "in": "query", "type": "string", "description": "CWE mentioned in the vulnerability."}, {"name": "source", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results", "description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.", "operationId": "get_last", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/last/{source}/{number}": {"parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "cwe", "in": "query", "type": "string", "description": "CWE mentioned in the vulnerability."}, {"name": "source", "in": "path", "required": true, "type": "string"}, {"name": "number", "in": "path", "required": true, "type": "integer"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results", "description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.", "operationId": "get_last", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent/": {"get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent/{date}": {"parameters": [{"name": "date", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent/{date}/{number}": {"parameters": [{"name": "date", "in": "path", "required": true, "type": "string"}, {"name": "number", "in": "path", "required": true, "type": "integer"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent/{date}/{source}": {"parameters": [{"name": "date", "in": "path", "required": true, "type": "string"}, {"name": "source", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/recent/{date}/{source}/{number}": {"parameters": [{"name": "date", "in": "path", "required": true, "type": "string"}, {"name": "source", "in": "path", "required": true, "type": "string"}, {"name": "number", "in": "path", "required": true, "type": "integer"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results", "description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.", "operationId": "get_recent", "deprecated": true, "tags": ["vulnerability"]}}, "/vulnerability/search/{vendor}/{product}": {"parameters": [{"name": "vendor", "in": "path", "required": true, "type": "string"}, {"name": "product", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Returns a list of vulnerabilities related to the vendor and product", "description": "Returns a list of vulnerabilities related to the product.\nOptionally filter vulnerabilities published or updated after the specified date (format: YYYY-MM-DD).", "operationId": "get_vendor_product_vulnerabilities", "parameters": [{"name": "page", "in": "query", "type": "integer", "description": "Number of the page.", "default": 1}, {"name": "per_page", "in": "query", "type": "integer", "description": "Maximum number of elements to return.", "default": 10}, {"name": "since", "in": "query", "type": "string", "description": "Filter vulnerabilities published or updated after the specified date (format: YYYY-MM-DD)."}], "tags": ["vulnerability"]}}, "/vulnerability/{vulnerability_id}": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success"}}, "summary": "Get a vulnerability with its id", "description": "Get a vulnerability. A GCVE-0 identifier (GCVE-0-YYYY-NNNN) is accepted and served as its CVE (CVE-YYYY-NNNN): the record's cveMetadata.cveId and x_gcve advisory entry then state the CVE identifier, not the one requested.", "operationId": "get_vulnerability", "parameters": [{"name": "with_meta", "in": "query", "type": "boolean", "description": "Include metadata.", "default": false}, {"name": "with_linked", "in": "query", "type": "boolean", "description": "Include the linked vulnerabilities.", "default": false}, {"name": "with_comments", "in": "query", "type": "boolean", "description": "Include the comments.", "default": false}, {"name": "with_bundles", "in": "query", "type": "boolean", "description": "Include the bundles.", "default": false}, {"name": "with_sightings", "in": "query", "type": "boolean", "description": "Include the sightings.", "default": false}], "tags": ["vulnerability"]}}, "/vulnerability/{vulnerability_id}/correlations": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/SightingCorrelations"}}}, "summary": "Get the sighting correlations of a vulnerability", "description": "The vulnerabilities sighted by the same sources as this one: for every source that filed a sighting of it (under either spelling of a CVE), the other vulnerabilities that source filed sightings of, most sighted first. Sources are matched exactly and counted over every sighting they filed; they come most correlated first (most related vulnerabilities, then most sightings of this one, then most recent), so the caps keep the strongest relationships. The Sighting correlations graph of the vulnerability page draws this document.", "operationId": "get_vulnerability_correlations", "parameters": [{"name": "sources", "in": "query", "type": "integer", "description": "Sources listed, most correlated first (1 to 200).", "default": 50}, {"name": "per_source", "in": "query", "type": "integer", "description": "Related vulnerabilities listed per source, most sighted first (1 to 200).", "default": 20}], "tags": ["vulnerability"]}}, "/vulnerability/{vulnerability_id}/timeline": {"parameters": [{"name": "vulnerability_id", "in": "path", "required": true, "type": "string"}], "get": {"responses": {"200": {"description": "Success.", "schema": {"$ref": "#/definitions/Timeline"}}}, "summary": "Get the timeline of a vulnerability", "description": "Every dated event of a vulnerability, oldest first: the dates of its record and of every related record (publication, updates, advisory revisions, SSVC decisions, disclosure events...), its sightings and its KEV catalog entries. Sightings and KEV entries filed under the GCVE-0 spelling of a CVE, or listing it in altId, are included. The Timeline tab of the vulnerability page shows the same events.", "operationId": "get_vulnerability_timeline", "tags": ["vulnerability"]}}}, "info": {"title": "Vulnerability-Lookup API", "version": "6.3.0", "description": "<a href='https://github.com/vulnerability-lookup/vulnerability-lookup' rel='noreferrer' target='_blank'><img src='https://vulnerability.circl.lu/static/img/VL-hori-coul.png' width='500px' /></a><br />API to query <a href='https://github.com/vulnerability-lookup/vulnerability-lookup' rel='noreferrer' target='_blank'>Vulnerability-Lookup</a>. A project from <a href='https://www.circl.lu' target='_blank'>CIRCL</a>.<br /><br />Back to the <a href='/'>main page</a><br /><br /><a href='https://www.vulnerability-lookup.org/documentation' target='_blank'>Official documentation</a> of the project.", "license": {"name": "GNU Affero General Public License version 3", "url": "https://www.gnu.org/licenses/agpl-3.0.html"}}, "produces": ["application/json"], "consumes": ["application/json"], "securityDefinitions": {"apikey": {"type": "apiKey", "in": "header", "name": "X-API-KEY"}}, "security": [{"apikey": []}], "tags": [{"name": "banner", "description": "The site notice this instance shows to every visitor."}, {"name": "system", "description": "Endpoints for retrieving various information about the system's status."}, {"name": "vulnerability", "description": "Vulnerability related operations."}, {"name": "browse", "description": "Endpoints for accessing vendor and product information."}, {"name": "stats", "description": "Endpoint for retrieving various statistics."}, {"name": "comment", "description": "Comment related operations."}, {"name": "user", "description": "User related operations."}, {"name": "bundle", "description": "Bundle related operations."}, {"name": "sighting", "description": "Sighting related operations."}, {"name": "cna_credential", "description": "CNA credentials related operations (administrators only)."}, {"name": "epss", "description": "EPSS related operations."}, {"name": "vex", "description": "VEX related operations."}, {"name": "cwe", "description": "CWE related operations."}, {"name": "capec", "description": "CAPEC related operations."}, {"name": "organization", "description": "Organization related operations."}, {"name": "product", "description": "Product related operations."}, {"name": "emb3d", "description": "EMB3D related operations."}, {"name": "gcve", "description": "GCVE related operations."}, {"name": "vlai", "description": "AI and NLP-driven services provided via the ML-Gateway. When the operator sets VLAI_CLASSIFICATION_REQUIRE_AUTH, the two classification endpoints require a logged-in session, an X-API-KEY header, or the X-VLAI-Token a vulnerability page carries."}, {"name": "rulezet", "description": "Rulezet related operations."}, {"name": "kev", "description": "KEV catalog operations (GCVE-BCP-07)."}, {"name": "cna", "description": "API endpoint which is confrom with CNA API endpoint"}, {"name": "exploit-hazard", "description": "User-parameterized local exploit hazard calculations."}, {"name": "euvd", "description": "EUVD (EU Vulnerability Database) entries."}, {"name": "euvd-stats", "description": "EUVD catalogue statistics, prepared in advance."}, {"name": "cpe_editor", "description": "Lookup of vulnerability CPEs against the CPE Editor catalog."}], "definitions": {"Banner": {"properties": {"enabled": {"type": "boolean", "description": "Whether a maintenance notice should be displayed."}, "message": {"type": "string", "description": "The notice to display, as the administrator wrote it. May contain Markdown emphasis and links; it is never HTML."}}, "type": "object"}, "Timeline": {"properties": {"metadata": {"type": "object", "description": "vulnerability: the id served; count: the number of events; kinds: the count per kind.", "example": {"vulnerability": "CVE-2026-1234", "count": 3, "kinds": {"milestone": 2, "sighting": 1, "kev": 0, "other": 0}}}, "data": {"type": "array", "description": "The events, oldest first.", "items": {"$ref": "#/definitions/TimelineEvent"}}}, "type": "object"}, "TimelineEvent": {"properties": {"timestamp": {"type": "string", "description": "RFC 3339, UTC, millisecond precision.", "example": "2026-10-05T21:30:00Z"}, "date_only": {"type": "boolean", "description": "The source gave a day without a time."}, "value": {"type": "string", "description": "The date as the source wrote it."}, "kind": {"type": "string", "example": "milestone", "enum": ["milestone", "sighting", "kev", "other"]}, "label": {"type": "string", "example": "Published"}, "source": {"type": "string", "description": "Where the date comes from.", "example": "cvelistv5 / CISA-ADP"}, "record": {"type": "string", "description": "The record holding the date.", "example": "CVE-2026-1234"}, "field": {"type": "string", "description": "The date's path within that record.", "example": "cveMetadata.datePublished"}, "uuid": {"type": "string", "description": "Sightings and KEV entries: their UUID."}, "content": {"type": "string", "description": "Sightings: their content, when any."}, "url": {"type": "string", "description": "Sightings: their source, when it is an HTTP(S) URL."}, "status": {"type": "object", "description": "KEV entries: {status_reason, exploited}."}}, "type": "object"}, "SightingCorrelations": {"properties": {"metadata": {"type": "object", "description": "vulnerability: the id served; sources: the sources of its sightings; shown_sources: how many data holds; per_source: the cap on related vulnerabilities per source.", "example": {"vulnerability": "CVE-2026-1234", "sources": 3, "shown_sources": 3, "per_source": 20}}, "data": {"type": "array", "description": "The sources: most related vulnerabilities first, then most sightings, then most recent.", "items": {"$ref": "#/definitions/CorrelatedSource"}}}, "type": "object"}, "CorrelatedSource": {"properties": {"source": {"type": "string", "description": "The sighting source; empty when the sightings named none.", "example": "https://example.org/report"}, "sightings": {"type": "integer", "description": "Sightings of the vulnerability from this source."}, "related": {"type": "integer", "description": "Distinct other vulnerabilities this source sighted."}, "vulnerabilities": {"type": "array", "description": "The most sighted of them, up to per_source.", "example": ["CVE-2026-0001"], "items": {"type": "string"}}, "type": {"type": "string", "description": "The type of the source's latest sighting of the vulnerability.", "example": "seen"}, "seen": {"type": "string", "description": "When that sighting was filed, RFC 3339 UTC.", "example": "2026-10-12T12:00:00Z"}, "content": {"type": "string", "description": "That sighting's content, at most 1500 characters."}, "content_truncated": {"type": "boolean", "description": "The content was longer and has been cut."}}, "type": "object"}, "VulnerabilityBulkLookup": {"required": ["ids"], "properties": {"ids": {"type": "array", "description": "One to 100 vulnerability identifiers.", "minItems": 1, "maxItems": 100, "items": {"type": "string", "description": "A vulnerability identifier.", "pattern": "\\S"}}, "with_meta": {"type": "boolean", "description": "Include storage metadata."}, "with_linked": {"type": "boolean", "description": "Include linked vulnerabilities. Accepted for at most 10 identifiers per request."}, "with_comments": {"type": "boolean", "description": "Include comments."}, "with_bundles": {"type": "boolean", "description": "Include bundles."}, "with_sightings": {"type": "boolean", "description": "Include sightings."}}, "type": "object"}, "StatsSourceDistribution": {"properties": {"sources": {"type": "array", "description": "Sources ranked by records held, descending. Sources overlap, so these do not sum to a vulnerability count.", "items": {"$ref": "#/definitions/StatsSourceRecords"}}}, "type": "object"}, "StatsSourceRecords": {"properties": {"source": {"type": "string", "description": "Imported vulnerability source."}, "records": {"type": "integer", "description": "Records this source holds."}}, "type": "object"}, "StatsCounts": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "granularity": {"type": "string", "description": "year or month."}, "state": {"type": "string", "description": "published or reserved: the date the records are counted by."}, "available": {"type": "boolean", "description": "False when the counters have never been prepared; counts is then empty."}, "counts": {"type": "object", "description": "Period (YYYY or YYYY-MM) -> record count."}}, "type": "object"}, "StatsError": {"properties": {"message": {"type": "string", "description": "Why the request could not be answered."}}, "type": "object"}, "StatsStatus": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "period": {"type": "string", "description": "The year the counts cover, absent for the whole source."}, "total": {"type": "integer", "description": "Records held. Absent with a period: the base index is scored by a record's last update, so a year of it would count records touched in that year rather than records of it."}, "published": {"type": "integer", "description": "Records carrying a publication date, withdrawn ones included."}, "reserved": {"type": "integer", "description": "Records carrying a reservation date, which is not the same as records awaiting publication: on the CVE list every record carries one, so this equals `total` there."}, "state": {"description": "Current lifecycle state, absent for a source that keeps no state index and with a period. Distinct from the date fields above: a withdrawn record keeps its publication date but counts as rejected here.", "allOf": [{"$ref": "#/definitions/StatsLifecycle"}]}}, "type": "object"}, "StatsLifecycle": {"properties": {"published": {"type": "integer", "description": "Records whose current state is PUBLISHED."}, "reserved": {"type": "integer", "description": "Records whose current state is RESERVED."}, "rejected": {"type": "integer", "description": "Records whose current state is REJECTED, i.e. withdrawn."}}, "type": "object"}, "StatsDistribution": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "period": {"type": "string", "description": "The publication year the distribution covers, or null for all of it."}, "available": {"type": "boolean", "description": "False when the distribution has never been prepared; distribution is then empty."}, "distribution": {"type": "object", "description": "Bucket -> record count."}}, "type": "object"}, "StatsKEV": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "available": {"type": "boolean", "description": "False when this source does not maintain a known-exploited index."}, "basis": {"type": "string", "description": "What the counts are counted on: `membership` without granularity (set membership, carrying no date), `listed_at` with it (the date each catalogue listed the record: first_seen_at, then recorded_at, then status_updated_at -- never the record's publication date)."}, "granularity": {"type": "string", "description": "year or month with a period series, null without one."}, "period": {"type": "string", "description": "With granularity=month, the year broken into months."}, "total": {"type": "integer", "description": "The denominator: currently-published records, or every record held. Null in the period form."}, "total_basis": {"type": "string", "description": "Which population ``total`` counts: ``state_published`` for a source whose lifecycle index says what is published now, ``date_published`` for one that only records when a vulnerability was published, ``held`` for one that does neither. Null in the period form."}, "exploited": {"type": "integer", "description": "Records appearing in at least one known-exploited catalogue. Null in the period form, where `totals` carries the series."}, "ratio": {"type": "number", "description": "exploited / total, or null when the source is empty."}, "catalogs": {"type": "object", "description": "Catalogue short name -> record count, or -> {period: count} with a granularity. These overlap: a record listed by two catalogues is counted by both, so they sum to more than `exploited` (or than `totals`)."}, "totals": {"type": "object", "description": "Period -> distinct records that became known exploited in it, each counted once in the period its first catalogue listed it. Only with a granularity."}, "scope_catalogs": {"type": "object", "description": "The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form."}, "scoped": {"type": "boolean", "description": "True when the figure is restricted to the catalogues configured for this source (STATS_KEV_CATALOGS): `exploited` is then the union of exactly the catalogues listed in `catalogs`. False when it covers every catalogue the instance knows."}, "unattributed": {"type": "integer", "description": "Exploited records held under a catalogue this instance cannot name, counted the same way when `scoped`: a record a scope leaves out is not unattributed, but one in no known catalogue still is. Non-zero means the local catalogue reference data is absent or stale. Null in the period form, where `unattributed_periods` carries the series."}, "unattributed_periods": {"type": "object", "description": "Period -> exploited records held under a catalogue this instance cannot name. Only with a granularity; the membership form reports the count in `unattributed`."}, "computed_at": {"type": "string", "description": "When the period buckets were last prepared."}}, "type": "object"}, "StatsTimeToExploit": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "period": {"type": "string", "description": "The publication year the summary covers, or null for the whole source."}, "available": {"type": "boolean", "description": "False when the cross-store scan has never run."}, "count": {"type": "integer", "description": "Records the figure rests on -- those ever exploited. Reported for every period, because one publication year's exploited records can be a dozen."}, "mean_days": {"type": "number", "description": "Mean days from publication to first listing, one decimal."}, "median_days": {"type": "number", "description": "Median days, reported alongside the mean."}, "p90_days": {"type": "number", "description": "90th percentile, nearest rank."}, "min_days": {"type": "number", "description": "Shortest observed interval."}, "max_days": {"type": "number", "description": "Longest observed interval."}, "exploited_before_publication": {"type": "integer", "description": "Of count, how many were listed before the record was published."}, "before_publication_mean_days": {"type": "number", "description": "Mean of the intervals of the records listed before publication (a negative number); absent when there are none."}, "scope_catalogs": {"type": "object", "description": "The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form."}, "scoped": {"type": "boolean", "description": "True when the figure was measured over the catalogues configured for this source (STATS_KEV_CATALOGS), which `scope_catalogs` then names. False when it covers every catalogue the instance knows."}, "granularity": {"type": "string", "description": "year with the per-year series."}, "records_outside_year_range": {"type": "integer", "description": "With a granularity, records whose publication year falls outside the years the series is drawn over: `years` sums to `count` minus this."}, "years": {"type": "object", "description": "With granularity=year: publication year -> the same summary (count, mean_days, median_days, p90_days, min_days, max_days, exploited_before_publication, before_publication_mean_days), over every year the source spans; a year whose records were never exploited is {count: 0}."}, "entries_scanned": {"type": "integer", "description": "Known-exploited catalogue entries the scan read."}, "cves_exploited": {"type": "integer", "description": "Distinct CVEs those entries named -- the denominator of the two unmatched counts."}, "unmatched_no_record": {"type": "integer", "description": "Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains."}, "unmatched_no_publication_date": {"type": "integer", "description": "Exploited records carrying no publication date, so they could not be dated."}, "computed_at": {"type": "string", "description": "When the snapshot was taken."}}, "type": "object"}, "ScorecardRanking": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "period": {"type": "string", "description": "window, all, or the publication year."}, "available": {"type": "boolean", "description": "False when the scorecard has never been prepared for this source."}, "meta": {"$ref": "#/definitions/ScorecardMeta"}, "ranking": {"type": "array", "description": "Ranked assigners first, best first.", "items": {"$ref": "#/definitions/ScorecardEntry"}}}, "type": "object"}, "ScorecardMeta": {"properties": {"methodology": {"type": "integer", "description": "Version of the rules the figures were computed under."}, "methodology_since": {"type": "string", "description": "The day that version of the rules took effect (ISO 8601)."}, "methodology_change": {"type": "string", "description": "What that version changed, in one sentence."}, "methodology_reference": {"type": "string", "description": "The pull request or commit that made the change."}, "vl_version": {"type": "string", "description": "The Vulnerability-Lookup release that prepared the figures."}, "window_days": {"type": "integer", "description": "Length of the rolling window the ranking is built on."}, "min_records": {"type": "integer", "description": "Publications an assigner needs in the window to be ranked."}, "computed_at": {"type": "string", "description": "When the figures were prepared."}, "records": {"type": "integer", "description": "Published records scored by the last full pass."}, "assigners": {"type": "integer", "description": "Assigners with at least one scored record."}}, "type": "object"}, "ScorecardEntry": {"properties": {"assigner": {"type": "string", "description": "The CNA short name, or the GNA source name."}, "score": {"type": "number", "description": "Mean record score over the period, 0..100."}, "grade": {"type": "string", "description": "A to E, from the mean score."}, "records": {"type": "integer", "description": "Published records scored in the period."}, "ranked": {"type": "boolean", "description": "False under the volume threshold: the score is shown, not ranked."}, "source": {"type": "string", "description": "The source the entry was read from (GNA ranking only)."}}, "type": "object"}, "ScorecardGNARanking": {"properties": {"period": {"type": "string", "description": "window, all, or the publication year."}, "available": {"type": "boolean", "description": "False when no GNA source has a prepared scorecard."}, "sources": {"type": "array", "description": "The GNA sources the ranking was read from.", "items": {"type": "string"}}, "ranking": {"type": "array", "description": "Ranked GNAs first, best first.", "items": {"$ref": "#/definitions/ScorecardEntry"}}}, "type": "object"}, "ScorecardAssigner": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "assigner": {"type": "string", "description": "The assigner reported on."}, "available": {"type": "boolean", "description": "False when nothing was prepared for this source or assigner."}, "ranked": {"type": "boolean", "description": "Whether the assigner reaches the volume threshold in the window."}, "window": {"type": "object", "description": "The rolling window's tallies: score, grade, pillars, checks, context."}, "all": {"type": "object", "description": "The same tallies over every publication."}, "years": {"type": "object", "description": "Score and record count per publication year."}, "meta": {"$ref": "#/definitions/ScorecardMeta"}}, "type": "object"}, "ScorecardSignals": {"properties": {"source": {"type": "string", "description": "The source reported on."}, "available": {"type": "boolean", "description": "False when the scorecard has never been prepared for this source."}, "signals": {"type": "object", "description": "Per signal: its label, unit and the ranked assigners tripping it."}}, "type": "object"}, "KEVScorecardRanking": {"properties": {"period": {"type": "string", "description": "window, all, or the listing year."}, "available": {"type": "boolean", "description": "False when the catalogue scorecard has never been prepared."}, "meta": {"$ref": "#/definitions/KEVScorecardMeta"}, "ranking": {"type": "array", "description": "Ranked catalogues first, best first.", "items": {"$ref": "#/definitions/KEVScorecardEntry"}}}, "type": "object"}, "KEVScorecardMeta": {"properties": {"methodology": {"type": "integer", "description": "Version of the rules the figures were computed under."}, "methodology_since": {"type": "string", "description": "The day that version of the rules took effect (ISO 8601)."}, "methodology_change": {"type": "string", "description": "What that version changed, in one sentence."}, "methodology_reference": {"type": "string", "description": "The pull request or commit that made the change."}, "vl_version": {"type": "string", "description": "The Vulnerability-Lookup release that prepared the figures."}, "window_days": {"type": "integer", "description": "Length of the rolling window the ranking is built on."}, "min_entries": {"type": "integer", "description": "Listings a catalogue needs in the window to be ranked."}, "computed_at": {"type": "string", "description": "When the figures were prepared."}, "entries": {"type": "integer", "description": "KEV entries scored by the last pass, withdrawn ones included."}, "catalogues": {"type": "integer", "description": "Catalogues with at least one scored entry."}, "mirrors": {"type": "object", "description": "The inferred mirror relations: downstream, upstream, containment, median_lag_days, downstream_first_share."}}, "type": "object"}, "KEVScorecardEntry": {"properties": {"catalogue": {"type": "string", "description": "The catalogue's UUID."}, "name": {"type": "string", "description": "The catalogue's name, from the GCVE registry."}, "score": {"type": "number", "description": "The catalogue's score over the period, 0..100."}, "grade": {"type": "string", "description": "A to E, from the score."}, "entries": {"type": "integer", "description": "Current entries listed in the period."}, "ranked": {"type": "boolean", "description": "False under the volume threshold: the score is shown, not ranked."}}, "type": "object"}, "KEVScorecardCatalogue": {"properties": {"catalogue": {"type": "string", "description": "The catalogue's UUID."}, "name": {"type": "string", "description": "The catalogue's name, from the GCVE registry."}, "available": {"type": "boolean", "description": "False when nothing was prepared for this catalogue."}, "window": {"type": "object", "description": "The rolling window's figures: score, grade, pillars, checks, context, mirrors."}, "all": {"type": "object", "description": "The same figures over every listing."}, "years": {"type": "object", "description": "Score and grade per listing year."}, "meta": {"$ref": "#/definitions/KEVScorecardMeta"}}, "type": "object"}, "Comment": {"properties": {"uuid": {"type": "string", "description": "Comment uuid."}, "vulnerability_lookup_origin": {"type": "string", "description": "UUID of the Vulnerability-Lookup origin instance.", "readOnly": true, "default": "1a89b78e-f703-45f3-bb86-59eb712668bd"}, "title": {"type": "string", "description": "Comment title."}, "description": {"type": "string", "description": "Description."}, "description_format": {"type": "string", "description": "Description format (markdown or text)."}, "vulnerability": {"type": "string", "description": "Vulnerability id."}, "creation_timestamp": {"type": "string", "format": "date-time", "description": "Creation time of the comment.", "readOnly": true}, "timestamp": {"type": "string", "format": "date-time", "description": "Updated time of the comment.", "readOnly": true}, "related_vulnerabilities": {"type": "array", "description": "One or more vulnerability references (CVE ID, GHSA-ID, PYSEC ID, etc.) for this comment.", "items": {"type": "string"}}, "meta": {"type": "object", "description": "Zero or more meta-fields."}, "author": {"readOnly": true, "allOf": [{"$ref": "#/definitions/User"}]}}, "type": "object"}, "User": {"properties": {"login": {"type": "string", "description": "Login of the user.", "readOnly": true}}, "type": "object"}, "CommentsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of comments.", "items": {"$ref": "#/definitions/Comment"}}}, "type": "object"}, "metadata": {"properties": {"count": {"type": "integer", "description": "Total number of the items of the data.", "readOnly": true}, "page": {"type": "integer", "description": "Number of the page.", "readOnly": true}, "per_page": {"type": "integer", "description": "Requested limit data.", "readOnly": true}}, "type": "object"}, "UserFull": {"properties": {"uuid": {"type": "string", "description": "User UUID."}, "login": {"type": "string", "description": "User login."}, "created_at": {"type": "string", "format": "date-time", "description": "Creation time of the user.", "readOnly": true}, "last_seen": {"type": "string", "format": "date-time", "description": "Last seen time of the user.", "readOnly": true}}, "type": "object"}, "API Key": {"properties": {"apikey": {"type": "string", "description": "The current API key of the user."}}, "type": "object"}, "UsersList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of users.", "items": {"$ref": "#/definitions/UserFull"}}}, "type": "object"}, "Bundle": {"properties": {"uuid": {"type": "string", "description": "Bundle id."}, "vulnerability_lookup_origin": {"type": "string", "description": "UUID of the Vulnerability-Lookup origin instance.", "readOnly": true, "default": "1a89b78e-f703-45f3-bb86-59eb712668bd"}, "name": {"type": "string", "description": "Bundle name."}, "description": {"type": "string", "description": "Description."}, "creation_timestamp": {"type": "string", "format": "date-time", "description": "Creation time of the bundle.", "readOnly": true}, "timestamp": {"type": "string", "format": "date-time", "description": "Updated time of the bundle.", "readOnly": true}, "related_vulnerabilities": {"type": "array", "description": "One or more vulnerability references (CVE ID, GHSA-ID, PYSEC ID, etc.) for this bundle.", "items": {"type": "string"}}, "meta": {"type": "object", "description": "Zero or more meta-fields."}, "author": {"readOnly": true, "allOf": [{"$ref": "#/definitions/User"}]}}, "type": "object"}, "BundlesList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of bundles.", "items": {"$ref": "#/definitions/Bundle"}}}, "type": "object"}, "Sighting": {"properties": {"uuid": {"type": "string", "description": "Sighting UUID.", "readOnly": true}, "vulnerability_lookup_origin": {"type": "string", "description": "UUID of the Vulnerability-Lookup origin instance.", "readOnly": true, "default": "1a89b78e-f703-45f3-bb86-59eb712668bd"}, "creation_timestamp": {"type": "string", "format": "date-time", "description": "When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it."}, "type": {"type": "string", "description": "Type of the sighting."}, "source": {"type": "string", "description": "The source of the sighting (Fediverse status URI, link, tool, etc.)."}, "content": {"type": "string", "description": "Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).", "default": ""}, "vulnerability": {"type": "string", "description": "Vulnerability id."}, "author": {"readOnly": true, "allOf": [{"$ref": "#/definitions/User"}]}}, "type": "object"}, "SourceCorrelations": {"properties": {"metadata": {"type": "object", "description": "source: the sighting's source; related: distinct vulnerabilities it sighted; shown: how many data holds; limit: the cap.", "example": {"source": "MISP/0b9d0c9e-4f0e-4f3a-9d2a-1c2b3d4e5f60", "related": 120, "shown": 100, "limit": 100}}, "data": {"type": "array", "description": "The vulnerabilities, most sighted first.", "items": {"$ref": "#/definitions/CorrelatedVulnerability"}}}, "type": "object"}, "CorrelatedVulnerability": {"properties": {"vulnerability": {"type": "string", "example": "CVE-2026-1234"}, "sightings": {"type": "integer", "description": "Sightings of it from the source."}, "type": {"type": "string", "description": "The type of the source's latest sighting of it.", "example": "seen"}, "seen": {"type": "string", "description": "When that sighting was filed, RFC 3339 UTC.", "example": "2026-10-12T12:00:00Z"}, "content": {"type": "string", "description": "That sighting's content, at most 1500 characters."}, "content_truncated": {"type": "boolean", "description": "The content was longer and has been cut."}}, "type": "object"}, "SightingsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of sightings.", "items": {"$ref": "#/definitions/Sighting"}}}, "type": "object"}, "CNACredentialsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of CNA credentials.", "items": {"$ref": "#/definitions/CNACredential"}}}, "type": "object"}, "CNACredential": {"properties": {"id": {"type": "integer", "description": "CNA credential id.", "readOnly": true}, "login": {"type": "string", "description": "Login of the user bound to this credential.", "readOnly": true}, "cve_api_org": {"type": "string", "description": "CVE Services API organization."}, "cve_api_user": {"type": "string", "description": "CVE Services API user."}, "enabled": {"type": "boolean", "description": "Whether CNA publication is allowed for the user bound to this credential."}, "created_at": {"type": "string", "format": "date-time", "description": "Creation time of the credential.", "readOnly": true}, "updated_at": {"type": "string", "format": "date-time", "description": "Last update time of the credential.", "readOnly": true}}, "type": "object"}, "CWEsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of CWEs.", "items": {"$ref": "#/definitions/CWE"}}}, "type": "object"}, "CWE": {"required": ["@Abstraction", "@ID", "@Name", "@Status", "@Structure", "Description"], "properties": {"@ID": {"type": "string", "description": "CWE ID"}, "@Name": {"type": "string", "description": "Name of the CWE"}, "@Abstraction": {"type": "string", "description": "Abstraction of the CWE"}, "@Structure": {"type": "string", "description": "Structure of the CWE"}, "@Status": {"type": "string", "description": "Status of the CWE"}, "Description": {"type": "string", "description": "Description of the CWE"}, "Related_Weaknesses": {"description": "Related weaknesses", "allOf": [{"$ref": "#/definitions/RelatedWeaknesses"}]}, "Potential_Mitigations": {"description": "Potential mitigations", "allOf": [{"$ref": "#/definitions/Mitigations"}]}, "Mapping_Notes": {"description": "Mapping notes", "allOf": [{"$ref": "#/definitions/MappingNotes"}]}}, "type": "object"}, "RelatedWeaknesses": {"properties": {"Related_Weakness": {"type": "array", "description": "List of related weaknesses", "items": {"$ref": "#/definitions/RelatedWeakness"}}}, "type": "object"}, "RelatedWeakness": {"required": ["@CWE_ID", "@Nature", "@Ordinal", "@View_ID"], "properties": {"@Nature": {"type": "string", "description": "Nature of the relationship"}, "@CWE_ID": {"type": "string", "description": "CWE ID of the related weakness"}, "@View_ID": {"type": "string", "description": "View ID of the related weakness"}, "@Ordinal": {"type": "string", "description": "Ordinal of the relationship"}}, "type": "object"}, "Mitigations": {"properties": {"Mitigation": {"type": "array", "description": "List of potential mitigations", "items": {"$ref": "#/definitions/Mitigation"}}}, "type": "object"}, "Mitigation": {"required": ["@Mitigation_ID", "Description"], "properties": {"@Mitigation_ID": {"type": "string", "description": "Id of the mitigation"}, "Description": {"type": "string", "description": "Description of the mitigation"}}, "type": "object"}, "MappingNotes": {"properties": {"Usage": {"type": "string", "description": "Mapping usage of the CWE (Allowed, Allowed-with-Review, Discouraged, Prohibited)"}}, "type": "object"}, "CAPECsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of CAPECs.", "items": {"$ref": "#/definitions/CAPEC"}}}, "type": "object"}, "CAPEC": {"properties": {"@ID": {"type": "string", "description": "Identifiant.", "readOnly": true}, "@Name": {"type": "string", "description": "Name.", "readOnly": true}, "@Description": {"type": "string", "description": "Description.", "readOnly": true}}, "type": "object"}, "OrganizationsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of organizations.", "items": {"$ref": "#/definitions/Organization"}}}, "type": "object"}, "Organization": {"properties": {"id": {"type": "string", "description": "Organization id."}, "uuid": {"type": "string", "description": "Organization uuid."}, "name": {"type": "string", "description": "Organization name."}, "short_name": {"type": "string", "description": "Organization short name."}, "description": {"type": "string", "description": "Description."}, "gna_id": {"type": "integer", "description": "The reserved GNA identifier of the organization."}, "creation_timestamp": {"type": "string", "format": "date-time", "description": "Creation time of the organization.", "readOnly": true}, "updated_timestamp": {"type": "string", "format": "date-time", "description": "Updated time of the organization.", "readOnly": true}}, "type": "object"}, "ProductsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of products.", "items": {"$ref": "#/definitions/Product"}}}, "type": "object"}, "Product": {"properties": {"id": {"type": "string", "description": "Product id."}, "uuid": {"type": "string", "description": "Product uuid."}, "name": {"type": "string", "description": "Product name."}, "description": {"type": "string", "description": "Description."}, "creation_timestamp": {"type": "string", "format": "date-time", "description": "Creation time of the product.", "readOnly": true}, "updated_timestamp": {"type": "string", "format": "date-time", "description": "Updated time of the product.", "readOnly": true}}, "type": "object"}, "EMB3DsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of Adversarial Techniques from MITRE EMB3D.", "items": {"$ref": "#/definitions/Emb3d"}}}, "type": "object"}, "Emb3d": {"properties": {"id": {"type": "string", "description": "Identifiant", "readOnly": true}, "Type": {"type": "string", "description": "Type", "readOnly": true}, "description": {"type": "string", "description": "Description", "readOnly": true}, "CWE": {"type": "object", "description": "CWE", "readOnly": true}}, "type": "object"}, "GNAsList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/metadata"}]}, "data": {"type": "array", "description": "List of GNAs.", "items": {"$ref": "#/definitions/GNA"}}}, "type": "object"}, "GNA": {"properties": {"id": {"type": "string", "description": "Unique identifier for the GCVE Numbering Authority.", "readOnly": true}, "short_name": {"type": "string", "description": "Short name of the organization.", "readOnly": true}, "full_name": {"type": "string", "description": "Full legal name of the organization.", "readOnly": true}, "cpe_vendor_name": {"type": "string", "description": "Official CPE vendor name.", "readOnly": true}, "gcve_url": {"type": "string", "description": "URL to the public vulnerability disclosure website.", "readOnly": true}, "gcve_api": {"type": "string", "description": "URL of the API endpoint providing vulnerability data.", "readOnly": true}, "gcve_dump": {"type": "string", "description": "URL to a machine-readable dump (e.g., JSON) of vulnerability information.", "readOnly": true}, "gcve_allocation": {"type": "string", "description": "URL of the interface used to allocate or register new vulnerabilities.", "readOnly": true}, "gcve_pull_api": {"type": "string", "description": "URL of the interface compatible to retrieve the local GNA publications.", "readOnly": true}}, "type": "object"}, "RulesList": {"properties": {"metadata": {"description": "Metadata related to the result.", "allOf": [{"$ref": "#/definitions/RulezetMetadata"}]}, "data": {"type": "array", "description": "List of rules.", "items": {"$ref": "#/definitions/Rule"}}}, "type": "object"}, "RulezetMetadata": {"properties": {"count": {"type": "integer", "description": "Total number of the items of the data.", "readOnly": true}, "page": {"type": "integer", "description": "Number of the page.", "readOnly": true}, "per_page": {"type": "integer", "description": "Requested limit data.", "readOnly": true}, "pages": {"type": "integer", "description": "Total number of pages.", "readOnly": true}}, "type": "object"}, "Rule": {"required": ["creation_date", "description", "detail_url", "format", "id", "raw", "title", "updated_date", "uuid", "vulnerability_id"], "properties": {"id": {"type": "integer", "description": "Rule ID."}, "uuid": {"type": "string", "description": "Rule UUID."}, "vulnerability_id": {"type": "string", "description": "Related vulnerability."}, "format": {"type": "string", "description": "Format of the rule."}, "title": {"type": "string", "description": "Title of the rule."}, "description": {"type": "string", "description": "Description of the rule."}, "raw": {"type": "string", "description": "raw version of the rule."}, "detail_url": {"type": "string", "description": "URL of the rule."}, "creation_date": {"type": "string", "description": "Date the ule was created."}, "updated_date": {"type": "string", "description": "Date the rule was updated."}}, "type": "object"}, "KEVList": {"properties": {"metadata": {"$ref": "#/definitions/ListMetadata"}, "data": {"type": "array", "items": {"$ref": "#/definitions/KEVEntry"}}}, "type": "object"}, "ListMetadata": {"properties": {"count": {"type": "integer", "description": "Total number of the items of the data.", "readOnly": true}, "page": {"type": "integer", "description": "Number of the page.", "readOnly": true}, "per_page": {"type": "integer", "description": "Requested limit data.", "readOnly": true}}, "type": "object"}, "KEVEntry": {"properties": {"uuid": {"type": "string", "description": "KEV entry UUID", "readOnly": true}, "vulnerability": {"$ref": "#/definitions/Vulnerability"}, "gcve": {"description": "GCVE origin metadata for the KEV assertion", "allOf": [{"$ref": "#/definitions/GCVERoot"}]}, "status": {"$ref": "#/definitions/Status"}, "characteristics": {"type": "object", "description": "Technical characteristics"}, "timestamps": {"type": "object", "description": "Temporal context"}, "scope": {"type": "object", "description": "Geographical/sectoral context"}, "evidence": {"type": "array", "description": "Supporting evidence", "items": {"$ref": "#/definitions/Evidence"}}, "references": {"type": "object", "description": "Related references"}}, "type": "object"}, "Vulnerability": {"required": ["vulnId"], "properties": {"vulnId": {"type": "string", "description": "Vulnerability ID"}, "altId": {"type": "array", "description": "Alternative vulnerability identifiers", "items": {"type": "string"}}}, "type": "object"}, "GCVERoot": {"properties": {"origin_uuid": {"type": "string", "description": "UUID of the origin instance where the KEV assertion originated"}, "gna": {"type": "integer", "description": "GNA ID identifying the origin of the KEV assertion (0-65535)", "minimum": 0, "maximum": 65535}, "object_uuid": {"type": "string", "description": "UUID of the KEV assertion in the GCVE ecosystem"}}, "type": "object"}, "Status": {"required": ["exploited", "status_reason", "status_updated_at"], "properties": {"exploited": {"type": "boolean", "description": "Exploitation observed"}, "status_reason": {"type": "string", "description": "Status reason", "example": "confirmed", "enum": ["confirmed", "suspected", "disputed", "historical", "unknown"]}, "status_updated_at": {"type": "string", "format": "date-time", "description": "Status update time"}}, "type": "object"}, "Evidence": {"required": ["source"], "properties": {"type": {"type": "string", "description": "Evidence type (optional)", "example": "incident_response", "enum": ["incident_response", "telemetry", "honeypot", "sinkhole", "vendor_report", "csirt_report", "public_report", "research_report", "unknown"]}, "source": {"type": "string", "description": "Evidence source (required)"}, "signal": {"type": "object", "description": "Evidence signal (string or array of strings)"}, "confidence": {"type": "object", "description": "Confidence (number 0.0-1.0 or string)"}, "details": {"type": "object", "description": "Implementation-specific details"}}, "type": "object"}, "GenericErrorModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"error": {"type": "string", "description": "Error name"}, "message": {"type": "string", "description": "Error description"}}}, "BadRequestModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"error": {"type": "string", "description": "Error name"}, "message": {"type": "string", "description": "Error description"}, "details": {"type": "array", "items": {"type": "object", "properties": {"msg": {"type": "string", "description": "Invalid value"}, "param": {"type": "string", "description": "The name of the parameter with the error"}, "location": {"type": "string", "enum": ["body", "param", "query"], "description": "The location of the parameter"}}}}}}, "PartialReservedCveIdsResponseModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"error": {"type": "string"}, "message": {"type": "string"}, "details": {"type": "object", "properties": {"amount_reserved": {"type": "integer", "format": "int32", "description": "The quantity of IDs reserved in the system"}}}, "cve_ids": {"type": "array", "items": {"properties": {"cve_id": {"type": "string", "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$"}, "cve_year": {"type": "string", "pattern": "^[0-9]{4}$"}, "owning_cna": {"type": "string", "description": "The shortname for the organization that owns the CVE ID"}, "state": {"type": "string", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, "requested_by": {"type": "object", "properties": {"cna": {"type": "string", "description": "The shortname for the organization of the user that requested the ID"}, "user": {"type": "string", "description": "The username for the account that requested the ID"}}}, "reserved": {"type": "string", "format": "date-time", "description": "The time the ID was reserved"}}}}}}, "ReservedCveIdsResonseModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"cve_ids": {"type": "array", "items": {"properties": {"cve_id": {"type": "string", "description": "^CVE-[0-9]{4}-[0-9]{4,}$"}, "cve_year": {"type": "string", "description": "^[0-9]{4}$"}, "owning_cna": {"type": "string", "description": "The shortname for the organization that owns the CVE ID"}, "state": {"type": "string", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, "requested_by": {"type": "object", "properties": {"cna": {"type": "string", "description": "The shortname for the organization of the user that requested the ID"}, "user": {"type": "string", "description": "The username for the account that requested the ID"}}}, "reserved": {"type": "string", "format": "date-time", "description": "The time the ID was reserved"}}}}, "meta": {"type": "object", "properties": {"remaining_quota": {"type": "integer", "format": "int32"}}}}}, "CveIdListResponseModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"totalCount": {"type": "integer", "format": "int32", "description": "Total CVE records found"}, "itemsPerPage": {"type": "integer", "format": "int32", "description": "Number of CVE records in a page"}, "pageCount": {"type": "integer", "format": "int32", "description": "Total number of pages"}, "currentPage": {"type": "integer", "format": "int32", "description": "Current page"}, "prevPage": {"type": "integer", "format": "int32", "description": "Previous page"}, "nextPage": {"type": "integer", "format": "int32", "description": "Next page"}, "cve_ids": {"type": "array", "items": {"type": "object", "properties": {"cve_id": {"type": "string", "description": "^CVE-[0-9]{4}-[0-9]{4,}$"}, "cve_year": {"type": "string", "description": "^[0-9]{4}$"}, "owning_cna": {"type": "string", "description": "The shortname for the organization that owns the CVE ID"}, "state": {"type": "string", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, "requested_by": {"type": "object", "properties": {"cna": {"type": "string", "description": "The shortname for the organization of the user that requested the ID"}, "user": {"type": "string", "description": "The username for the account that requested the ID"}}}, "reserved": {"type": "string", "format": "date-time", "description": "The time the ID was reserved"}, "time": {"type": "object", "properties": {"created": {"type": "string", "format": "date-time", "description": "The time the ID was created"}, "modified": {"type": "string", "format": "date-time", "description": "The last time the ID was modified"}}}}}}}}, "CveIdUpdateModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "updated": {"type": "object", "properties": {"cve_id": {"type": "string", "description": "^CVE-[0-9]{4}-[0-9]{4,}$"}, "cve_year": {"type": "string", "description": "^[0-9]{4}$"}, "owning_cna": {"type": "string", "description": "The shortname for the organization that owns the CVE ID"}, "state": {"type": "string", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, "requested_by": {"type": "object", "properties": {"cna": {"type": "string", "description": "The shortname for the organization of the user that requested the ID"}, "user": {"type": "string", "description": "The username for the account that requested the ID"}}}, "reserved": {"type": "string", "format": "date-time", "description": "The time the ID was reserved"}, "time": {"type": "object", "properties": {"created": {"type": "string", "format": "date-time", "description": "The time the ID was created"}, "modified": {"type": "string", "format": "date-time", "description": "The last time the ID was modified"}}}}}}}, "CveIdGetModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "cve_id": {"type": "string", "description": "^CVE-[0-9]{4}-[0-9]{4,}$"}, "cve_year": {"type": "string", "description": "^[0-9]{4}$"}, "owning_cna": {"type": "string", "description": "The shortname for the organization that owns the CVE ID"}, "state": {"type": "string", "enum": ["RESERVED", "PUBLISHED", "REJECTED"]}, "requested_by": {"type": "object", "properties": {"cna": {"type": "string", "description": "The shortname for the organization of the user that requested the ID"}, "user": {"type": "string", "description": "The username for the account that requested the ID"}}}, "reserved": {"type": "string", "format": "date-time", "description": "The time the ID was reserved"}, "time": {"type": "object", "properties": {"created": {"type": "string", "format": "date-time", "description": "The time the ID was created"}, "modified": {"type": "string", "format": "date-time", "description": "The last time the ID was modified"}}}}}, "CveRecordResponseModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "created": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "product": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}, "shortName": {"type": "string"}, "dateUpdated": {"type": "string", "format": "date-time"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "tags": {"type": "array", "items": {"type": "string"}}, "url": {"type": "string"}}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}, "CveRecordUpdateresponseModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "updated": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "product": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "url": {"type": "string"}}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}, "CveGetUnionResponse": {"$schema": "http://json-schema.org/draft-04/schema#", "oneOf": [{"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "tags": {"type": "array", "items": {"type": "string"}}, "url": {"type": "string"}}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}, {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "created": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"rejectedReasons": {"type": "array", "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}, "supportingMedia": {"type": "array", "items": {"type": "object", "properties": {"type": {"type": "string", "title": "Media type", "minLength": 1, "maxLength": 256, "description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.", "examples": ["text/markdown", "text/html", "image/png", "image/svg", "audio/mp3"]}, "base64": {"type": "boolean", "title": "Encoding", "description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.", "default": false}, "value": {"type": "string", "description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.", "minLength": 1, "maxLength": 16384}}, "required": ["type", "value"]}}}}}, "replacedBy": {"type": "array", "items": {"type": "string"}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}, "shortName": {"type": "string"}, "dateUpdated": {"type": "string", "format": "date-time"}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}]}, "CveListUnionResponse": {"$schema": "http://json-schema.org/draft-04/schema#", "oneOf": [{"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"totalCount": {"type": "integer", "format": "int32"}, "itemsPerPage": {"type": "integer", "format": "int32"}, "pageCount": {"type": "integer", "format": "int32"}, "currentPage": {"type": "integer", "format": "int32"}, "prevPage": {"type": "integer", "format": "int32"}, "nextPage": {"type": "integer", "format": "int32"}, "cveRecords": {"type": "array", "items": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "tags": {"type": "array", "items": {"type": "string"}}, "url": {"type": "string"}}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "integer"}}}}}}, {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "created": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"rejectedReasons": {"type": "array", "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}, "supportingMedia": {"type": "array", "items": {"type": "object", "properties": {"type": {"type": "string", "title": "Media type", "minLength": 1, "maxLength": 256, "description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.", "examples": ["text/markdown", "text/html", "image/png", "image/svg", "audio/mp3"]}, "base64": {"type": "boolean", "title": "Encoding", "description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.", "default": false}, "value": {"type": "string", "description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.", "minLength": 1, "maxLength": 16384}}, "required": ["type", "value"]}}}}}, "replacedBy": {"type": "array", "items": {"type": "string"}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}, "shortName": {"type": "string"}, "dateUpdated": {"type": "string", "format": "date-time"}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}]}, "RecordCountModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"totalCount": {"type": "integer", "format": "int32"}}}, "CveCursorUnionResponse": {"$schema": "http://json-schema.org/draft-04/schema#", "oneOf": [{"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"hasNext": {"type": "boolean"}, "hasPrevious": {"type": "boolean"}, "next": {"type": "string"}, "previous": {"type": "string"}, "cveRecords": {"type": "array", "items": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "tags": {"type": "array", "items": {"type": "string"}}, "url": {"type": "string"}}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "integer"}}}}}}, {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "created": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"rejectedReasons": {"type": "array", "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}, "supportingMedia": {"type": "array", "items": {"type": "object", "properties": {"type": {"type": "string", "title": "Media type", "minLength": 1, "maxLength": 256, "description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.", "examples": ["text/markdown", "text/html", "image/png", "image/svg", "audio/mp3"]}, "base64": {"type": "boolean", "title": "Encoding", "description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.", "default": false}, "value": {"type": "string", "description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.", "minLength": 1, "maxLength": 16384}}, "required": ["type", "value"]}}}}}, "replacedBy": {"type": "array", "items": {"type": "string"}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}, "shortName": {"type": "string"}, "dateUpdated": {"type": "string", "format": "date-time"}}}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}]}, "CnaRequestModel": {"$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://cve.org/cve/record/v5_00/", "type": "object", "title": "CVE JSON record format", "description": "cve-schema specifies the CVE JSON record format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://cve.mitre.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).", "definitions": {"uriType": {"type": "string", "format": "uri"}, "uuidType": {"type": "string"}, "reference": {"type": "object", "required": ["url"], "properties": {"url": {"$ref": "#/definitions/uriType"}, "name": {"type": "string"}, "tags": {"type": "array", "items": {"oneOf": [{"$ref": "#/definitions/tagExtension"}, {"$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://cve.mitre.org/cve/v5_00/tags/reference/", "type": "string"}]}}}}, "cveId": {"type": "string"}, "orgId": {"$ref": "#/definitions/uuidType"}, "userId": {"$ref": "#/definitions/uuidType"}, "shortName": {"type": "string"}, "datestamp": {"type": "string", "format": "date"}, "timestamp": {"type": "string", "format": "date-time"}, "version": {"type": "string"}, "status": {"type": "string"}, "product": {"type": "object", "allOf": [{"anyOf": [{"required": ["vendor", "product"]}, {"required": ["collectionURL", "packageName"]}]}, {"anyOf": [{"required": ["versions"]}, {"required": ["defaultStatus"]}]}], "properties": {"vendor": {"type": "string"}, "product": {"type": "string"}, "collectionURL": {"$ref": "#/definitions/uriType"}, "packageName": {"type": "string"}, "cpes": {"type": "array", "uniqueItems": true, "items": {"type": "string"}}, "modules": {"type": "array", "uniqueItems": true, "items": {"type": "string"}}, "programFiles": {"type": "array", "uniqueItems": true, "items": {"type": "string"}}, "programRoutines": {"type": "array", "uniqueItems": true, "items": {"type": "object", "required": ["name"], "properties": {"name": {"type": "string"}}}}, "platforms": {"type": "array", "uniqueItems": true, "items": {"type": "string"}}, "repo": {"$ref": "#/definitions/uriType"}, "defaultStatus": {"$ref": "#/definitions/status"}, "versions": {"type": "array", "uniqueItems": true, "items": {"type": "object", "oneOf": [{"required": ["version", "status"], "maxProperties": 2}, {"required": ["version", "status", "versionType"], "oneOf": [{"required": ["lessThan"]}, {"required": ["lessThanOrEqual"]}]}], "properties": {"version": {"$ref": "#/definitions/version"}, "status": {"$ref": "#/definitions/status"}, "versionType": {"type": "string"}, "lessThan": {"$ref": "#/definitions/version"}, "lessThanOrEqual": {"$ref": "#/definitions/version"}, "changes": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "required": ["at", "status"], "properties": {"at": {"$ref": "#/definitions/version"}, "status": {"$ref": "#/definitions/status"}}}}}}}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}, "cveMetadataPublished": {"type": "object", "required": ["cveId", "assignerOrgId", "state"], "properties": {"cveId": {"$ref": "#/definitions/cveId"}, "assignerOrgId": {"$ref": "#/definitions/orgId"}, "assignerShortName": {"$ref": "#/definitions/shortName"}, "requesterUserId": {"$ref": "#/definitions/userId"}, "dateUpdated": {"$ref": "#/definitions/timestamp"}, "serial": {"type": "integer"}, "dateReserved": {"$ref": "#/definitions/timestamp"}, "datePublished": {"$ref": "#/definitions/timestamp"}, "state": {"type": "string"}}, "additionalProperties": false}, "cveMetadataRejected": {"type": "object", "required": ["cveId", "assignerOrgId", "state"], "properties": {"cveId": {"$ref": "#/definitions/cveId"}, "assignerOrgId": {"$ref": "#/definitions/orgId"}, "assignerShortName": {"$ref": "#/definitions/shortName"}, "serial": {"type": "integer"}, "dateUpdated": {"$ref": "#/definitions/timestamp"}, "datePublished": {"$ref": "#/definitions/timestamp"}, "dateRejected": {"$ref": "#/definitions/timestamp"}, "state": {"type": "string"}, "dateReserved": {"$ref": "#/definitions/timestamp"}}, "additionalProperties": false}, "providerMetadata": {"type": "object", "properties": {"orgId": {"$ref": "#/definitions/orgId"}, "shortName": {"$ref": "#/definitions/shortName"}, "dateUpdated": {"$ref": "#/definitions/timestamp"}}, "required": ["orgId"]}, "cnaPublishedContainer": {"type": "object", "properties": {"providerMetadata": {"$ref": "#/definitions/providerMetadata"}, "dateAssigned": {"$ref": "#/definitions/timestamp"}, "datePublic": {"$ref": "#/definitions/timestamp"}, "title": {"type": "string"}, "descriptions": {"$ref": "#/definitions/descriptions"}, "affected": {"$ref": "#/definitions/affected"}, "problemTypes": {"$ref": "#/definitions/problemTypes"}, "references": {"$ref": "#/definitions/references"}, "impacts": {"$ref": "#/definitions/impacts"}, "metrics": {"$ref": "#/definitions/metrics"}, "configurations": {"$ref": "#/definitions/configurations"}, "workarounds": {"$ref": "#/definitions/workarounds"}, "solutions": {"$ref": "#/definitions/solutions"}, "exploits": {"$ref": "#/definitions/exploits"}, "timeline": {"$ref": "#/definitions/timeline"}, "credits": {"$ref": "#/definitions/credits"}, "source": {"$ref": "#/definitions/source"}, "tags": {"$ref": "#/definitions/cnaTags"}, "taxonomyMappings": {"$ref": "#/definitions/taxonomyMappings"}}, "required": ["providerMetadata", "descriptions", "affected", "references"], "patternProperties": {"^x_[^.]*$": {}}, "additionalProperties": false}, "cnaRejectedContainer": {"type": "object", "properties": {"providerMetadata": {"$ref": "#/definitions/providerMetadata"}, "rejectedReasons": {"$ref": "#/definitions/descriptions"}, "replacedBy": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/cveId"}}}, "required": ["providerMetadata", "rejectedReasons"], "patternProperties": {"^x_[^.]*$": {}}, "additionalProperties": false}, "affected": {"type": "array", "minItems": 1, "items": {"$ref": "#/definitions/product"}}, "description": {"type": "object", "properties": {"lang": {"$ref": "#/definitions/language"}, "value": {"type": "string"}, "supportingMedia": {"type": "array", "uniqueItems": true, "minItems": 1, "items": {"type": "object", "properties": {"type": {"type": "string"}, "base64": {"type": "boolean", "default": false}, "value": {"type": "string"}}, "required": ["type", "value"]}}}, "required": ["lang", "value"], "additionalProperties": false}, "englishLanguageDescription": {"type": "object", "properties": {"lang": {"$ref": "#/definitions/englishLanguage"}}, "required": ["lang"]}, "descriptions": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/description"}, "contains": {"$ref": "#/definitions/englishLanguageDescription"}}, "problemTypes": {"type": "array", "items": {"type": "object", "required": ["descriptions"], "properties": {"descriptions": {"type": "array", "items": {"type": "object", "required": ["lang", "description"], "properties": {"lang": {"$ref": "#/definitions/language"}, "description": {"type": "string"}, "cweId": {"type": "string"}, "type": {"type": "string"}, "references": {"$ref": "#/definitions/references"}}}, "minItems": 1, "uniqueItems": true}}}, "minItems": 1, "uniqueItems": true}, "references": {"type": "array", "items": {"$ref": "#/definitions/reference"}, "minItems": 1, "maxItems": 512, "uniqueItems": true}, "impacts": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "required": ["descriptions"], "properties": {"capecId": {"type": "string"}, "descriptions": {"$ref": "#/definitions/descriptions"}}}}, "metrics": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "anyOf": [{"required": ["cvssV4_0"]}, {"required": ["cvssV3_1"]}, {"required": ["cvssV3_0"]}, {"required": ["cvssV2_0"]}, {"required": ["other"]}], "properties": {"format": {"type": "string"}, "scenarios": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "properties": {"lang": {"$ref": "#/definitions/language"}, "value": {"type": "string"}}, "required": ["lang", "value"]}}, "cvssV4_0": {"$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "allOf": [{"properties": {"baseScore": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"}, "baseSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"}}}, {"properties": {"threatScore": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"}, "threatSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"}}}, {"properties": {"environmentalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"}, "environmentalSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"}}}], "definitions": {"attackComplexityType": {"type": "string"}, "attackRequirementsType": {"type": "string"}, "attackVectorType": {"type": "string"}, "automatableType": {"type": "string"}, "ciaRequirementType": {"type": "string"}, "criticalScoreType": {"type": "number"}, "criticalSeverityType": {"const": "string"}, "exploitMaturityType": {"type": "string"}, "highScoreType": {"type": "number"}, "highSeverityType": {"type": "string"}, "lowScoreType": {"type": "number"}, "lowSeverityType": {"type": "string"}, "mediumScoreType": {"type": "number"}, "mediumSeverityType": {"const": "string"}, "modifiedAttackComplexityType": {"type": "string"}, "modifiedAttackRequirementsType": {"type": "string"}, "modifiedAttackVectorType": {"type": "string"}, "modifiedPrivilegesRequiredType": {"type": "string"}, "modifiedSubCType": {"type": "string"}, "modifiedSubIaType": {"type": "string"}, "modifiedUserInteractionType": {"type": "string"}, "modifiedVulnCiaType": {"type": "string"}, "noneScoreType": {"type": "number"}, "noneSeverityType": {"const": "string"}, "privilegesRequiredType": {"type": "string"}, "providerUrgencyType": {"type": "string"}, "recoveryType": {"type": "string"}, "safetyType": {"type": "string"}, "scoreType": {"type": "number"}, "severityType": {"type": "string"}, "subCiaType": {"type": "string"}, "userInteractionType": {"type": "string"}, "valueDensityType": {"type": "string"}, "vulnCiaType": {"type": "string"}, "vulnerabilityResponseEffortType": {"type": "string"}}, "properties": {"Automatable": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/automatableType"}, "Recovery": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/recoveryType"}, "Safety": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/safetyType"}, "attackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackComplexityType"}, "attackRequirements": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackRequirementsType"}, "attackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackVectorType"}, "availabilityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"}, "baseScore": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/scoreType"}, "baseSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/severityType"}, "confidentialityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"}, "exploitMaturity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/exploitMaturityType"}, "integrityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"}, "modifiedAttackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackComplexityType"}, "modifiedAttackRequirements": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackRequirementsType"}, "modifiedAttackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackVectorType"}, "modifiedPrivilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedPrivilegesRequiredType"}, "modifiedSubAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubIaType"}, "modifiedSubConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubCType"}, "modifiedSubIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubIaType"}, "modifiedUserInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedUserInteractionType"}, "modifiedVulnAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"}, "modifiedVulnConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"}, "modifiedVulnIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"}, "privilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/privilegesRequiredType"}, "providerUrgency": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/providerUrgencyType"}, "subAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"}, "subConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"}, "subIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"}, "userInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/userInteractionType"}, "valueDensity": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/valueDensityType"}, "vectorString": {"type": "string"}, "version": {"description": "CVSS Version", "enum": ["4.0"], "type": "string"}, "vulnAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"}, "vulnConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"}, "vulnIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"}, "vulnerabilityResponseEffort": {"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnerabilityResponseEffortType"}}, "required": ["version", "vectorString", "baseScore", "baseSeverity"], "title": "JSON Schema for Common Vulnerability Scoring System version 4.0", "type": "object"}, "cvssV3_1": {"$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "definitions": {"attackVectorType": {"type": "string"}, "modifiedAttackVectorType": {"type": "string"}, "attackComplexityType": {"type": "string"}, "modifiedAttackComplexityType": {"type": "string"}, "privilegesRequiredType": {"type": "string"}, "modifiedPrivilegesRequiredType": {"type": "string"}, "userInteractionType": {"type": "string"}, "modifiedUserInteractionType": {"type": "string"}, "scopeType": {"type": "string"}, "modifiedScopeType": {"type": "string"}, "ciaType": {"type": "string"}, "modifiedCiaType": {"type": "string"}, "exploitCodeMaturityType": {"type": "string"}, "remediationLevelType": {"type": "string"}, "confidenceType": {"type": "string"}, "ciaRequirementType": {"type": "string"}, "scoreType": {"type": "number"}, "severityType": {"type": "string"}}, "properties": {"version": {"description": "CVSS Version", "type": "string"}, "vectorString": {"type": "string"}, "attackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/attackVectorType"}, "attackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/attackComplexityType"}, "privilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/privilegesRequiredType"}, "userInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/userInteractionType"}, "scope": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scopeType"}, "confidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"}, "integrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"}, "availabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"}, "baseScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"}, "baseSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"}, "exploitCodeMaturity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/exploitCodeMaturityType"}, "remediationLevel": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/remediationLevelType"}, "reportConfidence": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/confidenceType"}, "temporalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"}, "temporalSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"}, "confidentialityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"}, "integrityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"}, "availabilityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"}, "modifiedAttackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedAttackVectorType"}, "modifiedAttackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedAttackComplexityType"}, "modifiedPrivilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedPrivilegesRequiredType"}, "modifiedUserInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedUserInteractionType"}, "modifiedScope": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedScopeType"}, "modifiedConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"}, "modifiedIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"}, "modifiedAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"}, "environmentalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"}, "environmentalSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"}}, "required": ["version", "vectorString", "baseScore", "baseSeverity"]}, "cvssV3_0": {"$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "definitions": {"attackVectorType": {"type": "string"}, "modifiedAttackVectorType": {"type": "string"}, "attackComplexityType": {"type": "string"}, "modifiedAttackComplexityType": {"type": "string"}, "privilegesRequiredType": {"type": "string"}, "modifiedPrivilegesRequiredType": {"type": "string"}, "userInteractionType": {"type": "string"}, "modifiedUserInteractionType": {"type": "string"}, "scopeType": {"type": "string"}, "modifiedScopeType": {"type": "string"}, "ciaType": {"type": "string"}, "modifiedCiaType": {"type": "string"}, "exploitCodeMaturityType": {"type": "string"}, "remediationLevelType": {"type": "string"}, "confidenceType": {"type": "string"}, "ciaRequirementType": {"type": "string"}, "scoreType": {"type": "number"}, "severityType": {"type": "string"}}, "properties": {"version": {"type": "string"}, "vectorString": {"type": "string"}, "attackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/attackVectorType"}, "attackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/attackComplexityType"}, "privilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/privilegesRequiredType"}, "userInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/userInteractionType"}, "scope": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scopeType"}, "confidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"}, "integrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"}, "availabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"}, "baseScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"}, "baseSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"}, "exploitCodeMaturity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/exploitCodeMaturityType"}, "remediationLevel": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/remediationLevelType"}, "reportConfidence": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/confidenceType"}, "temporalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"}, "temporalSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"}, "confidentialityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"}, "integrityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"}, "availabilityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"}, "modifiedAttackVector": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedAttackVectorType"}, "modifiedAttackComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedAttackComplexityType"}, "modifiedPrivilegesRequired": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedPrivilegesRequiredType"}, "modifiedUserInteraction": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedUserInteractionType"}, "modifiedScope": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedScopeType"}, "modifiedConfidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"}, "modifiedIntegrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"}, "modifiedAvailabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"}, "environmentalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"}, "environmentalSeverity": {"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"}}, "required": ["version", "vectorString", "baseScore", "baseSeverity"]}, "cvssV2_0": {"$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "definitions": {"accessVectorType": {"type": "string"}, "accessComplexityType": {"type": "string"}, "authenticationType": {"type": "string"}, "ciaType": {"type": "string"}, "exploitabilityType": {"type": "string"}, "remediationLevelType": {"type": "string"}, "reportConfidenceType": {"type": "string"}, "collateralDamagePotentialType": {"type": "string"}, "targetDistributionType": {"type": "string"}, "ciaRequirementType": {"type": "string"}, "scoreType": {"type": "number"}}, "properties": {"version": {"type": "string"}, "vectorString": {"type": "string"}, "accessVector": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/accessVectorType"}, "accessComplexity": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/accessComplexityType"}, "authentication": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/authenticationType"}, "confidentialityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"}, "integrityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"}, "availabilityImpact": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"}, "baseScore": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"}, "exploitability": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/exploitabilityType"}, "remediationLevel": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/remediationLevelType"}, "reportConfidence": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/reportConfidenceType"}, "temporalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"}, "collateralDamagePotential": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/collateralDamagePotentialType"}, "targetDistribution": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/targetDistributionType"}, "confidentialityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"}, "integrityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"}, "availabilityRequirement": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"}, "environmentalScore": {"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"}}, "required": ["version", "vectorString", "baseScore"]}, "other": {"type": "object", "required": ["type", "content"], "properties": {"type": {"type": "string"}, "content": {"type": "object"}}}}}}, "configurations": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/description"}}, "workarounds": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/description"}}, "solutions": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/description"}}, "exploits": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/definitions/description"}}, "timeline": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "required": ["time", "lang", "value"], "properties": {"time": {"$ref": "#/definitions/timestamp"}, "lang": {"$ref": "#/definitions/language"}, "value": {"type": "string"}}}}, "credits": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "properties": {"lang": {"$ref": "#/definitions/language"}, "value": {"type": "string"}, "user": {"$ref": "#/definitions/uuidType"}, "type": {"type": "string"}}, "required": ["lang", "value"]}}, "source": {"type": "object", "minProperties": 1}, "language": {"type": "string"}, "englishLanguage": {"type": "string"}, "taxonomyMappings": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "required": ["taxonomyName", "taxonomyRelations"], "properties": {"taxonomyName": {"type": "string", "minLength": 1, "maxLength": 128}, "taxonomyVersion": {"type": "string", "minLength": 1, "maxLength": 128}, "taxonomyRelations": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "object", "required": ["taxonomyId", "relationshipName", "relationshipValue"], "properties": {"taxonomyId": {"type": "string", "minLength": 1, "maxLength": 2048}, "relationshipName": {"type": "string", "minLength": 1, "maxLength": 128}, "relationshipValue": {"type": "string", "minLength": 1, "maxLength": 2048}}}}}}}, "tagExtension": {"type": "string"}, "cnaTags": {"type": "array", "uniqueItems": true, "minItems": 1, "items": {"oneOf": [{"$ref": "#/definitions/tagExtension"}, {"$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://cve.mitre.org/cve/v5_00/tags/cna/", "type": "string"}]}}, "adpTags": {"type": "array", "uniqueItems": true, "minItems": 1, "items": {"oneOf": [{"$ref": "#/definitions/tagExtension"}, {"$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://cve.mitre.org/cve/v5_00/tags/adp/", "type": "string"}]}}, "adpContainer": {"type": "object", "properties": {"providerMetadata": {"$ref": "#/definitions/providerMetadata"}, "datePublic": {"$ref": "#/definitions/timestamp"}, "title": {"type": "string"}, "descriptions": {"$ref": "#/definitions/descriptions"}, "affected": {"$ref": "#/definitions/affected"}, "problemTypes": {"$ref": "#/definitions/problemTypes"}, "references": {"$ref": "#/definitions/references"}, "impacts": {"$ref": "#/definitions/impacts"}, "metrics": {"$ref": "#/definitions/metrics"}, "configurations": {"$ref": "#/definitions/configurations"}, "workarounds": {"$ref": "#/definitions/workarounds"}, "solutions": {"$ref": "#/definitions/solutions"}, "exploits": {"$ref": "#/definitions/exploits"}, "timeline": {"$ref": "#/definitions/timeline"}, "credits": {"$ref": "#/definitions/credits"}, "source": {"$ref": "#/definitions/source"}, "tags": {"$ref": "#/definitions/adpTags"}, "taxonomyMappings": {"$ref": "#/definitions/taxonomyMappings"}}, "required": ["providerMetadata"], "minProperties": 2, "patternProperties": {"^x_[^.]*$": {}}, "additionalProperties": false}}, "required": ["adpContainer"], "properties": {"adpContainer": {"$ref": "#/definitions/adpContainer"}}}, "CreateCveRecordModel": {"$schema": "http://json-schema.org/draft-04/schema", "type": "object", "properties": {"message": {"type": "string"}, "updated": {"type": "object", "properties": {"containers": {"type": "object", "properties": {"cna": {"type": "object", "properties": {"affected": {"type": "object", "properties": {"vendor": {"type": "string"}, "product": {"type": "string"}, "versions": {"type": "array", "items": {"type": "object", "properties": {"version": {"type": "string"}, "status": {"type": "string"}}}}}}, "descriptions": {"type": "array", "required": ["lang", "value"], "items": {"type": "object", "properties": {"lang": {"type": "string"}, "value": {"type": "string"}}}}, "problemTypes": {"type": "array", "items": {"type": "object", "properties": {"descriptions": {"type": "array", "items": {"type": "object", "properties": {"description": {"type": "string"}, "lang": {"type": "string"}, "type": {"type": "string"}}}}}}}, "providerMetadata": {"type": "object", "properties": {"orgId": {"type": "string"}}}, "references": {"type": "array", "items": {"type": "object", "properties": {"name": {"type": "string"}, "url": {"type": "string"}}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}, "cveMetadata": {"type": "object", "properties": {"assignerOrgId": {"type": "string"}, "cveId": {"type": "string"}, "state": {"type": "string"}, "assignerShortName": {"type": "string"}, "requesterUserId": {"type": "string"}, "dateReserved": {"type": "string"}, "datePublished": {"type": "string"}}}, "dataType": {"type": "string"}, "dataVersion": {"type": "string"}}}}}, "EUVDList": {"properties": {"metadata": {"$ref": "#/definitions/EUVDListMetadata"}, "data": {"type": "array", "items": {"$ref": "#/definitions/EUVD"}}}, "type": "object"}, "EUVDListMetadata": {"properties": {"count": {"type": "integer", "description": "Number of entries returned."}, "limit": {"type": "integer", "description": "Maximum that was requested."}}, "type": "object"}, "EUVD": {"properties": {"id": {"type": "string", "description": "EUVD identifier, e.g. EUVD-2026-0001."}, "description": {"type": "string", "description": "Description of the linked CVE."}, "date_published": {"type": "string", "description": "ISO-8601 publication timestamp."}, "date_updated": {"type": "string", "description": "ISO-8601 last-update timestamp."}, "cvss": {"description": "Highest-version CVSS metric of the linked CVE.", "allOf": [{"$ref": "#/definitions/EUVDCvss"}]}, "references": {"type": "array", "description": "Reference URLs.", "items": {"type": "string"}}, "aliases": {"type": "array", "description": "Identifiers this entry is also known by.", "items": {"type": "string"}}, "assigner": {"type": "string", "description": "CNA that assigned the linked CVE."}, "epss": {"type": "number", "description": "EPSS probability (0..1) of the linked CVE."}, "exploited_since": {"type": "string", "description": "ISO-8601 timestamp of the earliest KEV listing."}, "vendors": {"type": "array", "description": "Affected vendor names.", "items": {"type": "string"}}, "products": {"type": "array", "description": "Affected products.", "items": {"$ref": "#/definitions/EUVDProduct"}}}, "type": "object"}, "EUVDCvss": {"properties": {"base_score": {"type": "number", "description": "CVSS base score."}, "version": {"type": "string", "description": "CVSS version the score comes from."}, "vector": {"type": "string", "description": "CVSS vector string."}}, "type": "object"}, "EUVDProduct": {"properties": {"vendor": {"type": "string", "description": "Vendor name, as the CNA wrote it."}, "name": {"type": "string", "description": "Product name, as the CNA wrote it."}, "version": {"type": "string", "description": "Affected version or version range."}}, "type": "object"}, "EUVDError": {"properties": {"message": {"type": "string", "description": "Why the request could not be answered."}}, "type": "object"}, "EUVDDetail": {"allOf": [{"$ref": "#/definitions/EUVD"}, {"properties": {"vulnerabilities": {"type": "array", "description": "The records this EUVD is an identifier for.", "items": {"$ref": "#/definitions/EUVDLinkedVulnerability"}}, "advisories": {"type": "array", "description": "CSAF advisories covering this entry.", "items": {"$ref": "#/definitions/EUVDLinkedAdvisory"}}}, "type": "object"}]}, "EUVDLinkedVulnerability": {"properties": {"id": {"type": "string", "description": "Identifier, e.g. CVE-2026-1234."}, "status": {"type": "string", "description": "Lifecycle state: PUBLISHED, REJECTED, RESERVED."}, "description": {"type": "string", "description": "Description of the record."}, "date_published": {"type": "string", "description": "ISO-8601 publication timestamp."}, "date_updated": {"type": "string", "description": "ISO-8601 last-update timestamp."}, "cvss": {"$ref": "#/definitions/EUVDCvss"}, "references": {"type": "array", "description": "Reference URLs.", "items": {"type": "string"}}, "assigner": {"type": "string", "description": "CNA that assigned the record."}, "epss": {"type": "number", "description": "EPSS probability (0..1)."}, "vendors": {"type": "array", "description": "Affected vendor names.", "items": {"type": "string"}}, "products": {"type": "array", "items": {"$ref": "#/definitions/EUVDProduct"}}}, "type": "object"}, "EUVDLinkedAdvisory": {"properties": {"id": {"type": "string", "description": "The advisory's own tracking id."}, "source": {"type": "string", "description": "VL source holding the advisory."}}, "type": "object"}, "EUVDAdvisory": {"properties": {"id": {"type": "string", "description": "The advisory's own tracking id."}, "title": {"type": "string", "description": "Advisory title."}, "summary": {"type": "string", "description": "The advisory's summary note."}, "date_published": {"type": "string", "description": "ISO-8601 initial release."}, "date_updated": {"type": "string", "description": "ISO-8601 current release."}, "references": {"type": "array", "description": "The advisory's own URLs.", "items": {"type": "string"}}, "aliases": {"type": "array", "description": "CVEs the advisory covers.", "items": {"type": "string"}}, "source": {"type": "string", "description": "VL source holding the advisory."}, "products": {"type": "array", "items": {"$ref": "#/definitions/EUVDAdvisoryProduct"}}, "euvds": {"type": "array", "description": "EUVD entries this advisory covers.", "items": {"$ref": "#/definitions/EUVD"}}}, "type": "object"}, "EUVDAdvisoryProduct": {"properties": {"name": {"type": "string", "description": "Product name from the CSAF product tree."}, "vendor": {"type": "string", "description": "Nearest enclosing vendor branch."}}, "type": "object"}, "EUVDSearchResult": {"properties": {"metadata": {"$ref": "#/definitions/EUVDSearchMetadata"}, "data": {"type": "array", "items": {"$ref": "#/definitions/EUVD"}}}, "type": "object"}, "EUVDSearchMetadata": {"properties": {"count": {"type": "integer", "description": "Entries matching the filters. A total when count_is_exact is true, otherwise a lower bound."}, "count_is_exact": {"type": "boolean", "description": "True when the walk reached the end of the index, so count is the complete total; false when it stopped at its bound."}, "has_more": {"type": "boolean", "description": "True when further entries are available beyond this page."}, "page": {"type": "integer", "description": "Page returned (1-indexed)."}, "per_page": {"type": "integer", "description": "Entries per page."}}, "type": "object"}, "EUVDStatsCount": {"properties": {"granularity": {"type": "string", "description": "year or month."}, "available": {"type": "boolean", "description": "False when the counters have never been prepared; counts is then empty."}, "counts": {"type": "object", "description": "Period (YYYY or YYYY-MM) -> record count."}}, "type": "object"}, "EUVDStatsError": {"properties": {"message": {"type": "string", "description": "Why the request could not be answered."}}, "type": "object"}, "EUVDStatsStatus": {"properties": {"period": {"type": "string", "description": "The year the counts cover, absent for the whole catalogue."}, "total": {"type": "integer", "description": "Records in the catalogue. Absent with a period: the base index is scored by a record's last update, so a year of it would count records touched in that year rather than records of it."}, "published": {"type": "integer", "description": "Records carrying a publication date, withdrawn ones included."}, "reserved": {"type": "integer", "description": "Records carrying a reservation date."}, "state": {"description": "Current lifecycle state, absent while the catalogue keeps no state index.", "allOf": [{"$ref": "#/definitions/EUVDStatsLifecycle"}]}}, "type": "object"}, "EUVDStatsLifecycle": {"properties": {"published": {"type": "integer", "description": "Records whose current state is PUBLISHED."}, "reserved": {"type": "integer", "description": "Records whose current state is RESERVED."}, "rejected": {"type": "integer", "description": "Records whose current state is REJECTED, i.e. withdrawn."}}, "type": "object"}, "EUVDStatsDistribution": {"properties": {"period": {"type": "string", "description": "The publication year the distribution covers, or null for the whole catalogue."}, "available": {"type": "boolean", "description": "False when the distribution has never been prepared; distribution is then empty."}, "distribution": {"type": "object", "description": "Bucket -> record count."}}, "type": "object"}, "EUVDStatsKEV": {"properties": {"available": {"type": "boolean", "description": "False before the KEV sync has built the exploited index."}, "basis": {"type": "string", "description": "What the counts are counted on: `membership` without granularity (set membership, carrying no date), `listed_at` with it (the date each catalogue listed the record, never the record's publication date)."}, "granularity": {"type": "string", "description": "year or month with a period series, null without one."}, "period": {"type": "string", "description": "With granularity=month, the year broken into months."}, "total": {"type": "integer", "description": "The denominator: records in the catalogue, published where that is known. Null in the period form."}, "total_basis": {"type": "string", "description": "Which population ``total`` counts: ``state_published`` for a source whose lifecycle index says what is published now, ``date_published`` for one that only records when a vulnerability was published, ``held`` for one that does neither. Null in the period form."}, "exploited": {"type": "integer", "description": "Records whose CVE appears in at least one of the catalogues in `catalogs` (a union, not their sum). Null in the period form, where `totals` carries the series."}, "ratio": {"type": "number", "description": "exploited / total, or null when the catalogue is empty."}, "catalogs": {"type": "object", "description": "Catalogue short name -> record count, or -> {period: count} with a granularity. These overlap: a record listed by two catalogues is counted by both, so they sum to more than `exploited` (or than `totals`)."}, "totals": {"type": "object", "description": "Period -> distinct records that became known exploited in it, each counted once in the period its first catalogue listed it. Only with a granularity."}, "scope_catalogs": {"type": "object", "description": "The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form."}, "scoped": {"type": "boolean", "description": "True when the figure is restricted to the catalogues configured for this source (STATS_KEV_CATALOGS): `exploited` is then the union of exactly the catalogues listed in `catalogs`. False when it covers every catalogue the instance knows."}, "unattributed": {"type": "integer", "description": "Exploited records held under a catalogue this instance cannot name, counted the same way when `scoped`: a record a scope leaves out is not unattributed, but one in no known catalogue still is. Non-zero means the local GCVE reference data is absent or stale. Null in the period form, where `unattributed_periods` carries the series."}, "unattributed_periods": {"type": "object", "description": "Period -> exploited records held under a catalogue this instance cannot name. Only with a granularity; the membership form reports the count in `unattributed`."}, "computed_at": {"type": "string", "description": "When the period buckets were last prepared."}}, "type": "object"}, "EUVDStatsTimeToExploit": {"properties": {"period": {"type": "string", "description": "The publication year the summary covers, or null for the whole catalogue."}, "available": {"type": "boolean", "description": "False when the cross-store scan has never run."}, "count": {"type": "integer", "description": "Records the figure rests on -- those ever exploited. Reported for every period, because one publication year's exploited records can be a dozen."}, "mean_days": {"type": "number", "description": "Mean days from publication to first listing, one decimal."}, "median_days": {"type": "number", "description": "Median days, reported alongside the mean."}, "p90_days": {"type": "number", "description": "90th percentile, nearest rank."}, "min_days": {"type": "number", "description": "Shortest observed interval."}, "max_days": {"type": "number", "description": "Longest observed interval."}, "exploited_before_publication": {"type": "integer", "description": "Of count, how many were listed before the record was published."}, "before_publication_mean_days": {"type": "number", "description": "Mean of the intervals of the records listed before publication (a negative number); absent when there are none."}, "scope_catalogs": {"type": "object", "description": "The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form."}, "scoped": {"type": "boolean", "description": "True when the figure was measured over the catalogues configured for this source (STATS_KEV_CATALOGS), which `scope_catalogs` then names. False when it covers every catalogue the instance knows."}, "granularity": {"type": "string", "description": "year with the per-year series."}, "records_outside_year_range": {"type": "integer", "description": "With a granularity, records whose publication year falls outside the years the series is drawn over: `years` sums to `count` minus this."}, "years": {"type": "object", "description": "With granularity=year: publication year -> the same summary (count, mean_days, median_days, p90_days, min_days, max_days, exploited_before_publication, before_publication_mean_days), over every year the source spans; a year whose records were never exploited is {count: 0}."}, "entries_scanned": {"type": "integer", "description": "Known-exploited catalogue entries the scan read."}, "cves_exploited": {"type": "integer", "description": "Distinct CVEs those entries named -- the denominator of the two unmatched counts."}, "unmatched_no_record": {"type": "integer", "description": "Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains."}, "unmatched_no_publication_date": {"type": "integer", "description": "Exploited records carrying no publication date, so they could not be dated."}, "computed_at": {"type": "string", "description": "When the snapshot was taken."}}, "type": "object"}, "EUVDStatsAssignerRank": {"properties": {"assigner": {"type": "string", "description": "CNA short name, as the CVE records it."}, "count": {"type": "number", "description": "Records assigned."}}, "type": "object"}, "EUVDStatsVendorRank": {"properties": {"vendor": {"type": "string", "description": "Vendor name, as the CVE records it."}, "count": {"type": "number", "description": "Records affecting the vendor."}}, "type": "object"}}, "responses": {"ParseError": {"description": "When a mask can't be parsed"}, "MaskError": {"description": "When any error occurs on mask"}}}