Full intelligence record for one CVE

The CVE record. Top-level keys: cve_id, published, last_modified, description, scores{nvd_v31, nvd_v40, best, primary, highest_modern, has_higher_band_assessment, scoring_policy, cna_name, epss, epss_percentile, by_source[]}, exploitation{cisa_kev, kev_date, kev_due_date, known_ransomware_use, ssvc, vulncheck, circl}, detection{nuclei, nuclei_template_id, metasploit_check, emerging_threats, snort, sigma_log_detection, the Sigma entry is the LOG-HOST layer (hunt in SIEM/EDR telemetry), a separate claim from the remote modalities and never part of scannable coverage}, remediation{fix_held, upgrade_target, fix_lanes, kev_end_of_life, affected_versions[], vendor_sources[]}, fixed is the first patched build, affected_through is the last vulnerable build, so upgrade past it, attack{techniques[]: MITRE ATT&CK techniques with source (observed > exploit > detection > capability > weakness confidence), tactics, observed_role (CTID) and capability_role (exploitation or impact, from the exploit-capability analysis by the CVE Security intelligence team); a derived association with the record, and observed is the only source that reports use}, coverage{news, community}, intelligence_summary, cwes[], references[], other_databases[], products{items[], items_source, items_may_be_incomplete, cpes[], cpes_source, cpes_may_be_incomplete, configurations[], configurations_match_count, configurations_may_be_incomplete, note}, _meta{absence_semantics, attribution}. New in 1.5.5: products lists the vendor and product pairs the CVE page lists (items, up to 40, from NVD's CPE names or, until this dataset holds those, from the products the assigning CNA lists; items_source says which) and the CPE entries NVD's configurations name. With cpes_source nvd_configurations, configurations carries NVD's configurations as NVD writes them (each entry's vulnerable flag, the AND and OR operators, negate and the version bounds verbatim, up to 500 matches) and cpes their distinct names; with nvd_cpe_list, cpes holds the first 25 names in sort order our NVD ingest stores. The may_be_incomplete flags mark a list that may be cut, and products sits last before _meta. New in 1.5.4: other_databases[] lists the CVE's records in ENISA's EUVD, BDU (FSTEC of Russia), CNVD (CNCERT/CC) and JVN iPedia (JPCERT/CC and IPA), three a database at most, each with id, url, source_url, circl_url, published and basis (mapping, cited, single or advisory); the BDU, CNVD and JVN iPedia ids were read through CIRCL Vulnerability-Lookup. New in 1.5.3: remediation.kev_end_of_life reads CISA's KEV action text for an end-of-life statement (yes, possible, scoped or null) and never changes fix_held; a vendor_sources[].fixes[] row counts toward fix_held only when its kind is absent or fixed (a fixed build) or advisory_only; the other kinds name no fix: affected_through (the last vulnerable build), eol_notice (the vendor's end-of-life notice), and, from a CSAF advisory's own category, no_fix (no fix planned or none available), fix_planned, mitigation (mitigation or workaround) and listed (the advisory names no remedy); not_affected (the publisher states the products it names are not affected). New in 1.4.0: oss_packages, the OSV.dev open-source package mapping (CVE-linked, GitHub-reviewed advisories; CC-BY-4.0), packages[].fixed = upgrade targets, packages[].ranges[] carry OSV events verbatim with either fixed[] or affected_through (the last vulnerable version, so upgrade past it).