API#

Vulnerability-Lookup exposes a REST API under the /api path of every instance. The same instance also serves an interactive Swagger UI at /api/, where you can browse the endpoints and try them out live. PyVulnerabilityLookup is the official Python client for the API.

Note

Building a mirror, scanner, or other automated consumer? Read Access patterns for automated consumers first — it covers the canonical sync path (since= + the pub/sub stream), identification expectations, and the rate-limit posture. The same guidance is exposed in machine-readable form at /.well-known/api-policy.json.

Quick start#

The examples below use the public CIRCL instance (https://vulnerability.circl.lu); replace the host with your own. Responses are JSON.

Look up a vulnerability by ID:

$ curl 'https://vulnerability.circl.lu/api/vulnerability/CVE-2024-38063'

GCVE-0 is the CVE namespace, so a GCVE-0 identifier is accepted wherever a CVE identifier is and served as that CVE. The response names the CVE, not the identifier you asked for: GCVE-0-2024-38063 returns the record whose cveMetadata.cveId is CVE-2024-38063, with its comments, sightings and bundles under either spelling.

$ curl 'https://vulnerability.circl.lu/api/vulnerability/GCVE-0-2024-38063'

Filter comments by metadata — for example those flagged as a Proof of Concept. The meta parameter is a JSON value matched against the comment’s meta field (JSONB containment). Use -G/--data-urlencode so curl URL-encodes the JSON for you instead of escaping it by hand:

$ curl -G 'https://vulnerability.circl.lu/api/comment/' \
    --data-urlencode 'meta=[{"tags":["vulnerability:information=PoC"]}]'

Tags are matched exactly, so use the full machine-tag value (for example vulnerability:information=PoC, not just PoC).

Paginate any list endpoint with page and per_page (see Response format for the envelope):

$ curl 'https://vulnerability.circl.lu/api/sighting/?vuln_id=CVE-2024-38063&per_page=50'

For the full list of endpoints, parameters, and response models, see the OpenAPI specification below.

Browsing VEX records#

Vulnerability-Lookup stores vendor VEX statements as enrichment metadata on existing vulnerability records. In the web UI, open VEX from the top menu to browse available VEX records and pivot to the related vulnerability. API clients can use the VEX browse endpoint:

$ curl 'https://vulnerability.circl.lu/api/vex/?per_page=20'

The response is paginated and each record includes vulnerability_id and vulnerability_url (instance-relative, resolve it against the host you queried), so clients can pivot from the VEX record to the related CVE/vulnerability page. You can restrict the browse view to one metadata source (redhat_vex or microsoft_vex; unknown sources are rejected with a 400) or filter with q, a case-insensitive substring match on the vulnerability id, document title, or source name:

$ curl 'https://vulnerability.circl.lu/api/vex/?source=redhat_vex&q=CVE-2024'

Use /api/vex/{vuln_id} to retrieve the VEX statements attached to one vulnerability, and /api/vex/{vuln_id}/{source}/csaf to retrieve the stored CSAF document for that source.

Local exploit hazard#

The POST /api/exploit-hazard endpoint computes a user-parameterized local exploit hazard for one vulnerability instance. It accepts a vulnerability_id to load local EPSS/CVSS metadata when available, or an explicit ELM probability such as EPSS (epss), plus optional control effectiveness values (controls or controls_by_attack_vector), optional KEV policy parameters (kev, kev_weight, kev_floor), and either an exponential or weibull hazard model. When model is weibull, provide published or age_days; the default shape parameter is 0.605, as calibrated in the referenced local exploit hazard paper.

$ curl -X POST 'https://vulnerability.circl.lu/api/exploit-hazard' \
    -H 'Content-Type: application/json' \
    -d '{
      "epss": 0.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "controls_by_attack_vector": {"network": [0.5]},
      "model": "weibull",
      "published": "2026-07-01",
      "horizon_days": 7
    }'

The response includes the residual adjusted_likelihood, an instantaneous daily_hazard, and the requested-window horizon_probability.

Notes on the parameters:

The KEV policy follows section 3.3 of the paper: kev_weight and kev_floor modify the ELM likelihood before control effectiveness is applied, and only when kev is true. kev_floor is therefore not a floor on the final result — stacked controls can still reduce the outcome below it. The paper includes this mechanism as a compliance affordance (a KEV listing is an observed exploitation, not a higher forecast), not as a statistical correction.
weibull_shape accepts values between 0.1 and 5.0; the paper’s calibration is 0.605 with a recommended sensitivity range of 0.5–0.7.
age_days, horizon_days, and elm_horizon_days are bounded at 36600 (about 100 years); elm_horizon_days must be at least 1. controls arrays accept at most 256 values.

Invalid parameters return HTTP 400 with a descriptive message; HTTP 503 is returned when the storage backend cannot be reached to resolve a vulnerability_id.

POST /api/exploit-hazard/batch aggregates a whole set of instances at once (section 3.6 of the paper): the response carries each instance’s result in order, the aggregate daily hazard (the sum of the per-instance hazards, H_agg), the expected number of exploitation events over the horizon, and the Poisson probability of at least one event. instances accepts the same objects as the single endpoint — or plain vulnerability-id strings as shorthand for {"vulnerability_id": ...} — up to 256 per request, and one horizon_days is forced on every instance so the per-item probabilities are comparable. An optional parameters object applies the same per-subscription parameter set the notification form accepts (controls, controls_by_attack_vector, kev_weight, kev_floor, weibull_shape) to every instance, with an instance’s own values winning on overlap. An instance that fails validation is reported in its result slot as {"error": ...} and excluded from the aggregate instead of failing the batch; slots resolved from a vulnerability_id echo it back.

$ curl -X POST 'https://vulnerability.circl.lu/api/exploit-hazard/batch' \
    -H 'Content-Type: application/json' \
    -d '{
      "instances": ["CVE-2025-53770", {"epss": 0.2, "model": "weibull", "age_days": 40}],
      "parameters": {"controls_by_attack_vector": {"network": [0.5]}},
      "horizon_days": 7
    }'

The paper’s caveat applies to the aggregate: correlated vulnerabilities (for example many in the same product) make it an upper-bound trend indicator rather than a calibrated event count.

The same model enriches vulnerability notifications: email and webhook reports order vulnerabilities by their individual hazard, annotate each with its EPSS score, age, and horizon exploitation probability, and carry the batch aggregate (expected exploitation events per day and the probability of at least one event, per section 3.6 of the paper). Webhook payload templates can reference the aggregate through the {hazard_events_per_day} and {hazard_probability} placeholders. Each notification subscription can localize its estimates with stored hazard parameters (control effectiveness values, per-attack-vector controls, KEV policy, Weibull shape) configured on the notification form; vulnerabilities present in the local KEV catalog activate the subscription’s KEV policy automatically. Without stored parameters, reports carry the global (uncontrolled) estimate.

Beyond the per-report delta, the notification daemon evaluates each subscription’s standing exposure once a day: the aggregate hazard of the entire current vulnerability set the subscription watches (the paper’s exposed-set aggregate H_agg, section 3.6), localized with the same stored parameters. Reports include the standing figure, and a subscriber can set an exposure alert threshold (expected exploitation events per day) on the notification form: when the daily evaluation crosses it upward, an alert is sent on the subscription’s delivery channels, listing the top hazard contributors — the removals that lower the exposure most, mirroring the paper’s remediation ranking (section 3.7). The alert then stays silent until the exposure falls back below 90% of the threshold. The evaluation is engineered to be cheap at scale: EPSS scores are read fresh from storage in pipelined batches, record-derived inputs (CVSS vector, publication date) are cached for a week with a bounded refill per run, and subscriptions watching the same vendor/product with the same parameters share one computation.

Statistics#

The /api/stats/* endpoints report per-source figures about a whole corpus: records per period, the lifecycle split, the CVSS version and severity distributions, known-exploited inclusion, time to exploit, and the assigner and vendor leaderboards. They are read from figures prepared in advance rather than computed per request. Statistics explains what each one means, how to read available: false, and which pass prepares it.

Response format#

All list endpoints return a paginated response with the following structure:

{
    "metadata": {
        "count": 42,
        "page": 1,
        "per_page": 10
    },
    "data": []
}

OpenAPI specification#

The complete reference below is generated from the API’s OpenAPI (Swagger) specification — the same spec that powers the interactive Swagger UI at /api/.

GET /banner#

Read the site notice

Status Codes:

200 OK – Success.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

enabled (boolean) – Whether a maintenance notice should be displayed.
message (string) – The notice to display, as the administrator wrote it. May contain Markdown emphasis and links; it is never HTML.

PUT /banner#

Set the site notice

Only available to administrators.

Guarded by admin:access rather than a notice-specific permission, and that is deliberate. A new permission is created by the RBAC seed but not added to any existing role – roles keep their configured permission sets unless the seed is run with reset, which would discard an instance’s customisations. The endpoint would then be callable by nobody on precisely the instances that have been running longest, and would be found out during the incident someone was trying to announce.

Request JSON Object:

enabled (boolean) – Whether a maintenance notice should be displayed. (required)
message (string) – The notice to display (at most 2000 characters). Stored and returned verbatim; this instance’s own pages render a small Markdown subset of it – emphasis, code, lists and links – and strip everything else.

Status Codes:

200 OK – Success.
400 Bad Request – Invalid banner.
401 Unauthorized – Authentication required.
403 Forbidden – Admin permission required.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

enabled (boolean) – Whether a maintenance notice should be displayed.
message (string) – The notice to display, as the administrator wrote it. May contain Markdown emphasis and links; it is never HTML.

GET /browse/#

Get the known vendors

Deprecated: use GET /api/browse/vendors instead. Get the known vendors. Deprecated in favor of /api/browse/vendors.

Status Codes:

200 OK – Success

GET /browse/vendors#

Get the known vendors with their last vulnerability change date

Get the known vendors with the date of their most recent vulnerability change, most recently changed first. Vendors without a known last change date are listed last with a null last_change.

Query Parameters:

q (string) – Case-insensitive substring filter on the name.
since (string) – Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded.
page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return (capped at 1000).

Status Codes:

200 OK – Success

GET /browse/vendors/{vendor}/products#

Get the products of a vendor with their last vulnerability change date

Get the known products of a vendor with the date of their most recent vulnerability change, most recently changed first. Products without a known last change date are listed last with a null last_change.

Parameters:

vendor (string)

Query Parameters:

q (string) – Case-insensitive substring filter on the name.
since (string) – Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded.
page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return (capped at 1000).

Status Codes:

200 OK – Success

GET /browse/{vendor}#

Get the known products for a vendor

Deprecated: use GET /api/browse/vendors/<vendor>/products instead. Get the known products for a vendor. Deprecated in favor of /api/browse/vendors/<vendor>/products.

Parameters:

vendor (string)

Status Codes:

200 OK – Success

DELETE /bundle/#

Delete bundles by vulnerability_lookup_origin

Delete bundles by vulnerability_lookup_origin (admin only).

Query Parameters:

vulnerability_lookup_origin (string) – Delete bundles from this origin instance UUID.

Status Codes:

200 OK – Deleted bundles successfully.
400 Bad Request – Invalid UUID format.
403 Forbidden – Admin permission required.
404 Not Found – No bundles matched the filter.

GET /bundle/#

List all bundles

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
uuid (string) – UUID of the bundle.
author (string) – Author (login) of the bundle.
vuln_id (string) – Id of a vulnerability referenced by the bundle.
meta (string) – Query for the meta JSON field. Example: meta=[{‘tags’: [‘tcp’]}]
date_from (string) – The date of the bundles must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the bundles must be smaller or equal than this value. Format: YYYY-MM-DD

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].creation_timestamp (string) – Creation time of the bundle. (read only)
[].data[].description (string) – Description.
[].data[].meta (object) – Zero or more meta-fields.
[].data[].name (string) – Bundle name.
[].data[].related_vulnerabilities[] (string)
[].data[].timestamp (string) – Updated time of the bundle. (read only)
[].data[].uuid (string) – Bundle id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

POST /bundle/#

Create a bundle.

Request JSON Object:

author (any) – (read only)
creation_timestamp (string) – Creation time of the bundle. (read only)
description (string) – Description.
meta (object) – Zero or more meta-fields.
name (string) – Bundle name.
related_vulnerabilities[] (string)
timestamp (string) – Updated time of the bundle. (read only)
uuid (string) – Bundle id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

Status Codes:

201 Created – Success.
400 Bad Request – JSON validation failed or incorrect payload to instantiate a bundle.
403 Forbidden – Administrator permission required.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].creation_timestamp (string) – Creation time of the bundle. (read only)
[].data[].description (string) – Description.
[].data[].meta (object) – Zero or more meta-fields.
[].data[].name (string) – Bundle name.
[].data[].related_vulnerabilities[] (string)
[].data[].timestamp (string) – Updated time of the bundle. (read only)
[].data[].uuid (string) – Bundle id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

DELETE /bundle/{bundle_uuid}#

Endpoint for deleting a bundle

Delete a bundle. Only an admin can delete a bundle.

Parameters:

bundle_uuid (string)

Status Codes:

204 No Content – Success.
403 Forbidden – Administrator permission required or not the author of the bundle.
404 Not Found – Bundle not found.

GET /bundle/{bundle_uuid}#

Get a bundle with its UUID.

Parameters:

bundle_uuid (string)

Status Codes:

200 OK – Success.
404 Not Found – Bundle not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

author (any) – (read only)
creation_timestamp (string) – Creation time of the bundle. (read only)
description (string) – Description.
meta (object) – Zero or more meta-fields.
name (string) – Bundle name.
related_vulnerabilities[] (string)
timestamp (string) – Updated time of the bundle. (read only)
uuid (string) – Bundle id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

GET /capec/#

List all CAPECs

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].@Description (string) – Description. (read only)
[].data[].@ID (string) – Identifiant. (read only)
[].data[].@Name (string) – Name. (read only)
[].metadata (any) – Metadata related to the result.

GET /capec/{capec_id}#

Get detailed information about a CAPEC

Get detailed information about a CAPEC.

Parameters:

capec_id (string)

Status Codes:

200 OK – Success

GET /cna/cve#

Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)

Query Parameters:

time_modified.lt (string) – Most recent CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)
time_modified.gt (string) – Earliest CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)
state (string) – Filter by state
assigner_short_name (string) – Filter by assignerShortName
assigner (string) – Filter by assigner org UUID
page (integer) – The current page in the paginator
adp_short_name (string) – Filter by ADP short name
count_only (boolean) – Get count of records that match query
cna_modified (boolean) – Only get CVE records with cnaContainers modified/created within the time_modified range

Status Codes:

200 OK – A filtered list of CVE Records, along with pagination fields if results span multiple pages of data
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

GET /cna/cve-id#

Retrieves information about CVE IDs after applying the query parameters as filters (accessible to all registered users)

Query Parameters:

state (string) – Filter by state
cve_id_year (string) – Filter by the year of the CVE IDs
time_reserved.lt (string) – Most recent reserved timestamp to retrieve
time_reserved.gt (string) – Earliest CVE ID reserved timestamp to retrieve
time_modified.lt (string) – Most recent modified timestamp to retrieve
time_modified.gt (string) – Earliest CVE ID modified timestamp to retrieve
page (integer) – The current page in the paginator
sort_by (string) – Sort field (default: modified)
sort_dir (string) – Sort direction (default: desc)
search (string) – Substring filter on vuln_id (case-insensitive)

Status Codes:

200 OK – Filtered CVE IDs
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

currentPage (integer) – Current page
cve_ids[].cve_id (string) – ^CVE-[0-9]{4}-[0-9]{4,}$
cve_ids[].cve_year (string) – ^[0-9]{4}$
cve_ids[].owning_cna (string) – The shortname for the organization that owns the CVE ID
cve_ids[].requested_by.cna (string) – The shortname for the organization of the user that requested the ID
cve_ids[].requested_by.user (string) – The username for the account that requested the ID
cve_ids[].reserved (string) – The time the ID was reserved
cve_ids[].state (string)
cve_ids[].time.created (string) – The time the ID was created
cve_ids[].time.modified (string) – The last time the ID was modified
itemsPerPage (integer) – Number of CVE records in a page
nextPage (integer) – Next page
pageCount (integer) – Total number of pages
prevPage (integer) – Previous page
totalCount (integer) – Total CVE records found

POST /cna/cve-id#

Reserves CVE IDs for the organization provided in the short_name query parameter (accessible to CNAs and Secretariat)

Query Parameters:

amount (integer) – Quantity of CVE IDs to reserve
batch_type (string) – Required when amount is greater than one
cve_year (integer) – The year the CVE IDs will be reserved for
short_name (string) – The CNA that will own the reserved CVE IDs

Status Codes:

200 OK – Reseved CVE IDs
206 Partial Content – Partially Reserved CVE IDs
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

cve_ids[] (any)
meta.remaining_quota (integer)
cve_ids[]
details.amount_reserved (integer) – The quantity of IDs reserved in the system
error (string)
message (string)

POST /cna/cve-id-range/{year}#

Creates a CVE-ID-Range for the specified year (accessible to Secretariat)

Parameters:

year (integer)

Status Codes:

200 OK – The CVE-ID-Range was created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

GET /cna/cve-id/{id}#

Retrieves information about the specified CVE ID (accessible to all users)

Parameters:

id (string)

Status Codes:

200 OK – The requested CVE ID information is returned
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
429 Too Many Requests – Too Many Requests
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response Headers:

RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.

Response JSON Object:

cve_id (string) – ^CVE-[0-9]{4}-[0-9]{4,}$
cve_year (string) – ^[0-9]{4}$
message (string)
owning_cna (string) – The shortname for the organization that owns the CVE ID
requested_by.cna (string) – The shortname for the organization of the user that requested the ID
requested_by.user (string) – The username for the account that requested the ID
reserved (string) – The time the ID was reserved
state (string)
time.created (string) – The time the ID was created
time.modified (string) – The last time the ID was modified

PUT /cna/cve-id/{id}#

Updates information related to the specified CVE ID (accessible to CNAs and Secretariat)

Parameters:

id (string)

Query Parameters:

org (string) – The shortname of the new owning_cna for the CVE ID
state (string) – The id of the CVE ID to update

Status Codes:

200 OK – The requested CVE ID information is returned
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

message (string)
updated.cve_id (string) – ^CVE-[0-9]{4}-[0-9]{4,}$
updated.cve_year (string) – ^[0-9]{4}$
updated.owning_cna (string) – The shortname for the organization that owns the CVE ID
updated.requested_by.cna (string) – The shortname for the organization of the user that requested the ID
updated.requested_by.user (string) – The username for the account that requested the ID
updated.reserved (string) – The time the ID was reserved
updated.state (string)
updated.time.created (string) – The time the ID was created
updated.time.modified (string) – The last time the ID was modified

DELETE /cna/cve/{id}#

Parameters:

id (string)

Status Codes:

400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

GET /cna/cve/{id}#

Returns a CVE Record by CVE ID (accessible to all users)

Parameters:

id (string)

Status Codes:

200 OK – The requested CVE Record
400 Bad Request – Bad Request
403 Forbidden – Forbidden
404 Not Found – Not Found
429 Too Many Requests – Too Many Requests
500 Internal Server Error – Internal Server Error

Response Headers:

RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.
RateLimit-Limit – Indicates the service limit associated with the client in the current time window.
RateLimit-Policy – Indicates a service policy currently associated with the client.
RateLimit-Remaining – Indicates the remaining quota units associated with the expiring-limit.
RateLimit-Reset – Indicates the number of seconds until the quota resets.

POST /cna/cve/{id}#

Creates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat

)

Parameters:

id (string)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

created.containers.cna.affected.product (string)
created.containers.cna.affected.vendor (string)
created.containers.cna.affected.versions[].status (string)
created.containers.cna.affected.versions[].version (string)
created.containers.cna.descriptions[].lang (string)
created.containers.cna.descriptions[].value (string)
created.containers.cna.problemTypes[].descriptions[].description (string)
created.containers.cna.problemTypes[].descriptions[].lang (string)
created.containers.cna.problemTypes[].descriptions[].type (string)
created.containers.cna.providerMetadata.dateUpdated (string)
created.containers.cna.providerMetadata.orgId (string)
created.containers.cna.providerMetadata.shortName (string)
created.containers.cna.references[].name (string)
created.containers.cna.references[].tags[] (string)
created.containers.cna.references[].url (string)
created.cveMetadata.assignerOrgId (string)
created.cveMetadata.assignerShortName (string)
created.cveMetadata.cveId (string)
created.cveMetadata.datePublished (string)
created.cveMetadata.dateReserved (string)
created.cveMetadata.requesterUserId (string)
created.cveMetadata.state (string)
created.dataType (string)
created.dataVersion (string)
message (string)

PUT /cna/cve/{id}#

Updates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat

)

Parameters:

id (string)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

PUT /cna/cve/{id}/adp#

Inserts or replaces the ADP container for the caller org on an existing CVE Record

Parameters:

id (string)

Request JSON Object:

adpContainer.affected[].collectionURL (string)
adpContainer.affected[].cpes[] (string)
adpContainer.affected[].defaultStatus (string)
adpContainer.affected[].modules[] (string)
adpContainer.affected[].packageName (string)
adpContainer.affected[].platforms[] (string)
adpContainer.affected[].product (string)
adpContainer.affected[].programFiles[] (string)
adpContainer.affected[].programRoutines[].name (string) – (required)
adpContainer.affected[].repo (string)
adpContainer.affected[].vendor (string)
adpContainer.affected[].versions[].changes[].at (string) – (required)
adpContainer.affected[].versions[].changes[].status (string) – (required)
adpContainer.affected[].versions[].lessThan (string)
adpContainer.affected[].versions[].lessThanOrEqual (string)
adpContainer.affected[].versions[].status (string)
adpContainer.affected[].versions[].version (string)
adpContainer.affected[].versions[].versionType (string)
adpContainer.configurations[].lang (string) – (required)
adpContainer.configurations[].supportingMedia[].base64 (boolean)
adpContainer.configurations[].supportingMedia[].type (string) – (required)
adpContainer.configurations[].supportingMedia[].value (string) – (required)
adpContainer.configurations[].value (string) – (required)
adpContainer.credits[].lang (string) – (required)
adpContainer.credits[].type (string)
adpContainer.credits[].user (string)
adpContainer.credits[].value (string) – (required)
adpContainer.datePublic (string)
adpContainer.descriptions[].lang (string) – (required)
adpContainer.descriptions[].supportingMedia[].base64 (boolean)
adpContainer.descriptions[].supportingMedia[].type (string) – (required)
adpContainer.descriptions[].supportingMedia[].value (string) – (required)
adpContainer.descriptions[].value (string) – (required)
adpContainer.exploits[].lang (string) – (required)
adpContainer.exploits[].supportingMedia[].base64 (boolean)
adpContainer.exploits[].supportingMedia[].type (string) – (required)
adpContainer.exploits[].supportingMedia[].value (string) – (required)
adpContainer.exploits[].value (string) – (required)
adpContainer.impacts[].capecId (string)
adpContainer.impacts[].descriptions[].lang (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].base64 (boolean)
adpContainer.impacts[].descriptions[].supportingMedia[].type (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].value (string) – (required)
adpContainer.impacts[].descriptions[].value (string) – (required)
adpContainer.metrics[].cvssV2_0.accessComplexity (string)
adpContainer.metrics[].cvssV2_0.accessVector (string)
adpContainer.metrics[].cvssV2_0.authentication (string)
adpContainer.metrics[].cvssV2_0.availabilityImpact (string)
adpContainer.metrics[].cvssV2_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV2_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV2_0.collateralDamagePotential (string)
adpContainer.metrics[].cvssV2_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV2_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV2_0.environmentalScore (number)
adpContainer.metrics[].cvssV2_0.exploitability (string)
adpContainer.metrics[].cvssV2_0.integrityImpact (string)
adpContainer.metrics[].cvssV2_0.integrityRequirement (string)
adpContainer.metrics[].cvssV2_0.remediationLevel (string)
adpContainer.metrics[].cvssV2_0.reportConfidence (string)
adpContainer.metrics[].cvssV2_0.targetDistribution (string)
adpContainer.metrics[].cvssV2_0.temporalScore (number)
adpContainer.metrics[].cvssV2_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV2_0.version (string) – (required)
adpContainer.metrics[].cvssV3_0.attackComplexity (string)
adpContainer.metrics[].cvssV3_0.attackVector (string)
adpContainer.metrics[].cvssV3_0.availabilityImpact (string)
adpContainer.metrics[].cvssV3_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_0.environmentalScore (number)
adpContainer.metrics[].cvssV3_0.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_0.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_0.integrityImpact (string)
adpContainer.metrics[].cvssV3_0.integrityRequirement (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_0.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_0.modifiedScope (string)
adpContainer.metrics[].cvssV3_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_0.privilegesRequired (string)
adpContainer.metrics[].cvssV3_0.remediationLevel (string)
adpContainer.metrics[].cvssV3_0.reportConfidence (string)
adpContainer.metrics[].cvssV3_0.scope (string)
adpContainer.metrics[].cvssV3_0.temporalScore (number)
adpContainer.metrics[].cvssV3_0.temporalSeverity (string)
adpContainer.metrics[].cvssV3_0.userInteraction (string)
adpContainer.metrics[].cvssV3_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_0.version (string) – (required)
adpContainer.metrics[].cvssV3_1.attackComplexity (string)
adpContainer.metrics[].cvssV3_1.attackVector (string)
adpContainer.metrics[].cvssV3_1.availabilityImpact (string)
adpContainer.metrics[].cvssV3_1.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_1.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_1.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_1.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_1.environmentalScore (number)
adpContainer.metrics[].cvssV3_1.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_1.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_1.integrityImpact (string)
adpContainer.metrics[].cvssV3_1.integrityRequirement (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_1.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_1.modifiedScope (string)
adpContainer.metrics[].cvssV3_1.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_1.privilegesRequired (string)
adpContainer.metrics[].cvssV3_1.remediationLevel (string)
adpContainer.metrics[].cvssV3_1.reportConfidence (string)
adpContainer.metrics[].cvssV3_1.scope (string)
adpContainer.metrics[].cvssV3_1.temporalScore (number)
adpContainer.metrics[].cvssV3_1.temporalSeverity (string)
adpContainer.metrics[].cvssV3_1.userInteraction (string)
adpContainer.metrics[].cvssV3_1.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_1.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.Automatable (string)
adpContainer.metrics[].cvssV4_0.Recovery (string)
adpContainer.metrics[].cvssV4_0.Safety (string)
adpContainer.metrics[].cvssV4_0.attackComplexity (string)
adpContainer.metrics[].cvssV4_0.attackRequirements (string)
adpContainer.metrics[].cvssV4_0.attackVector (string)
adpContainer.metrics[].cvssV4_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV4_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV4_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV4_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV4_0.exploitMaturity (string)
adpContainer.metrics[].cvssV4_0.integrityRequirement (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackRequirements (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV4_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV4_0.modifiedSubAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.privilegesRequired (string)
adpContainer.metrics[].cvssV4_0.providerUrgency (string)
adpContainer.metrics[].cvssV4_0.subAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.subConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.subIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.userInteraction (string)
adpContainer.metrics[].cvssV4_0.valueDensity (string)
adpContainer.metrics[].cvssV4_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV4_0.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.vulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnerabilityResponseEffort (string)
adpContainer.metrics[].format (string)
adpContainer.metrics[].other.content (object) – (required)
adpContainer.metrics[].other.type (string) – (required)
adpContainer.metrics[].scenarios[].lang (string) – (required)
adpContainer.metrics[].scenarios[].value (string) – (required)
adpContainer.problemTypes[].descriptions[].cweId (string)
adpContainer.problemTypes[].descriptions[].description (string) – (required)
adpContainer.problemTypes[].descriptions[].lang (string) – (required)
adpContainer.problemTypes[].descriptions[].references[].name (string)
adpContainer.problemTypes[].descriptions[].references[].tags[] (any)
adpContainer.problemTypes[].descriptions[].references[].url (string) – (required)
adpContainer.problemTypes[].descriptions[].type (string)
adpContainer.providerMetadata.dateUpdated (string)
adpContainer.providerMetadata.orgId (string) – (required)
adpContainer.providerMetadata.shortName (string)
adpContainer.references[].name (string)
adpContainer.references[].tags[] (any)
adpContainer.references[].url (string) – (required)
adpContainer.solutions[].lang (string) – (required)
adpContainer.solutions[].supportingMedia[].base64 (boolean)
adpContainer.solutions[].supportingMedia[].type (string) – (required)
adpContainer.solutions[].supportingMedia[].value (string) – (required)
adpContainer.solutions[].value (string) – (required)
adpContainer.source (object)
adpContainer.tags[] (any)
adpContainer.taxonomyMappings[].taxonomyName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipValue (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].taxonomyId (string) – (required)
adpContainer.taxonomyMappings[].taxonomyVersion (string)
adpContainer.timeline[].lang (string) – (required)
adpContainer.timeline[].time (string) – (required)
adpContainer.timeline[].value (string) – (required)
adpContainer.title (string)
adpContainer.workarounds[].lang (string) – (required)
adpContainer.workarounds[].supportingMedia[].base64 (boolean)
adpContainer.workarounds[].supportingMedia[].type (string) – (required)
adpContainer.workarounds[].supportingMedia[].value (string) – (required)
adpContainer.workarounds[].value (string) – (required)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

POST /cna/cve/{id}/cna#

Creates a CVE Record from CNA Container JSON for the specified ID (accessible to CNAs and Secretariat)

Parameters:

id (string)

Query Parameters:

erlcheck (boolean) – Enable ERL check

Request JSON Object:

adpContainer.affected[].collectionURL (string)
adpContainer.affected[].cpes[] (string)
adpContainer.affected[].defaultStatus (string)
adpContainer.affected[].modules[] (string)
adpContainer.affected[].packageName (string)
adpContainer.affected[].platforms[] (string)
adpContainer.affected[].product (string)
adpContainer.affected[].programFiles[] (string)
adpContainer.affected[].programRoutines[].name (string) – (required)
adpContainer.affected[].repo (string)
adpContainer.affected[].vendor (string)
adpContainer.affected[].versions[].changes[].at (string) – (required)
adpContainer.affected[].versions[].changes[].status (string) – (required)
adpContainer.affected[].versions[].lessThan (string)
adpContainer.affected[].versions[].lessThanOrEqual (string)
adpContainer.affected[].versions[].status (string)
adpContainer.affected[].versions[].version (string)
adpContainer.affected[].versions[].versionType (string)
adpContainer.configurations[].lang (string) – (required)
adpContainer.configurations[].supportingMedia[].base64 (boolean)
adpContainer.configurations[].supportingMedia[].type (string) – (required)
adpContainer.configurations[].supportingMedia[].value (string) – (required)
adpContainer.configurations[].value (string) – (required)
adpContainer.credits[].lang (string) – (required)
adpContainer.credits[].type (string)
adpContainer.credits[].user (string)
adpContainer.credits[].value (string) – (required)
adpContainer.datePublic (string)
adpContainer.descriptions[].lang (string) – (required)
adpContainer.descriptions[].supportingMedia[].base64 (boolean)
adpContainer.descriptions[].supportingMedia[].type (string) – (required)
adpContainer.descriptions[].supportingMedia[].value (string) – (required)
adpContainer.descriptions[].value (string) – (required)
adpContainer.exploits[].lang (string) – (required)
adpContainer.exploits[].supportingMedia[].base64 (boolean)
adpContainer.exploits[].supportingMedia[].type (string) – (required)
adpContainer.exploits[].supportingMedia[].value (string) – (required)
adpContainer.exploits[].value (string) – (required)
adpContainer.impacts[].capecId (string)
adpContainer.impacts[].descriptions[].lang (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].base64 (boolean)
adpContainer.impacts[].descriptions[].supportingMedia[].type (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].value (string) – (required)
adpContainer.impacts[].descriptions[].value (string) – (required)
adpContainer.metrics[].cvssV2_0.accessComplexity (string)
adpContainer.metrics[].cvssV2_0.accessVector (string)
adpContainer.metrics[].cvssV2_0.authentication (string)
adpContainer.metrics[].cvssV2_0.availabilityImpact (string)
adpContainer.metrics[].cvssV2_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV2_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV2_0.collateralDamagePotential (string)
adpContainer.metrics[].cvssV2_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV2_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV2_0.environmentalScore (number)
adpContainer.metrics[].cvssV2_0.exploitability (string)
adpContainer.metrics[].cvssV2_0.integrityImpact (string)
adpContainer.metrics[].cvssV2_0.integrityRequirement (string)
adpContainer.metrics[].cvssV2_0.remediationLevel (string)
adpContainer.metrics[].cvssV2_0.reportConfidence (string)
adpContainer.metrics[].cvssV2_0.targetDistribution (string)
adpContainer.metrics[].cvssV2_0.temporalScore (number)
adpContainer.metrics[].cvssV2_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV2_0.version (string) – (required)
adpContainer.metrics[].cvssV3_0.attackComplexity (string)
adpContainer.metrics[].cvssV3_0.attackVector (string)
adpContainer.metrics[].cvssV3_0.availabilityImpact (string)
adpContainer.metrics[].cvssV3_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_0.environmentalScore (number)
adpContainer.metrics[].cvssV3_0.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_0.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_0.integrityImpact (string)
adpContainer.metrics[].cvssV3_0.integrityRequirement (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_0.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_0.modifiedScope (string)
adpContainer.metrics[].cvssV3_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_0.privilegesRequired (string)
adpContainer.metrics[].cvssV3_0.remediationLevel (string)
adpContainer.metrics[].cvssV3_0.reportConfidence (string)
adpContainer.metrics[].cvssV3_0.scope (string)
adpContainer.metrics[].cvssV3_0.temporalScore (number)
adpContainer.metrics[].cvssV3_0.temporalSeverity (string)
adpContainer.metrics[].cvssV3_0.userInteraction (string)
adpContainer.metrics[].cvssV3_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_0.version (string) – (required)
adpContainer.metrics[].cvssV3_1.attackComplexity (string)
adpContainer.metrics[].cvssV3_1.attackVector (string)
adpContainer.metrics[].cvssV3_1.availabilityImpact (string)
adpContainer.metrics[].cvssV3_1.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_1.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_1.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_1.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_1.environmentalScore (number)
adpContainer.metrics[].cvssV3_1.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_1.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_1.integrityImpact (string)
adpContainer.metrics[].cvssV3_1.integrityRequirement (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_1.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_1.modifiedScope (string)
adpContainer.metrics[].cvssV3_1.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_1.privilegesRequired (string)
adpContainer.metrics[].cvssV3_1.remediationLevel (string)
adpContainer.metrics[].cvssV3_1.reportConfidence (string)
adpContainer.metrics[].cvssV3_1.scope (string)
adpContainer.metrics[].cvssV3_1.temporalScore (number)
adpContainer.metrics[].cvssV3_1.temporalSeverity (string)
adpContainer.metrics[].cvssV3_1.userInteraction (string)
adpContainer.metrics[].cvssV3_1.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_1.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.Automatable (string)
adpContainer.metrics[].cvssV4_0.Recovery (string)
adpContainer.metrics[].cvssV4_0.Safety (string)
adpContainer.metrics[].cvssV4_0.attackComplexity (string)
adpContainer.metrics[].cvssV4_0.attackRequirements (string)
adpContainer.metrics[].cvssV4_0.attackVector (string)
adpContainer.metrics[].cvssV4_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV4_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV4_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV4_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV4_0.exploitMaturity (string)
adpContainer.metrics[].cvssV4_0.integrityRequirement (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackRequirements (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV4_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV4_0.modifiedSubAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.privilegesRequired (string)
adpContainer.metrics[].cvssV4_0.providerUrgency (string)
adpContainer.metrics[].cvssV4_0.subAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.subConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.subIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.userInteraction (string)
adpContainer.metrics[].cvssV4_0.valueDensity (string)
adpContainer.metrics[].cvssV4_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV4_0.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.vulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnerabilityResponseEffort (string)
adpContainer.metrics[].format (string)
adpContainer.metrics[].other.content (object) – (required)
adpContainer.metrics[].other.type (string) – (required)
adpContainer.metrics[].scenarios[].lang (string) – (required)
adpContainer.metrics[].scenarios[].value (string) – (required)
adpContainer.problemTypes[].descriptions[].cweId (string)
adpContainer.problemTypes[].descriptions[].description (string) – (required)
adpContainer.problemTypes[].descriptions[].lang (string) – (required)
adpContainer.problemTypes[].descriptions[].references[].name (string)
adpContainer.problemTypes[].descriptions[].references[].tags[] (any)
adpContainer.problemTypes[].descriptions[].references[].url (string) – (required)
adpContainer.problemTypes[].descriptions[].type (string)
adpContainer.providerMetadata.dateUpdated (string)
adpContainer.providerMetadata.orgId (string) – (required)
adpContainer.providerMetadata.shortName (string)
adpContainer.references[].name (string)
adpContainer.references[].tags[] (any)
adpContainer.references[].url (string) – (required)
adpContainer.solutions[].lang (string) – (required)
adpContainer.solutions[].supportingMedia[].base64 (boolean)
adpContainer.solutions[].supportingMedia[].type (string) – (required)
adpContainer.solutions[].supportingMedia[].value (string) – (required)
adpContainer.solutions[].value (string) – (required)
adpContainer.source (object)
adpContainer.tags[] (any)
adpContainer.taxonomyMappings[].taxonomyName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipValue (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].taxonomyId (string) – (required)
adpContainer.taxonomyMappings[].taxonomyVersion (string)
adpContainer.timeline[].lang (string) – (required)
adpContainer.timeline[].time (string) – (required)
adpContainer.timeline[].value (string) – (required)
adpContainer.title (string)
adpContainer.workarounds[].lang (string) – (required)
adpContainer.workarounds[].supportingMedia[].base64 (boolean)
adpContainer.workarounds[].supportingMedia[].type (string) – (required)
adpContainer.workarounds[].supportingMedia[].value (string) – (required)
adpContainer.workarounds[].value (string) – (required)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

PUT /cna/cve/{id}/cna#

Parameters:

id (string)

Query Parameters:

erlcheck (boolean) – Enable ERL check

Request JSON Object:

adpContainer.affected[].collectionURL (string)
adpContainer.affected[].cpes[] (string)
adpContainer.affected[].defaultStatus (string)
adpContainer.affected[].modules[] (string)
adpContainer.affected[].packageName (string)
adpContainer.affected[].platforms[] (string)
adpContainer.affected[].product (string)
adpContainer.affected[].programFiles[] (string)
adpContainer.affected[].programRoutines[].name (string) – (required)
adpContainer.affected[].repo (string)
adpContainer.affected[].vendor (string)
adpContainer.affected[].versions[].changes[].at (string) – (required)
adpContainer.affected[].versions[].changes[].status (string) – (required)
adpContainer.affected[].versions[].lessThan (string)
adpContainer.affected[].versions[].lessThanOrEqual (string)
adpContainer.affected[].versions[].status (string)
adpContainer.affected[].versions[].version (string)
adpContainer.affected[].versions[].versionType (string)
adpContainer.configurations[].lang (string) – (required)
adpContainer.configurations[].supportingMedia[].base64 (boolean)
adpContainer.configurations[].supportingMedia[].type (string) – (required)
adpContainer.configurations[].supportingMedia[].value (string) – (required)
adpContainer.configurations[].value (string) – (required)
adpContainer.credits[].lang (string) – (required)
adpContainer.credits[].type (string)
adpContainer.credits[].user (string)
adpContainer.credits[].value (string) – (required)
adpContainer.datePublic (string)
adpContainer.descriptions[].lang (string) – (required)
adpContainer.descriptions[].supportingMedia[].base64 (boolean)
adpContainer.descriptions[].supportingMedia[].type (string) – (required)
adpContainer.descriptions[].supportingMedia[].value (string) – (required)
adpContainer.descriptions[].value (string) – (required)
adpContainer.exploits[].lang (string) – (required)
adpContainer.exploits[].supportingMedia[].base64 (boolean)
adpContainer.exploits[].supportingMedia[].type (string) – (required)
adpContainer.exploits[].supportingMedia[].value (string) – (required)
adpContainer.exploits[].value (string) – (required)
adpContainer.impacts[].capecId (string)
adpContainer.impacts[].descriptions[].lang (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].base64 (boolean)
adpContainer.impacts[].descriptions[].supportingMedia[].type (string) – (required)
adpContainer.impacts[].descriptions[].supportingMedia[].value (string) – (required)
adpContainer.impacts[].descriptions[].value (string) – (required)
adpContainer.metrics[].cvssV2_0.accessComplexity (string)
adpContainer.metrics[].cvssV2_0.accessVector (string)
adpContainer.metrics[].cvssV2_0.authentication (string)
adpContainer.metrics[].cvssV2_0.availabilityImpact (string)
adpContainer.metrics[].cvssV2_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV2_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV2_0.collateralDamagePotential (string)
adpContainer.metrics[].cvssV2_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV2_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV2_0.environmentalScore (number)
adpContainer.metrics[].cvssV2_0.exploitability (string)
adpContainer.metrics[].cvssV2_0.integrityImpact (string)
adpContainer.metrics[].cvssV2_0.integrityRequirement (string)
adpContainer.metrics[].cvssV2_0.remediationLevel (string)
adpContainer.metrics[].cvssV2_0.reportConfidence (string)
adpContainer.metrics[].cvssV2_0.targetDistribution (string)
adpContainer.metrics[].cvssV2_0.temporalScore (number)
adpContainer.metrics[].cvssV2_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV2_0.version (string) – (required)
adpContainer.metrics[].cvssV3_0.attackComplexity (string)
adpContainer.metrics[].cvssV3_0.attackVector (string)
adpContainer.metrics[].cvssV3_0.availabilityImpact (string)
adpContainer.metrics[].cvssV3_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_0.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_0.environmentalScore (number)
adpContainer.metrics[].cvssV3_0.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_0.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_0.integrityImpact (string)
adpContainer.metrics[].cvssV3_0.integrityRequirement (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_0.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_0.modifiedScope (string)
adpContainer.metrics[].cvssV3_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_0.privilegesRequired (string)
adpContainer.metrics[].cvssV3_0.remediationLevel (string)
adpContainer.metrics[].cvssV3_0.reportConfidence (string)
adpContainer.metrics[].cvssV3_0.scope (string)
adpContainer.metrics[].cvssV3_0.temporalScore (number)
adpContainer.metrics[].cvssV3_0.temporalSeverity (string)
adpContainer.metrics[].cvssV3_0.userInteraction (string)
adpContainer.metrics[].cvssV3_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_0.version (string) – (required)
adpContainer.metrics[].cvssV3_1.attackComplexity (string)
adpContainer.metrics[].cvssV3_1.attackVector (string)
adpContainer.metrics[].cvssV3_1.availabilityImpact (string)
adpContainer.metrics[].cvssV3_1.availabilityRequirement (string)
adpContainer.metrics[].cvssV3_1.baseScore (number) – (required)
adpContainer.metrics[].cvssV3_1.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV3_1.confidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.confidentialityRequirement (string)
adpContainer.metrics[].cvssV3_1.environmentalScore (number)
adpContainer.metrics[].cvssV3_1.environmentalSeverity (string)
adpContainer.metrics[].cvssV3_1.exploitCodeMaturity (string)
adpContainer.metrics[].cvssV3_1.integrityImpact (string)
adpContainer.metrics[].cvssV3_1.integrityRequirement (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV3_1.modifiedAttackVector (string)
adpContainer.metrics[].cvssV3_1.modifiedAvailabilityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedConfidentialityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedIntegrityImpact (string)
adpContainer.metrics[].cvssV3_1.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV3_1.modifiedScope (string)
adpContainer.metrics[].cvssV3_1.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV3_1.privilegesRequired (string)
adpContainer.metrics[].cvssV3_1.remediationLevel (string)
adpContainer.metrics[].cvssV3_1.reportConfidence (string)
adpContainer.metrics[].cvssV3_1.scope (string)
adpContainer.metrics[].cvssV3_1.temporalScore (number)
adpContainer.metrics[].cvssV3_1.temporalSeverity (string)
adpContainer.metrics[].cvssV3_1.userInteraction (string)
adpContainer.metrics[].cvssV3_1.vectorString (string) – (required)
adpContainer.metrics[].cvssV3_1.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.Automatable (string)
adpContainer.metrics[].cvssV4_0.Recovery (string)
adpContainer.metrics[].cvssV4_0.Safety (string)
adpContainer.metrics[].cvssV4_0.attackComplexity (string)
adpContainer.metrics[].cvssV4_0.attackRequirements (string)
adpContainer.metrics[].cvssV4_0.attackVector (string)
adpContainer.metrics[].cvssV4_0.availabilityRequirement (string)
adpContainer.metrics[].cvssV4_0.baseScore (number) – (required)
adpContainer.metrics[].cvssV4_0.baseSeverity (string) – (required)
adpContainer.metrics[].cvssV4_0.confidentialityRequirement (string)
adpContainer.metrics[].cvssV4_0.exploitMaturity (string)
adpContainer.metrics[].cvssV4_0.integrityRequirement (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackComplexity (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackRequirements (string)
adpContainer.metrics[].cvssV4_0.modifiedAttackVector (string)
adpContainer.metrics[].cvssV4_0.modifiedPrivilegesRequired (string)
adpContainer.metrics[].cvssV4_0.modifiedSubAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedSubIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedUserInteraction (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.modifiedVulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.privilegesRequired (string)
adpContainer.metrics[].cvssV4_0.providerUrgency (string)
adpContainer.metrics[].cvssV4_0.subAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.subConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.subIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.userInteraction (string)
adpContainer.metrics[].cvssV4_0.valueDensity (string)
adpContainer.metrics[].cvssV4_0.vectorString (string) – (required)
adpContainer.metrics[].cvssV4_0.version (string) – CVSS Version (required)
adpContainer.metrics[].cvssV4_0.vulnAvailabilityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnConfidentialityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnIntegrityImpact (string)
adpContainer.metrics[].cvssV4_0.vulnerabilityResponseEffort (string)
adpContainer.metrics[].format (string)
adpContainer.metrics[].other.content (object) – (required)
adpContainer.metrics[].other.type (string) – (required)
adpContainer.metrics[].scenarios[].lang (string) – (required)
adpContainer.metrics[].scenarios[].value (string) – (required)
adpContainer.problemTypes[].descriptions[].cweId (string)
adpContainer.problemTypes[].descriptions[].description (string) – (required)
adpContainer.problemTypes[].descriptions[].lang (string) – (required)
adpContainer.problemTypes[].descriptions[].references[].name (string)
adpContainer.problemTypes[].descriptions[].references[].tags[] (any)
adpContainer.problemTypes[].descriptions[].references[].url (string) – (required)
adpContainer.problemTypes[].descriptions[].type (string)
adpContainer.providerMetadata.dateUpdated (string)
adpContainer.providerMetadata.orgId (string) – (required)
adpContainer.providerMetadata.shortName (string)
adpContainer.references[].name (string)
adpContainer.references[].tags[] (any)
adpContainer.references[].url (string) – (required)
adpContainer.solutions[].lang (string) – (required)
adpContainer.solutions[].supportingMedia[].base64 (boolean)
adpContainer.solutions[].supportingMedia[].type (string) – (required)
adpContainer.solutions[].supportingMedia[].value (string) – (required)
adpContainer.solutions[].value (string) – (required)
adpContainer.source (object)
adpContainer.tags[] (any)
adpContainer.taxonomyMappings[].taxonomyName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipName (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].relationshipValue (string) – (required)
adpContainer.taxonomyMappings[].taxonomyRelations[].taxonomyId (string) – (required)
adpContainer.taxonomyMappings[].taxonomyVersion (string)
adpContainer.timeline[].lang (string) – (required)
adpContainer.timeline[].time (string) – (required)
adpContainer.timeline[].value (string) – (required)
adpContainer.title (string)
adpContainer.workarounds[].lang (string) – (required)
adpContainer.workarounds[].supportingMedia[].base64 (boolean)
adpContainer.workarounds[].supportingMedia[].type (string) – (required)
adpContainer.workarounds[].supportingMedia[].value (string) – (required)
adpContainer.workarounds[].value (string) – (required)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

POST /cna/cve/{id}/reject#

Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)

Parameters:

id (string)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

PUT /cna/cve/{id}/reject#

Parameters:

id (string)

Status Codes:

200 OK – The CVE Record created
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Response JSON Object:

message (string)
updated.containers.cna.affected.product (string)
updated.containers.cna.affected.vendor (string)
updated.containers.cna.affected.versions[].status (string)
updated.containers.cna.affected.versions[].version (string)
updated.containers.cna.dataType (string)
updated.containers.cna.dataVersion (string)
updated.containers.cna.descriptions[].lang (string)
updated.containers.cna.descriptions[].value (string)
updated.containers.cna.problemTypes[].descriptions[].description (string)
updated.containers.cna.problemTypes[].descriptions[].lang (string)
updated.containers.cna.problemTypes[].descriptions[].type (string)
updated.containers.cna.providerMetadata.orgId (string)
updated.containers.cna.references[].name (string)
updated.containers.cna.references[].url (string)
updated.cveMetadata.assignerOrgId (string)
updated.cveMetadata.assignerShortName (string)
updated.cveMetadata.cveId (string)
updated.cveMetadata.datePublished (string)
updated.cveMetadata.dateReserved (string)
updated.cveMetadata.requesterUserId (string)
updated.cveMetadata.state (string)
updated.dataType (string)
updated.dataVersion (string)

GET /cna/cve_count#

Retrieves the count of all the CVE Records after applying the query parameters as filters (accessible to all users)

Query Parameters:

state (string) – Filter by state

Status Codes:

200 OK – A count of the total number of filtered CVE records
400 Bad Request – Bad Request
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Response JSON Object:

totalCount (integer)

GET /cna/cve_cursor#

Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)

Query Parameters:

time_modified.lt (string) – Most recent CVE record modified timestamp to retrieve
time_modified.gt (string) – Earliest CVE record modified timestamp to retrieve
state (string) – Filter by state
count_only (boolean) – Get count of records that match query
assigner_short_name (string) – Filter by assignerShortName
assigner (string) – Filter by assigner org UUID
cna_modified (boolean) – Only get CVE records with cnaContainers that have been modified/created within the set time_modified range
adp_short_name (string) – Only get CVE records that have an adpContainer owned by this org
next_page (string) – Key returned by a GET /cve_cursor call that must be used to get the next page of results in a subsequent call
previous_page (string) – Key returned by a GET /cve_cursor call that must be used to get the previous page of results in a subsequent call
limit (integer) – Maximum number of records to return

Status Codes:

200 OK – A filtered list of CVE Records, along with pagination fields if results span multiple pages of data
400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

GET /cna/health-check#

Check that the system is running

Checks that the system is running (accessible to all users)

Status Codes:

200 OK – Returns a 200 respose code

GET /cna/org#

Query Parameters:

page (integer) – The current page in the paginator

Status Codes:

400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

GET /cna/org/{identifier}#

Parameters:

identifier (string)

Status Codes:

400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

GET /cna/users#

Query Parameters:

page (integer) – The current page in the paginator

Status Codes:

400 Bad Request – Bad Request
401 Unauthorized – Not Authenticated
403 Forbidden – Forbidden
404 Not Found – Not Found
500 Internal Server Error – Internal Server Error

Request Headers:

CVE-API-ORG – Organization shortname is required
CVE-API-USER – Username is required
CVE-API-KEY – API key is required

GET /cna_credential/#

List the CNA credentials

Only available to administrators.

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.

Status Codes:

200 OK – Success.
403 Forbidden – Admin permission required.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].created_at (string) – Creation time of the credential. (read only)
[].data[].cve_api_org (string) – CVE Services API organization.
[].data[].cve_api_user (string) – CVE Services API user.
[].data[].enabled (boolean) – Whether CNA publication is allowed for the user bound to this credential.
[].data[].id (integer) – CNA credential id. (read only)
[].data[].login (string) – Login of the user bound to this credential. (read only)
[].data[].updated_at (string) – Last update time of the credential. (read only)
[].metadata (any) – Metadata related to the result.

GET /cna_credential/{credential_id}#

Get a CNA credential

Get a CNA credential. Only available to administrators. Only available to administrators.

Parameters:

credential_id (integer)

Status Codes:

200 OK – Success.
403 Forbidden – Admin permission required.
404 Not Found – CNA credential not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

created_at (string) – Creation time of the credential. (read only)
cve_api_org (string) – CVE Services API organization.
cve_api_user (string) – CVE Services API user.
enabled (boolean) – Whether CNA publication is allowed for the user bound to this credential.
id (integer) – CNA credential id. (read only)
login (string) – Login of the user bound to this credential. (read only)
updated_at (string) – Last update time of the credential. (read only)

PUT /cna_credential/{credential_id}#

Enable or disable CNA publication for the user bound to a credential

Enable or disable CNA publication for the user bound to a credential. Only available to administrators.

Parameters:

credential_id (integer)

Request JSON Object:

enabled (boolean) – Whether CNA publication is allowed for the user bound to this credential. (required)

Status Codes:

200 OK – Success.
403 Forbidden – Admin permission required.
404 Not Found – CNA credential not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

created_at (string) – Creation time of the credential. (read only)
cve_api_org (string) – CVE Services API organization.
cve_api_user (string) – CVE Services API user.
enabled (boolean) – Whether CNA publication is allowed for the user bound to this credential.
id (integer) – CNA credential id. (read only)
login (string) – Login of the user bound to this credential. (read only)
updated_at (string) – Last update time of the credential. (read only)

DELETE /comment/#

Delete comments by vulnerability_lookup_origin

Delete comments by vulnerability_lookup_origin (admin only).

Query Parameters:

vulnerability_lookup_origin (string) – Delete comments from this origin instance UUID.

Status Codes:

200 OK – Deleted comments successfully.
400 Bad Request – Invalid UUID format.
403 Forbidden – Admin permission required.
404 Not Found – No comments matched the filter.

GET /comment/#

List all comments

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
uuid (string) – UUID of the comment.
vuln_id (string) – Vulnerability related to the comment.
author (string) – Author of the comment.
meta (string) – Query for the meta JSON field. Tags are matched exactly. Example: meta=[{‘tags’: [‘vulnerability:information=PoC’]}]
date_from (string) – The date of the comments must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the comments must be smaller or equal than this value. Format: YYYY-MM-DD

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].creation_timestamp (string) – Creation time of the comment. (read only)
[].data[].description (string) – Description.
[].data[].description_format (string) – Description format (markdown or text).
[].data[].meta (object) – Zero or more meta-fields.
[].data[].related_vulnerabilities[] (string)
[].data[].timestamp (string) – Updated time of the comment. (read only)
[].data[].title (string) – Comment title.
[].data[].uuid (string) – Comment uuid.
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

POST /comment/#

Create a new comment or update an existing one

Create or update a comment related to a security advisory.

Request JSON Object:

author (any) – (read only)
creation_timestamp (string) – Creation time of the comment. (read only)
description (string) – Description.
description_format (string) – Description format (markdown or text).
meta (object) – Zero or more meta-fields.
related_vulnerabilities[] (string)
timestamp (string) – Updated time of the comment. (read only)
title (string) – Comment title.
uuid (string) – Comment uuid.
vulnerability (string) – Vulnerability id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

Status Codes:

201 Created – Comment created or updated.
400 Bad Request – Invalid comment payload or comment update failed.
403 Forbidden – Insufficient permission.
404 Not Found – Vulnerability not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].creation_timestamp (string) – Creation time of the comment. (read only)
[].data[].description (string) – Description.
[].data[].description_format (string) – Description format (markdown or text).
[].data[].meta (object) – Zero or more meta-fields.
[].data[].related_vulnerabilities[] (string)
[].data[].timestamp (string) – Updated time of the comment. (read only)
[].data[].title (string) – Comment title.
[].data[].uuid (string) – Comment uuid.
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

DELETE /comment/{comment_uuid}#

Delete a comment

Delete a comment.

Parameters:

comment_uuid (string)

Status Codes:

204 No Content – Success.
403 Forbidden – Commenter permission required or not the author of the comment.
404 Not Found – Comment not found.

GET /comment/{comment_uuid}#

Get a comment with its UUID.

Parameters:

comment_uuid (string)

Status Codes:

200 OK – Success.
404 Not Found – Comment not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

author (any) – (read only)
creation_timestamp (string) – Creation time of the comment. (read only)
description (string) – Description.
description_format (string) – Description format (markdown or text).
meta (object) – Zero or more meta-fields.
related_vulnerabilities[] (string)
timestamp (string) – Updated time of the comment. (read only)
title (string) – Comment title.
uuid (string) – Comment uuid.
vulnerability (string) – Vulnerability id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

GET /cpe_editor/status/{vulnerability_id}#

Get the CPE Editor catalog status for a vulnerability’s affected products

Check whether the CPEs referenced by a cvelistv5 vulnerability already exist in the CPE Editor catalog.

Parameters:

vulnerability_id (string)

Status Codes:

200 OK – Success

GET /cwe/#

List all CWEs

Query Parameters:

vuln_id (string) – ID of a vulnerability that references one or more CWE identifiers.
page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
exclude_discouraged (boolean) – Exclude CWEs whose Mapping_Notes Usage is Discouraged.
exclude_prohibited (boolean) – Exclude CWEs whose Mapping_Notes Usage is Prohibited.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].@Abstraction (string) – Abstraction of the CWE (required)
[].data[].@ID (string) – CWE ID (required)
[].data[].@Name (string) – Name of the CWE (required)
[].data[].@Status (string) – Status of the CWE (required)
[].data[].@Structure (string) – Structure of the CWE (required)
[].data[].Description (string) – Description of the CWE (required)
[].data[].Mapping_Notes (any) – Mapping notes
[].data[].Potential_Mitigations (any) – Potential mitigations
[].data[].Related_Weaknesses (any) – Related weaknesses
[].metadata (any) – Metadata related to the result.

GET /cwe/{cwe_id}#

Get detailed information about a CWE

Get detailed information about a CWE.

Parameters:

cwe_id (string)

Status Codes:

200 OK – Success

GET /emb3d/#

List all Adversarial Techniques from MITRE EMB3D

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
vuln_id (string) – Vulnerability identifier.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].CWE (object) – CWE (read only)
[].data[].Type (string) – Type (read only)
[].data[].description (string) – Description (read only)
[].data[].id (string) – Identifiant (read only)
[].metadata (any) – Metadata related to the result.

GET /emb3d/{emb3d_id}#

Get detailed information about a MITRE EMB3D Adversarial Technique

Get detailed information about a MITRE EMB3D Adversarial Technique.

Parameters:

emb3d_id (string)

Status Codes:

200 OK – Success

GET /epss/{vulnerability_id}#

Get the EPSS score of a vulnerability

Get the EPSS score of a vulnerability.

Parameters:

vulnerability_id (string)

Status Codes:

200 OK – Success.
404 Not Found – EPSS score not found.
502 Bad Gateway – Bad Gateway: Invalid response from EPSS service.
503 Service Unavailable – Service Unavailable: Unable to reach EPSS service or misconfigured.

GET /euvd/#

List EUVD entries, most recently updated first

Query Parameters:

limit (integer) – Maximum number of entries to return (1 to 100).
coordinated (boolean) – Only entries whose linked CVE was assigned by a coordinated (EU CSIRT) CNA.
cvss_min (string) – Only entries whose linked CVE has a CVSS base score strictly above this.
exploited (boolean) – Only entries whose linked CVE is listed in a KEV catalog.
with_products (boolean) – Include the affected-product rows (one per affected version).

Status Codes:

200 OK – Success
503 Service Unavailable – The exploited-vulnerability data is unavailable.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

data[].aliases[] (string)
data[].assigner (string) – CNA that assigned the linked CVE.
data[].cvss (any) – Highest-version CVSS metric of the linked CVE.
data[].date_published (string) – ISO-8601 publication timestamp.
data[].date_updated (string) – ISO-8601 last-update timestamp.
data[].description (string) – Description of the linked CVE.
data[].epss (number) – EPSS probability (0..1) of the linked CVE.
data[].exploited_since (string) – ISO-8601 timestamp of the earliest KEV listing.
data[].id (string) – EUVD identifier, e.g. EUVD-2026-0001.
data[].products[].name (string) – Product name, as the CNA wrote it.
data[].products[].vendor (string) – Vendor name, as the CNA wrote it.
data[].products[].version (string) – Affected version or version range.
data[].references[] (string)
data[].vendors[] (string)
metadata.count (integer) – Number of entries returned.
metadata.limit (integer) – Maximum that was requested.

GET /euvd/advisory/{identifier}#

One CSAF advisory, by its own tracking id

Parameters:

identifier (string) – The advisory’s tracking id, e.g. TEST-SA-2026-0001.

Query Parameters:

with_products (boolean) – Include the advisory’s affected-product rows.

Status Codes:

200 OK – Success.
404 Not Found – No advisory with this identifier.

Response JSON Object:

aliases[] (string)
date_published (string) – ISO-8601 initial release.
date_updated (string) – ISO-8601 current release.
euvds[].aliases[] (string)
euvds[].assigner (string) – CNA that assigned the linked CVE.
euvds[].cvss (any) – Highest-version CVSS metric of the linked CVE.
euvds[].date_published (string) – ISO-8601 publication timestamp.
euvds[].date_updated (string) – ISO-8601 last-update timestamp.
euvds[].description (string) – Description of the linked CVE.
euvds[].epss (number) – EPSS probability (0..1) of the linked CVE.
euvds[].exploited_since (string) – ISO-8601 timestamp of the earliest KEV listing.
euvds[].id (string) – EUVD identifier, e.g. EUVD-2026-0001.
euvds[].products[].name (string) – Product name, as the CNA wrote it.
euvds[].products[].vendor (string) – Vendor name, as the CNA wrote it.
euvds[].products[].version (string) – Affected version or version range.
euvds[].references[] (string)
euvds[].vendors[] (string)
id (string) – The advisory’s own tracking id.
products[].name (string) – Product name from the CSAF product tree.
products[].vendor (string) – Nearest enclosing vendor branch.
references[] (string)
source (string) – VL source holding the advisory.
summary (string) – The advisory’s summary note.
title (string) – Advisory title.

GET /euvd/assigners/names#

List the coordinated assigner names

Status Codes:

200 OK – Success.

Response JSON Object:

[] (string) – Assigner name.

GET /euvd/search#

Search EUVD entries

Query Parameters:

page (integer) – Page number (1 to 1000).
per_page (integer) – Entries per page (1 to 100).
sort (string) – Dimension to order by. ‘published’ and ‘reserved’ also restrict the result to entries that carry that date, so they can return fewer entries than ‘updated’; ‘updated’ is set for every entry and never restricts.
order (string) – Ordering direction.
published_from (string) – Earliest publication date (ISO-8601).
published_to (string) – Latest publication date (ISO-8601).
updated_from (string) – Earliest update date (ISO-8601).
updated_to (string) – Latest update date (ISO-8601).
exploited_from (string) – Earliest exploited-since date (ISO-8601).
exploited_to (string) – Latest exploited-since date (ISO-8601).
text (string) – Free text matched against the linked CVE’s indexed content. Requires full-text search to be enabled on the instance.
assigner (string) – Assigner (CNA) of the linked CVE. Matched exactly, as upstream does.
cvss_min (string) – Lowest CVSS base score (0..10) to include. Entries whose linked CVE has no score at all are excluded, since nothing about them can satisfy a lower bound.
cvss_max (string) – Highest CVSS base score (0..10) to include. Unscored entries are kept, so cvss_max=10 is a no-op rather than a filter.
epss_min (string) – Lowest EPSS probability (0..1) to include. Entries with no EPSS score are excluded, as for cvss_min.
epss_max (string) – Highest EPSS probability (0..1) to include. Unscored entries are kept, so epss_max=1 is a no-op.
exploited (boolean) – Restrict to entries listed (true) or not listed (false) in a KEV catalog.
kev_catalog (string) – Restrict to entries exploited in this KEV catalog.
vendor (string) – Affected vendor. Matches any vendor starting with this.
product (string) – Affected product. Matches any product starting with this.
with_products (boolean) – Include the affected-product rows (one per affected version).

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.
503 Service Unavailable – The exploited-vulnerability data is unavailable.

Response JSON Object:

data[].aliases[] (string)
data[].assigner (string) – CNA that assigned the linked CVE.
data[].cvss (any) – Highest-version CVSS metric of the linked CVE.
data[].date_published (string) – ISO-8601 publication timestamp.
data[].date_updated (string) – ISO-8601 last-update timestamp.
data[].description (string) – Description of the linked CVE.
data[].epss (number) – EPSS probability (0..1) of the linked CVE.
data[].exploited_since (string) – ISO-8601 timestamp of the earliest KEV listing.
data[].id (string) – EUVD identifier, e.g. EUVD-2026-0001.
data[].products[].name (string) – Product name, as the CNA wrote it.
data[].products[].vendor (string) – Vendor name, as the CNA wrote it.
data[].products[].version (string) – Affected version or version range.
data[].references[] (string)
data[].vendors[] (string)
metadata.count (integer) – Entries matching the filters. A total when count_is_exact is true, otherwise a lower bound.
metadata.count_is_exact (boolean) – True when the walk reached the end of the index, so count is the complete total; false when it stopped at its bound.
metadata.has_more (boolean) – True when further entries are available beyond this page.
metadata.page (integer) – Page returned (1-indexed).
metadata.per_page (integer) – Entries per page.

GET /euvd/stats/assigners/ranking#

List the top assigners

Query Parameters:

limit (integer) – How many entries to return, capped at 10.
period (string) – Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

[].assigner (string) – CNA short name, as the CVE records it.
[].count (number) – Records assigned.

GET /euvd/stats/count#

Count the catalogue per year, or per month within one year

Query Parameters:

granularity (string) – Period granularity of the counts.
period (string) – With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the counters have never been prepared; counts is then empty.
counts (object) – Period (YYYY or YYYY-MM) -> record count.
granularity (string) – year or month.

GET /euvd/stats/cvss/scores#

Distribution of records by severity band

Query Parameters:

period (string) – Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the distribution has never been prepared; distribution is then empty.
distribution (object) – Bucket -> record count.
period (string) – The publication year the distribution covers, or null for the whole catalogue.

GET /euvd/stats/cvss/versions#

Distribution of records by CVSS version

Query Parameters:

period (string) – Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the distribution has never been prepared; distribution is then empty.
distribution (object) – Bucket -> record count.
period (string) – The publication year the distribution covers, or null for the whole catalogue.

GET /euvd/stats/kev#

Report known-exploited inclusion

Status Codes:

200 OK – Success.

Response JSON Object:

available (boolean) – False before the KEV sync has built the exploited index.
catalogs (object) – Catalogue short name -> record count. These overlap: a record listed by two catalogues is counted by both, so they do not sum to exploited.
exploited (integer) – Records whose CVE appears in at least one known-exploited catalogue.
ratio (number) – exploited / total, or null when the catalogue is empty.
total (integer) – Records in the catalogue.
unattributed (integer) – Exploited records held under a catalogue this instance cannot name. Non-zero means the local GCVE reference data is absent or stale.

GET /euvd/stats/status#

Report the catalogue’s lifecycle split

Status Codes:

200 OK – Success.

Response JSON Object:

published (integer) – Records carrying a publication date.
reserved (integer) – Records carrying a reservation date.
total (integer) – Records in the catalogue.

GET /euvd/stats/time_to_exploit#

Report the publication-to-exploitation summary

Status Codes:

200 OK – Success.

Response JSON Object:

available (boolean) – False when the cross-store scan has never run.
computed_at (string) – When the snapshot was taken.
count (integer) – Records the figure rests on – those ever exploited.
cves_exploited (integer) – Distinct CVEs those entries named – the denominator of the two unmatched counts.
entries_scanned (integer) – Known-exploited catalogue entries the scan read.
exploited_before_publication (integer) – Of count, how many were listed before the record was published.
max_days (number) – Longest observed interval.
mean_days (number) – Mean days from publication to first listing.
median_days (number) – Median days, reported alongside the mean.
min_days (number) – Shortest observed interval.
p90_days (number) – 90th percentile, nearest rank.
unmatched_no_publication_date (integer) – Exploited records carrying no publication date, so they could not be dated.
unmatched_no_record (integer) – Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.

GET /euvd/stats/vendors/ranking#

List the top vendors

Query Parameters:

limit (integer) – How many entries to return, capped at 10.
period (string) – Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

[].count (number) – Records affecting the vendor.
[].vendor (string) – Vendor name, as the CVE records it.

GET /euvd/{identifier}#

One EUVD entry in full, by its own id or by any identifier it covers

Parameters:

identifier (string) – An EUVD id, a CVE id, or any alias the entry covers.

Status Codes:

200 OK – Success.
404 Not Found – No EUVD entry for this identifier.

POST /exploit-hazard#

Compute the local exploit hazard for a vulnerability instance from an ELM probability such as EPSS, user-provided control effectiveness, optional KEV policy parameters, and exponential or Weibull hazard settings.

Status Codes:

200 OK – Success.
400 Bad Request – Invalid model parameters.
503 Service Unavailable – Storage backend unavailable.

POST /exploit-hazard/#

Status Codes:

200 OK – Success.
400 Bad Request – Invalid model parameters.
503 Service Unavailable – Storage backend unavailable.

POST /exploit-hazard/batch#

Aggregate the local exploit hazard of a set of vulnerability instances (section 3.6 of the referenced paper): per-instance hazards, their sum as the aggregate daily hazard, and the Poisson probability of at least one exploitation event over the common horizon. Instances are the same objects the single endpoint accepts — or plain vulnerability-id strings — and optional shared ‘parameters’ (controls, KEV policy, Weibull shape) apply to every instance.

Status Codes:

200 OK – Success.
400 Bad Request – Invalid request or model parameters.
503 Service Unavailable – Storage backend unavailable.

GET /gcve/publication#

List the GCVE published by the local Vulnerability-Lookup instance

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
date_sort (string) – Field to sort by (published, updated, reserved).
sort_order (string) – Sort order: asc or desc.
since (string) – Retrieve vulnerabilities published/updated after this date.

Status Codes:

200 OK – Success

GET /gcve/registry#

List the GNAs from the local GCVE registry of the Vulnerability-Lookup instance

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
short_name (string) – Short name of the organization.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].cpe_vendor_name (string) – Official CPE vendor name. (read only)
[].data[].full_name (string) – Full legal name of the organization. (read only)
[].data[].gcve_allocation (string) – URL of the interface used to allocate or register new vulnerabilities. (read only)
[].data[].gcve_api (string) – URL of the API endpoint providing vulnerability data. (read only)
[].data[].gcve_dump (string) – URL to a machine-readable dump (e.g., JSON) of vulnerability information. (read only)
[].data[].gcve_pull_api (string) – URL of the interface compatible to retrieve the local GNA publications. (read only)
[].data[].gcve_url (string) – URL to the public vulnerability disclosure website. (read only)
[].data[].id (string) – Unique identifier for the GCVE Numbering Authority. (read only)
[].data[].short_name (string) – Short name of the organization. (read only)
[].metadata (any) – Metadata related to the result.

GET /gcve/registry/integrity#

Verify the integrity of the local registry

Status Codes:

200 OK – Success

GET /kev#

List KEV entries with pagination and filtering

Query Parameters:

page (integer) – Page number
per_page (integer) – Items per page (max 1000)
vuln_id (string) – Filter by vulnerability ID
status_reason (string)
exploited (string) – Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all.
vulnerability_lookup_origin (string) – Filter by origin instance UUID
date_from (string) – Filter from date (YYYY-MM-DD)
date_to (string) – Filter to date (YYYY-MM-DD)
author (string) – Filter by author login

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

data[].characteristics (object) – Technical characteristics
data[].evidence[].confidence (object) – Confidence (number 0.0-1.0 or string)
data[].evidence[].details (object) – Implementation-specific details
data[].evidence[].signal (object) – Evidence signal (string or array of strings)
data[].evidence[].source (string) – Evidence source (required) (required)
data[].evidence[].type (string) – Evidence type (optional)
data[].gcve (any) – GCVE origin metadata for the KEV assertion
data[].references (object) – Related references
data[].scope (object) – Geographical/sectoral context
data[].status.exploited (boolean) – Exploitation observed (required)
data[].status.status_reason (string) – Status reason (required)
data[].status.status_updated_at (string) – Status update time (required)
data[].timestamps (object) – Temporal context
data[].uuid (string) – KEV entry UUID (read only)
data[].vulnerability.altId[] (string)
data[].vulnerability.vulnId (string) – Vulnerability ID (required)
metadata.count (integer) – Total number of the items of the data. (read only)
metadata.page (integer) – Number of the page. (read only)
metadata.per_page (integer) – Requested limit data. (read only)

POST /kev#

Create new KEV entry

Status Codes:

200 OK – Success

GET /kev/#

List KEV entries with pagination and filtering

Query Parameters:

page (integer) – Page number
per_page (integer) – Items per page (max 1000)
vuln_id (string) – Filter by vulnerability ID
status_reason (string)
exploited (string) – Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all.
vulnerability_lookup_origin (string) – Filter by origin instance UUID
date_from (string) – Filter from date (YYYY-MM-DD)
date_to (string) – Filter to date (YYYY-MM-DD)
author (string) – Filter by author login

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

data[].characteristics (object) – Technical characteristics
data[].evidence[].confidence (object) – Confidence (number 0.0-1.0 or string)
data[].evidence[].details (object) – Implementation-specific details
data[].evidence[].signal (object) – Evidence signal (string or array of strings)
data[].evidence[].source (string) – Evidence source (required) (required)
data[].evidence[].type (string) – Evidence type (optional)
data[].gcve (any) – GCVE origin metadata for the KEV assertion
data[].references (object) – Related references
data[].scope (object) – Geographical/sectoral context
data[].status.exploited (boolean) – Exploitation observed (required)
data[].status.status_reason (string) – Status reason (required)
data[].status.status_updated_at (string) – Status update time (required)
data[].timestamps (object) – Temporal context
data[].uuid (string) – KEV entry UUID (read only)
data[].vulnerability.altId[] (string)
data[].vulnerability.vulnId (string) – Vulnerability ID (required)
metadata.count (integer) – Total number of the items of the data. (read only)
metadata.page (integer) – Number of the page. (read only)
metadata.per_page (integer) – Requested limit data. (read only)

POST /kev/#

Create new KEV entry

Status Codes:

200 OK – Success

DELETE /kev/catalog/{catalog_uuid}#

Delete all KEV entries from a specific catalog

Parameters:

catalog_uuid (string)

Status Codes:

200 OK – Success

DELETE /kev/origin/{origin_uuid}/{vuln_id}#

Delete KEV entry by (origin_uuid, vulnId) (admin only)

Parameters:

origin_uuid (string)
vuln_id (string)

Status Codes:

200 OK – Success

GET /kev/origin/{origin_uuid}/{vuln_id}#

Get single KEV entry by (origin_uuid, vulnId)

Parameters:

origin_uuid (string)
vuln_id (string)

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

characteristics (object) – Technical characteristics
evidence[].confidence (object) – Confidence (number 0.0-1.0 or string)
evidence[].details (object) – Implementation-specific details
evidence[].signal (object) – Evidence signal (string or array of strings)
evidence[].source (string) – Evidence source (required) (required)
evidence[].type (string) – Evidence type (optional)
gcve (any) – GCVE origin metadata for the KEV assertion
references (object) – Related references
scope (object) – Geographical/sectoral context
status.exploited (boolean) – Exploitation observed (required)
status.status_reason (string) – Status reason (required)
status.status_updated_at (string) – Status update time (required)
timestamps (object) – Temporal context
uuid (string) – KEV entry UUID (read only)
vulnerability.altId[] (string)
vulnerability.vulnId (string) – Vulnerability ID (required)

PUT /kev/origin/{origin_uuid}/{vuln_id}#

Update KEV entry by (origin_uuid, vulnId) (author or admin only)

Parameters:

origin_uuid (string)
vuln_id (string)

Status Codes:

200 OK – Success

DELETE /kev/{kev_uuid}#

Delete KEV entry (admin only)

Parameters:

kev_uuid (string)

Status Codes:

200 OK – Success

GET /kev/{kev_uuid}#

Get single KEV entry

Parameters:

kev_uuid (string)

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

characteristics (object) – Technical characteristics
evidence[].confidence (object) – Confidence (number 0.0-1.0 or string)
evidence[].details (object) – Implementation-specific details
evidence[].signal (object) – Evidence signal (string or array of strings)
evidence[].source (string) – Evidence source (required) (required)
evidence[].type (string) – Evidence type (optional)
gcve (any) – GCVE origin metadata for the KEV assertion
references (object) – Related references
scope (object) – Geographical/sectoral context
status.exploited (boolean) – Exploitation observed (required)
status.status_reason (string) – Status reason (required)
status.status_updated_at (string) – Status update time (required)
timestamps (object) – Temporal context
uuid (string) – KEV entry UUID (read only)
vulnerability.altId[] (string)
vulnerability.vulnId (string) – Vulnerability ID (required)

PUT /kev/{kev_uuid}#

Update KEV entry (author or admin only)

Parameters:

kev_uuid (string)

Status Codes:

200 OK – Success

GET /organization/#

List all organizations

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
id (integer) – ID of the organization.
uuid (string) – UUID of the organization.
name (string) – The name of the organization.
gna_id (integer) – The reserved GNA identifier of the organization.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].creation_timestamp (string) – Creation time of the organization. (read only)
[].data[].description (string) – Description.
[].data[].gna_id (integer) – The reserved GNA identifier of the organization.
[].data[].id (string) – Organization id.
[].data[].name (string) – Organization name.
[].data[].short_name (string) – Organization short name.
[].data[].updated_timestamp (string) – Updated time of the organization. (read only)
[].data[].uuid (string) – Organization uuid.
[].metadata (any) – Metadata related to the result.

GET /product/#

List all products

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
uuid (string) – UUID of the product.
name (string) – The name of the product.
organization_name (string) – The name of the organization related to the product.
organization_id (string) – The id of the organization related to the product.
organization_uuid (string) – The uuid of the organization related to the product.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].creation_timestamp (string) – Creation time of the product. (read only)
[].data[].description (string) – Description.
[].data[].id (string) – Product id.
[].data[].name (string) – Product name.
[].data[].updated_timestamp (string) – Updated time of the product. (read only)
[].data[].uuid (string) – Product uuid.
[].metadata (any) – Metadata related to the result.

GET /rulezet/search_rules_by_vulnerabilities/{vulnerability_id}#

Get rules from Rulezet by vulnerability id

Get rules from Rulezet by vulnerability id.

Parameters:

vulnerability_id (string)

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.

Status Codes:

200 OK – Success.
404 Not Found – Rule not found in Rulezet.
502 Bad Gateway – Bad Gateway: Invalid response from Rulezet.
503 Service Unavailable – Service Unavailable: Unable to reach Rulezet or misconfigured.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].creation_date (string) – Date the ule was created. (required)
[].data[].description (string) – Description of the rule. (required)
[].data[].detail_url (string) – URL of the rule. (required)
[].data[].format (string) – Format of the rule. (required)
[].data[].id (integer) – Rule ID. (required)
[].data[].raw (string) – raw version of the rule. (required)
[].data[].title (string) – Title of the rule. (required)
[].data[].updated_date (string) – Date the rule was updated. (required)
[].data[].uuid (string) – Rule UUID. (required)
[].data[].vulnerability_id (string) – Related vulnerability. (required)
[].metadata (any) – Metadata related to the result.

DELETE /sighting#

Delete sightings by filters (author, source, date)

Delete sightings by filters (author, source, date). At least one filter must be specified. At least one filter must be specified.

Query Parameters:

author (string) – Author of the sightings to delete (login). Only the author themselves or an admin can delete.
source (string) – Source of the sightings (supports partial match using ilike).
date_from (string) – Delete sightings from this date (inclusive). Format: YYYY-MM-DD.
date_to (string) – Delete sightings up to this date (inclusive). Format: YYYY-MM-DD.
vulnerability_lookup_origin (string) – Delete sightings from this origin instance UUID.

Status Codes:

200 OK – Deleted sightings successfully.
403 Forbidden – Not allowed to delete these sightings.
404 Not Found – No sightings matched the filters.

GET /sighting#

List all sightings

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
uuid (string) – UUID of the sighting.
type (string) –
Type of sightings:
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
vuln_id (string) – Vulnerability related to the sighting.
author (string) – Author of the sighting (login).
date_from (string) – The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD
source (string) – Source of the sighting.
advisory_status (string) – Filter sightings by the status of the related advisory.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
[].data[].creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
[].data[].source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
[].data[].type (string) – Type of the sighting.
[].data[].uuid (string) – Sighting UUID. (read only)
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

POST /sighting#

Create a new sighting

Create a new sighting.

Request JSON Object:

author (any) – (read only)
content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
type (string) – Type of the sighting.
uuid (string) – Sighting UUID. (read only)
vulnerability (string) – Vulnerability id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

Status Codes:

201 Created – Success.
400 Bad Request – Incorrect payload to instantiate a sighting.
409 Conflict – Duplicate sighting.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
[].data[].creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
[].data[].source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
[].data[].type (string) – Type of the sighting.
[].data[].uuid (string) – Sighting UUID. (read only)
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

DELETE /sighting/#

Delete sightings by filters (author, source, date)

Delete sightings by filters (author, source, date). At least one filter must be specified. At least one filter must be specified.

Query Parameters:

author (string) – Author of the sightings to delete (login). Only the author themselves or an admin can delete.
source (string) – Source of the sightings (supports partial match using ilike).
date_from (string) – Delete sightings from this date (inclusive). Format: YYYY-MM-DD.
date_to (string) – Delete sightings up to this date (inclusive). Format: YYYY-MM-DD.
vulnerability_lookup_origin (string) – Delete sightings from this origin instance UUID.

Status Codes:

200 OK – Deleted sightings successfully.
403 Forbidden – Not allowed to delete these sightings.
404 Not Found – No sightings matched the filters.

GET /sighting/#

List all sightings

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.
uuid (string) – UUID of the sighting.
type (string) –
Type of sightings:
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
vuln_id (string) – Vulnerability related to the sighting.
author (string) – Author of the sighting (login).
date_from (string) – The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD
source (string) – Source of the sighting.
advisory_status (string) – Filter sightings by the status of the related advisory.

Status Codes:

200 OK – Success

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
[].data[].creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
[].data[].source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
[].data[].type (string) – Type of the sighting.
[].data[].uuid (string) – Sighting UUID. (read only)
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

POST /sighting/#

Create a new sighting

Create a new sighting.

Request JSON Object:

author (any) – (read only)
content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
type (string) – Type of the sighting.
uuid (string) – Sighting UUID. (read only)
vulnerability (string) – Vulnerability id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

Status Codes:

201 Created – Success.
400 Bad Request – Incorrect payload to instantiate a sighting.
409 Conflict – Duplicate sighting.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].author (any) – (read only)
[].data[].content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
[].data[].creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
[].data[].source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
[].data[].type (string) – Type of the sighting.
[].data[].uuid (string) – Sighting UUID. (read only)
[].data[].vulnerability (string) – Vulnerability id.
[].data[].vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)
[].metadata (any) – Metadata related to the result.

GET /sighting/stats#

Aggregated sighting counts over a date range. Returns pre-grouped (no pagination) rows so the homepage can render the top-N charts and the evolution table without fetching raw sightings.

Query Parameters:

date_from (string) – Inclusive lower bound of creation date. Format: YYYY-MM-DD.
date_to (string) – Inclusive upper bound of creation date. Format: YYYY-MM-DD.
type (string) – Optional filter on sighting type.
group_by (string) – Grouping dimensions. ‘type,vulnerability’ returns per-type vulnerability counts (charts); ‘vulnerability,date’ returns daily counts per vulnerability (table).

Status Codes:

200 OK – Success

DELETE /sighting/{sighting_uuid}#

Delete a single sighting by UUID

Delete a single sighting by its UUID.

Parameters:

sighting_uuid (string)

Status Codes:

200 OK – Sighting deleted successfully.
403 Forbidden – Not allowed to delete this sighting.
404 Not Found – Sighting not found.

GET /sighting/{sighting_uuid}#

Get a sighting with its UUID.

Parameters:

sighting_uuid (string)

Status Codes:

200 OK – Success.
404 Not Found – Sighting not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

author (any) – (read only)
content (string) – Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).
creation_timestamp (string) – When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.
source (string) – The source of the sighting (Fediverse status URI, link, tool, etc.).
type (string) – Type of the sighting.
uuid (string) – Sighting UUID. (read only)
vulnerability (string) – Vulnerability id.
vulnerability_lookup_origin (string) – UUID of the Vulnerability-Lookup origin instance. (read only)

GET /stats/assigners/ranking#

Returns the assigners ranking.

Query Parameters:

limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.
period (string) – The period of the stats. Format: YYYY[-MM]
source (string) – The source of the vulnerability advisories.

Status Codes:

200 OK – Success

GET /stats/credits/ranking#

Returns the credits ranking.

Query Parameters:

limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.
period (string) – The period of the stats. Format: YYYY[-MM]
source (string) – Optional feeder name. If omitted, the combined ranking across all credit-indexing sources (the CVE list and the CSAF feeders) is returned.

Status Codes:

200 OK – Success

GET /stats/cvss/scores#

Returns the severity band distribution of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
period (string) – Restrict the distribution to one publication year (YYYY). Omit for the whole source.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the distribution has never been prepared; distribution is then empty.
distribution (object) – Bucket -> record count.
period (string) – The publication year the distribution covers, or null for all of it.
source (string) – The source reported on.

GET /stats/cvss/versions#

Returns the CVSS version distribution of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
period (string) – Restrict the distribution to one publication year (YYYY). Omit for the whole source.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the distribution has never been prepared; distribution is then empty.
distribution (object) – Bucket -> record count.
period (string) – The publication year the distribution covers, or null for all of it.
source (string) – The source reported on.

GET /stats/cwe/most_used#

Returns the most used CWEs based on sightings

Query Parameters:

limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.
period (string) – The period of the stats. Format: YYYY[-MM]

Status Codes:

200 OK – Success

GET /stats/kev#

Returns known-exploited inclusion for a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when this source does not maintain a known-exploited index.
catalogs (object) – Catalogue short name -> record count. These overlap: a record listed by two catalogues is counted by both, so they do not sum to exploited.
exploited (integer) – Records appearing in at least one known-exploited catalogue.
ratio (number) – exploited / total, or null when the source is empty.
source (string) – The source reported on.
total (integer) – Records held.
unattributed (integer) – Exploited records held under a catalogue this instance cannot name. Non-zero means the local catalogue reference data is absent or stale.

GET /stats/scorecard/assigner#

Returns one assigner’s scorecard.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
assigner (string) – The assigner short name (a CNA), or the GNA source name (gna-<id>) for a GNA source.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

all (object) – The same tallies over every publication.
assigner (string) – The assigner reported on.
available (boolean) – False when nothing was prepared for this source or assigner.
meta.assigners (integer) – Assigners with at least one scored record.
meta.computed_at (string) – When the figures were prepared.
meta.methodology (integer) – Version of the rules the figures were computed under.
meta.min_records (integer) – Publications an assigner needs in the window to be ranked.
meta.records (integer) – Published records scored by the last full pass.
meta.window_days (integer) – Length of the rolling window the ranking is built on.
ranked (boolean) – Whether the assigner reaches the volume threshold in the window.
source (string) – The source reported on.
window (object) – The rolling window’s tallies: score, grade, pillars, checks, context.
years (object) – Score and record count per publication year.

GET /stats/scorecard/gnas#

Returns the cross-GNA scorecard ranking.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
period (string) – ‘window’ (the rolling window the ranking is built on, the default), ‘all’, or a publication year (YYYY).
limit (integer) – The most entries to return, at most 500.
output (string) – The format of the output.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when no GNA source has a prepared scorecard.
period (string) – window, all, or the publication year.
ranking[].assigner (string) – The CNA short name, or the GNA source name.
ranking[].grade (string) – A to E, from the mean score.
ranking[].ranked (boolean) – False under the volume threshold: the score is shown, not ranked.
ranking[].records (integer) – Published records scored in the period.
ranking[].score (number) – Mean record score over the period, 0..100.
ranking[].source (string) – The source the entry was read from (GNA ranking only).
sources[] (string)

GET /stats/scorecard/ranking#

Returns the assigner scorecard ranking of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
period (string) – ‘window’ (the rolling window the ranking is built on, the default), ‘all’, or a publication year (YYYY).
limit (integer) – The most entries to return, at most 500.
output (string) – The format of the output.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the scorecard has never been prepared for this source.
meta.assigners (integer) – Assigners with at least one scored record.
meta.computed_at (string) – When the figures were prepared.
meta.methodology (integer) – Version of the rules the figures were computed under.
meta.min_records (integer) – Publications an assigner needs in the window to be ranked.
meta.records (integer) – Published records scored by the last full pass.
meta.window_days (integer) – Length of the rolling window the ranking is built on.
period (string) – window, all, or the publication year.
ranking[].assigner (string) – The CNA short name, or the GNA source name.
ranking[].grade (string) – A to E, from the mean score.
ranking[].ranked (boolean) – False under the volume threshold: the score is shown, not ranked.
ranking[].records (integer) – Published records scored in the period.
ranking[].score (number) – Mean record score over the period, 0..100.
ranking[].source (string) – The source the entry was read from (GNA ranking only).
source (string) – The source reported on.

GET /stats/scorecard/signals#

Returns the scorecard signals of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the scorecard has never been prepared for this source.
signals (object) – Per signal: its label, unit and the ranked assigners tripping it.
source (string) – The source reported on.

GET /stats/sighting/exploitation_ratio#

Per publication year, the share of CVEs that have at least one exploitation sighting (type ‘exploited’ or ‘published-proof-of-concept’) over the total number of CVEs published that year. Both sides of the ratio are bucketed by the CVE Program publication date, not by the year in the CVE id, so a CVE-2023-* record published in 2025 counts in 2025. Sighted ids that the CVE Program never published are left out; their number is reported in the metadata. Useful to track whether the proportion of exploited vulnerabilities evolves over time, independently of the raw discovery volume. With ‘year’, the same ratio is returned per publication month of that year instead. Note: recent years are undercounted, as sightings accumulate over time.

Query Parameters:

year_from (integer) – Inclusive lower bound of the CVE year range. Format: YYYY.
year_to (integer) – Inclusive upper bound of the CVE year range. Defaults to the current year.
year (integer) – Break one publication year down per month (YYYY). The months after the current one are omitted for the current year. Overrides year_from and year_to.
output (string) – The format of the output.

Status Codes:

200 OK – Success

GET /stats/sighting/exploitation_ratio_cumulative#

Cumulative share of published CVEs that have received at least one exploitation sighting (‘exploited’ or ‘published-proof-of-concept’), bucketed by the date of the sighting rather than the CVE year. Each bucket reports the running totals up to that point, so the series is monotonic in its inputs and reflects how the overall exploited fraction evolves over time. Returns the trailing ‘window’ buckets (default 30).

Query Parameters:

granularity (string) – Bucket size of the cumulative series.
window (integer) – Number of trailing buckets to return. Use 0 for the full history.
output (string) – The format of the output.

Status Codes:

200 OK – Success

GET /stats/time_to_exploit#

Returns the publication-to-exploitation summary of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the cross-store scan has never run.
computed_at (string) – When the snapshot was taken.
count (integer) – Records the figure rests on – those ever exploited.
cves_exploited (integer) – Distinct CVEs those entries named – the denominator of the two unmatched counts.
entries_scanned (integer) – Known-exploited catalogue entries the scan read.
exploited_before_publication (integer) – Of count, how many were listed before the record was published.
max_days (number) – Longest observed interval.
mean_days (number) – Mean days from publication to first listing.
median_days (number) – Median days, reported alongside the mean.
min_days (number) – Shortest observed interval.
p90_days (number) – 90th percentile, nearest rank.
source (string) – The source reported on.
unmatched_no_publication_date (integer) – Exploited records carrying no publication date, so they could not be dated.
unmatched_no_record (integer) – Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.

GET /stats/vendors/ranking#

Returns the vendors ranking.

Query Parameters:

limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.
period (string) – The period of the stats. Format: YYYY[-MM]
source (string) – The source of the vulnerability advisories.

Status Codes:

200 OK – Success

GET /stats/vulnerability/count#

Returns the number of published/reserved vulnerabilities for a specific period.

Query Parameters:

state (string) – The state of the advisory.
period (string) – The period of the stats. Format: YYYY[-MM]
source (string) – The source of the vulnerability advisories.

Status Codes:

200 OK – Success

GET /stats/vulnerability/counts#

Returns the record count per publication period.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.
granularity (string) – Period granularity of the counts.
period (string) – With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.
state (string) – Count records by publication date (default) or by reservation date.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

available (boolean) – False when the counters have never been prepared; counts is then empty.
counts (object) – Period (YYYY or YYYY-MM) -> record count.
granularity (string) – year or month.
source (string) – The source reported on.
state (string) – published or reserved: the date the records are counted by.

GET /stats/vulnerability/most_commented#

Returns the most commented vulnerabilities.

Query Parameters:

date_from (string) – The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD
limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.

Status Codes:

200 OK – Success

GET /stats/vulnerability/most_sighted#

Returns the most sighted vulnerabilities.

Query Parameters:

date_from (string) – The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD
date_to (string) – The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD
sighting_type (string) – The type of the sighting.
limit (integer) – The top elements to take into account in the query.
output (string) – The format of the output.

Status Codes:

200 OK – Success

GET /stats/vulnerability/status#

Returns the lifecycle split of a source.

Query Parameters:

source (string) – The source to report on, e.g. cvelistv5 or euvd.

Status Codes:

200 OK – Success.
400 Bad Request – The request could not be satisfied.

Response JSON Object:

published (integer) – Records carrying a publication date.
reserved (integer) – Records carrying a reservation date.
source (string) – The source reported on.
total (integer) – Records held.

GET /system/checkProcess#

Checks the heartbeats of the various processes

Checks the heartbeats of the various processes.

Status Codes:

200 OK – Success

GET /system/checkSMTP#

Checks the SMTP connection

Checks the SMTP connection.

Status Codes:

200 OK – Success

GET /system/configInfo#

Returns non-sensitive information about the configuration of the system

Returns non-sensitive information about the configuration of the system.

Status Codes:

200 OK – Success

GET /system/dbInfo#

Returns information about the current sources in the Kvrocks database in use and when it was updated

Returns information about the current sources in the Kvrocks database in use and when it was updated.

Status Codes:

200 OK – Success

GET /system/pgInfo#

Returns information about the PostgreSQL database

Returns information about the PostgreSQL database.

Status Codes:

200 OK – Success

GET /system/redis_up#

Check if Valkey/Redis is up and running

Alias for /api/system/redis_up

Status Codes:

200 OK – Success

GET /system/valkey_up#

Check if Valkey/Redis is up and running

Check if Valkey/Redis is up and running.

Status Codes:

200 OK – Success

GET /user/#

List all users

Only available to administrators.

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.

Status Codes:

200 OK – Success.
403 Forbidden – Admin permission required.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

[].data[].created_at (string) – Creation time of the user. (read only)
[].data[].last_seen (string) – Last seen time of the user. (read only)
[].data[].login (string) – User login.
[].data[].uuid (string) – User UUID.
[].metadata (any) – Metadata related to the result.

POST /user/#

Create a non-admin user.

Query Parameters:

page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return.

Request JSON Object:

email (string) – Email. (required)
login (string) – Login. (required)
name (string) – Display name (firstname, lastname). (required)
organisation (string) – Organisation.

Status Codes:

200 OK – Success
201 Created – Success.
403 Forbidden – Self-registration is disabled.
422 Unprocessable Entity – Email address not accepted (disposable email detected, blocked domain, or invalid domain).
429 Too Many Requests – Too many requests (maximum 3 registrations/hour per IP)

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

created_at (string) – Creation time of the user. (read only)
last_seen (string) – Last seen time of the user. (read only)
login (string) – User login.
uuid (string) – User UUID.

POST /user/api_key#

Regenerating the API key of the authenticated user with the current API key

Regenerating the API key of the authenticated user with the current API key.

Request JSON Object:

apikey (string) – The current API key of the user.

Status Codes:

200 OK – Success.
403 Forbidden – Wrong API key submitted.
404 Not Found – User not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

created_at (string) – Creation time of the user. (read only)
last_seen (string) – Last seen time of the user. (read only)
login (string) – User login.
uuid (string) – User UUID.

GET /user/me#

Get information about the currently authenticated user

Get information about the currently authenticated user.

Status Codes:

200 OK – Success.
404 Not Found – User not found.

Request Headers:

X-Fields – An optional fields mask

Response JSON Object:

created_at (string) – Creation time of the user. (read only)
last_seen (string) – Last seen time of the user. (read only)
login (string) – User login.
uuid (string) – User UUID.

DELETE /user/{user_id}#

Endpoint for deleting a user

Delete a user.

Parameters:

user_id (integer)

Status Codes:

204 No Content – Success.
403 Forbidden – Administrator permission required or not the current user.
404 Not Found – User not found.
500 Internal Server Error – Internal server error.

GET /vex/#

Browse VEX records and pivot to the related vulnerability

Browse the VEX records available in vulnerability-lookup, newest first.

Query Parameters:

source (string) – Filter by VEX metadata source.
q (string) – Case-insensitive substring filter on the vulnerability id, document title, or source name.
page (integer) – Number of the page.
per_page (integer) – Maximum number of VEX records to return (capped at 1000).

Status Codes:

200 OK – Success.

GET /vex/{vulnerability_id}#

Get the VEX statements attached to a vulnerability

Get the VEX statements attached to a vulnerability.

Parameters:

vulnerability_id (string)

Status Codes:

200 OK – Success.

GET /vex/{vulnerability_id}/{meta_source}/csaf#

Get the full CSAF VEX document stored for a vulnerability

Get the full CSAF VEX document stored for a vulnerability.

Parameters:

vulnerability_id (string)
meta_source (string)

Status Codes:

200 OK – Success.
404 Not Found – No stored VEX document for this vulnerability and source.

POST /vlai/attack-techniques#

Suggest MITRE ATT&CK techniques based on vulnerability descriptions.

Request JSON Object:

description (string) – Description of the vulnerability.
top_k (integer) – Maximum number of ATT&CK techniques to return.

Status Codes:

200 OK – Success.
401 Unauthorized – Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented).
500 Internal Server Error – Unexpected error.
502 Bad Gateway – Bad content: Invalid response from ML-Gateway.
503 Service Unavailable – Connection Error: Unable to reach ML-Gateway.

GET /vlai/attack-techniques/catalog#

Every MITRE ATT&CK technique the bi-encoder similarity search can rank vulnerabilities for, sorted by id: the techniques the model was trained on (in_vocabulary true) and the other enterprise techniques, scored from their official ATT&CK text. Backs the technique index page.

Status Codes:

200 OK – Success.
500 Internal Server Error – Unexpected error.
502 Bad Gateway – Bad content: Invalid response from ML-Gateway.
503 Service Unavailable – Connection Error: Unable to reach ML-Gateway.

GET /vlai/attack-techniques/{technique_id}/vulnerabilities#

Vulnerabilities whose description is nearest to one MITRE ATT&CK technique in the CIRCL bi-encoder space, best first. A similarity search over the indexed descriptions, not a classification: only the vulnerability -> technique direction has measured accuracy. in_vocabulary is false for techniques the model was not trained on, which rank noticeably worse. score is the training-time probability sigmoid(logit_scale * cosine + logit_bias).

Parameters:

technique_id (string) – MITRE ATT&CK technique id, e.g. T1190 or T1059.004.

Query Parameters:

top_k (integer) – Number of vulnerabilities to return (1-100).

Status Codes:

200 OK – Success.
400 Bad Request – Invalid technique id or top_k.
404 Not Found – Unknown technique.
500 Internal Server Error – Unexpected error.
502 Bad Gateway – Bad content: Invalid response from ML-Gateway.
503 Service Unavailable – Connection Error: Unable to reach ML-Gateway.

GET /vlai/related/{vulnerability_id}#

Vulnerabilities whose description is nearest to this one in the CIRCL ATT&CK bi-encoder space, by plain cosine, best first. A similarity search with no measured accuracy, not a classification. The search runs on the vulnerability’s stored vector when it is indexed (query.by is id); otherwise its description is embedded on the fly (query.by is text, query.indexed is false). query.id is the identifier the record is indexed under.

Parameters:

vulnerability_id (string) – Identifier of a stored vulnerability, e.g. CVE-2021-44077.

Query Parameters:

top_k (integer) – Number of vulnerabilities to return (1-100).

Status Codes:

200 OK – Success.
400 Bad Request – Invalid top_k.
404 Not Found – Unknown vulnerability.
422 Unprocessable Entity – The record has no description to search with.
500 Internal Server Error – Unexpected error.
502 Bad Gateway – Bad content: Invalid response from ML-Gateway.
503 Service Unavailable – Connection Error: Unable to reach ML-Gateway.

POST /vlai/severity-classification#

Classify vulnerabilities by severity based on their descriptions.

Request JSON Object:

description (string) – Description of the vulnerability.
model (string) – AI model to use.

Status Codes:

200 OK – Success.
401 Unauthorized – Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented).
500 Internal Server Error – Unexpected error.
502 Bad Gateway – Bad content: Invalid response from ML-Gateway.
503 Service Unavailable – Connection Error: Unable to reach ML-Gateway.

GET /vulnerability/#

Retrieve vulnerabilities with optional filters

Retrieve vulnerabilities with optional filtering and pagination.

Supports light mode for minimal data (returns only vulnerability ID and source). Returns full vulnerability details by default, or only IDs and sources in light mode.

Query Parameters#

sourcestr: Optional source to filter vulnerabilities (e.g., ‘CVE’, ‘GHSA’, ‘PySec’).
per_pageint, default=30: Maximum number of results (capped at 100).
date_sortstr: Field to sort by. Options: ‘’, ‘published’, ‘updated’, ‘reserved’.
sort_orderstr: Sort order: ‘asc’ or ‘desc’.
sincestr: Retrieve vulnerabilities published/updated after the specified date.
pageint: Pagination page number.
cwestr: Filter vulnerabilities by a specific CWE ID.
productstr: Optional product name to filter vulnerabilities (case-insensitive). If set, the endpoint returns vulnerabilities related to this product across all vendors. Use with assigner to further narrow results.
assignerstr: Optional CNA/assigner short name to filter results (case-insensitive). Only effective when used with product or vendor filters.
lightstr: If ‘1’, returns only (vulnerability_id, source) instead of full details.
with_metastr: If ‘true’, includes metadata for each vulnerability. Ignored in light mode.
with_linkedstr: If ‘true’, includes linked vulnerabilities for each result. Ignored in light mode.
with_commentsstr: If ‘true’, includes comments for each result. Ignored in light mode.
with_bundlesstr: If ‘true’, includes bundles for each result. Ignored in light mode.
with_sightingsstr: If ‘true’, includes sightings for each result. Ignored in light mode.

Returns#

list[dict[str, Any]] | list[tuple[str, str | None]]: Full vulnerability details or minimal tuples if light mode is enabled.

query string product:: Optional product name to filter vulnerabilities (case-insensitive). When provided, results are returned for the product across all vendors.
query string with_sightings:: If ‘true’, include sightings for each result. Ignored in light mode.
query string with_bundles:: If ‘true’, include bundles for each result. Ignored in light mode.
query string with_comments:: If ‘true’, include comments for each result. Ignored in light mode.
query string with_linked:: If ‘true’, include linked vulnerabilities for each result. Ignored in light mode.
query string with_meta:: If ‘true’, include metadata for each vulnerability. Ignored in light mode.
query string light:: If ‘1’, returns only vulnerability ID and source
query string cwe:: Filter vulnerabilities by a specific CWE ID
query string since:: Retrieve vulnerabilities reported after the specified date.
query string sort_order:: Sort order: ‘asc’ or ‘desc’
query string date_sort:: Sort field: ‘’, ‘published’, ‘updated’, ‘reserved’
query string per_page:: Maximum number of results (capped at 100)
query string page:: Pagination page number
query string source:: Optional data source to filter vulnerabilities (e.g., ‘cvelistv5’, ‘github’, ‘nvd’)
status 200:: Success

GET /vulnerability/browse/#

Get the known vendors

Deprecated: use GET /api/browse/vendors instead. Get the known vendors. Deprecated in favor of /api/browse/vendors.

Status Codes:

200 OK – Success

GET /vulnerability/browse/assigners#

Get the known CNAs

Get the known CNAs.

Status Codes:

200 OK – Success

GET /vulnerability/cpesearch/{cpe}#

Get vulnerabilities by CPE (based on the extracted CPE vendor and product)

Get vulnerabilities by CPE (based on the extracted CPE vendor and product).

Parameters:

cpe (string)

Query Parameters:

sort_order (string) – Sort order: ‘asc’ or ‘desc’
date_sort (string) – Sort field: ‘’, ‘published’, ‘updated’, ‘reserved’
per_page (string) – Maximum number of results (capped at 100)
page (string) – Pagination page number
source (string) – Optional source to filter vulnerabilities (e.g., ‘cvelistv5’, ‘nvd’)

Status Codes:

200 OK – Success.
404 Not Found – No match found in the CPE string.

GET /vulnerability/fulltext#

Search vulnerabilities using fulltext search

Fulltext search across all indexed vulnerability sources.

Query Parameters:

q (string) – Fulltext search query string.
page (integer) – Number of the page.
per_page (integer) – Maximum number of elements to return (capped at 100).
sources (string) – Comma-separated list of sources to search (e.g., ‘cvelistv5’, ‘variot’, ‘certfr_alerte’, ‘certfr_avis’, ‘jvndb’). Defaults to ‘cvelistv5’.

Status Codes:

200 OK – Success.
400 Bad Request – Missing or empty query parameter.
503 Service Unavailable – Fulltext search is not enabled on this instance.

GET /vulnerability/last#

Retrieve the latest vulnerabilities, with optional filters for source and number of results

Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources. Supports light mode for minimal data and provides backward-compatible routes. The light mode only returns the vulnerability id and the sources.

Query Parameters:

page (integer) – Number of the page.
cwe (string) – CWE mentioned in the vulnerability.

Status Codes:

200 OK – Success

GET /vulnerability/last/{number}#

Retrieve the latest vulnerabilities, with optional filters for source and number of results

Parameters:

number (integer)

Query Parameters:

page (integer) – Number of the page.
cwe (string) – CWE mentioned in the vulnerability.

Status Codes:

200 OK – Success

GET /vulnerability/last/{source}#

Retrieve the latest vulnerabilities, with optional filters for source and number of results

Parameters:

source (string)

Query Parameters:

page (integer) – Number of the page.
cwe (string) – CWE mentioned in the vulnerability.

Status Codes:

200 OK – Success

GET /vulnerability/last/{source}/{number}#

Retrieve the latest vulnerabilities, with optional filters for source and number of results

Parameters:

source (string)
number (integer)

Query Parameters:

page (integer) – Number of the page.
cwe (string) – CWE mentioned in the vulnerability.

Status Codes:

200 OK – Success

GET /vulnerability/recent#