Known chained pairs: CVEs a cited source reports were used together

Pairs of CVEs that a cited source reports were used together in one exploit chain (VulnCheck KEV entry text, Metasploit modules, SigmaHQ rules, press or research sentences, exploit code read by a model, community text judged by a local model), newest first. Every row carries both CVEs with their CISA KEV status, the claim kind (observed or potential), the quoted evidence with its source, URL and date, and community discussion counts. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community); Metasploit Framework; SigmaHQ.

get/api/chains.json

Request

  • Base URL: https://cve-security.com
  • URL: https://cve-security.com/api/chains.json
  • Auth: one of:
    • bearerAuth (a scheme the document does not define)
    • API key in header X-API-Key

Query parameters

source'vulncheck_kev' | 'metasploit' | 'sigma' | 'press' | 'research' | 'academic' | 'community' | 'github_poc' | 'exploitdb' | 'exploit_code'

Evidence lane

sincestring date

Pairs first seen on or after this day

claim'observed' | 'potential'

observed: the source reports attacks that chained them; potential: the source reports they can be chained

limitinteger

Response

{ generated, source, since, claim, count, attribution[], note, rates, rows: [{cve_a, cve_a_url, cve_a_kev, cve_b, cve_b_url, cve_b_kev, claim_kind, claim_label, lanes[], first_seen, first_date, evidence: [{source, source_label, source_url, source_title, date, quote, claim_kind, observed_basis, support, code_summary}], discussed}] }. The evidence of an observed pair lists the sources that report the attack first; observed_basis says where a row states the attack (quote, context or source) and support holds the sentence when the quote alone does not state it. On a row of exploit code, code_summary {text, url, label} says in our words which CVEs the exploit uses and links to the file.

Changes

No recorded changes to this operation across all 1 revision of this API.