--- title: "Full intelligence record for one CVE" method: GET path: "/api/cve/{id}" --- # Full intelligence record for one CVE `GET /api/cve/{id}` ## Request - Base URL: `https://cve-security.com` - URL: `https://cve-security.com/api/cve/{id}` - Auth: one of: - HTTP bearer - API key in header `X-API-Key` The same record the HTML page at /cve/{id} renders: scores per scorer, exploitation status (KEV, ransomware flag, CISA SSVC, note ssvc 'poc' means exploit CODE is public, not that exploitation was observed), detection coverage, per-product remediation with upgrade targets, news/community coverage, and an intelligence summary. Responses are private-cacheable for 300s; please honour that rather than re-fetching in a loop. ## Path parameters - `id` string, required ## Response `200` The CVE record. Top-level keys: cve_id, published, last_modified, description, scores{nvd_v31, nvd_v40, best, primary, highest_modern, has_higher_band_assessment, scoring_policy, cna_name, epss, epss_percentile, by_source[]}, exploitation{cisa_kev, kev_date, kev_due_date, known_ransomware_use, ssvc, vulncheck, circl}, detection{nuclei, nuclei_template_id, metasploit_check, emerging_threats, snort, sigma_log_detection, the Sigma entry is the LOG-HOST layer (hunt in SIEM/EDR telemetry), a separate claim from the remote modalities and never part of scannable coverage}, remediation{fix_held, upgrade_target, fix_lanes, kev_end_of_life, affected_versions[], vendor_sources[]}, `fixed` is the first patched build, `affected_through` is the last vulnerable build, so upgrade past it, attack{techniques[]: MITRE ATT&CK techniques with source (observed > exploit > detection > capability > weakness confidence), tactics, observed_role (CTID) and capability_role (exploitation or impact, from the exploit-capability analysis by the CVE Security intelligence team); a derived association with the record, and observed is the only source that reports use}, coverage{news, community}, intelligence_summary, cwes[], references[], other_databases[], products{items[], items_source, items_may_be_incomplete, cpes[], cpes_source, cpes_may_be_incomplete, configurations[], configurations_match_count, configurations_may_be_incomplete, note}, _meta{absence_semantics, attribution}. New in 1.5.5: products lists the vendor and product pairs the CVE page lists (items, up to 40, from NVD's CPE names or, until this dataset holds those, from the products the assigning CNA lists; items_source says which) and the CPE entries NVD's configurations name. With cpes_source nvd_configurations, configurations carries NVD's configurations as NVD writes them (each entry's vulnerable flag, the AND and OR operators, negate and the version bounds verbatim, up to 500 matches) and cpes their distinct names; with nvd_cpe_list, cpes holds the first 25 names in sort order our NVD ingest stores. The may_be_incomplete flags mark a list that may be cut, and products sits last before _meta. New in 1.5.4: other_databases[] lists the CVE's records in ENISA's EUVD, BDU (FSTEC of Russia), CNVD (CNCERT/CC) and JVN iPedia (JPCERT/CC and IPA), three a database at most, each with id, url, source_url, circl_url, published and basis (mapping, cited, single or advisory); the BDU, CNVD and JVN iPedia ids were read through CIRCL Vulnerability-Lookup. New in 1.5.3: remediation.kev_end_of_life reads CISA's KEV action text for an end-of-life statement (yes, possible, scoped or null) and never changes fix_held; a vendor_sources[].fixes[] row counts toward fix_held only when its kind is absent or fixed (a fixed build) or advisory_only; the other kinds name no fix: affected_through (the last vulnerable build), eol_notice (the vendor's end-of-life notice), and, from a CSAF advisory's own category, no_fix (no fix planned or none available), fix_planned, mitigation (mitigation or workaround) and listed (the advisory names no remedy); not_affected (the publisher states the products it names are not affected). New in 1.4.0: oss_packages, the OSV.dev open-source package mapping (CVE-linked, GitHub-reviewed advisories; CC-BY-4.0), packages[].fixed = upgrade targets, packages[].ranges[] carry OSV events verbatim with either fixed[] or affected_through (the last vulnerable version, so upgrade past it). - CveRecord: Per-CVE intelligence record returned by GET /api/cve/{id} and the MCP get_cve tool (identical shape). Absence semantics: a null or empty field means this dataset holds no such record. The source may still hold one. - `cve_id` string, required - `title` string, nullable: The CVE's title in the house format: vendor, product, component and weakness, in that order, in sentence case. title_source says where it came from. Null when this dataset holds no title that meets the standard; lists then show the description. - `title_source` string, nullable: Where the title came from: cisa_kev (the name CISA gives the KEV entry, set in the house format), cna: (the assigning CNA's own title), vendor: (the vendor's advisory title), ghsa (the GitHub Advisory Database summary, CC BY 4.0), rule (written from the CVE record by our rules), model (drafted by a language model from the CVE record and checked against it) or none (this dataset holds no title that meets the standard). Null on a record the title pipeline has not reached. - `published` string, nullable - `last_modified` string, nullable - `description` string, nullable - `scores` object - `nvd_v31` number, nullable: NVD's own CVSS v3.1 base score (NVD's metric, source nvd@nist.gov). Null when this dataset holds no NVD v3.1 score. New in 1.7.0: until Oct. 5, 2026, about 104,000 records held a CNA's metric here; the CNA's score now reads under the CNA in best and by_source. - `nvd_v31_severity` string, nullable - `nvd_v40` number, nullable: NVD's own CVSS v4.0 base score (NVD's metric, source nvd@nist.gov). Null when this dataset holds no NVD v4.0 score. - `nvd_v40_severity` string, nullable: New in 1.7.0. - `best` object, nullable: New in 1.7.0. The one score behind the listing's severity band and sort, with its scorer. From 1.8.0 it follows scoring_policy (the same assessment as primary, without a legacy CVSS v2.0 score): the CNA's CVSS v4.0, v3.1 or v3.0 when the CVE Program lists the CNA as a vendor or open-source organization (and, from 1.9.0, the record names a product it makes: cna_makes_product), then NVD, then CISA ADP, then any other CNA, then other ADPs; within a source v4.0, v3.1, v3.0. Until 1.8.0 it was NVD's v3.1, then NVD's v4.0, then the best CNA or ADP score. Null when this dataset holds no v3 or v4 score. Kept through a deprecation period; read primary. - `score` number - `severity` string, nullable - `source` string, nullable: nvd, cna or the ADP's short name (cisa-adp, redhat-sadp). Null on a record exported before Oct. 5, 2026 whose catalog row names no source. - `version` string, nullable: 3.1, 4.0 or 3.0 - `scorer` string, nullable: The scorer as the CVE page names it: NVD, the CNA by name (such as VulDB (CNA), or CNA (assigner) when the name is not held), CISA-ADP or Red Hat. - `primary` object, nullable: New in 1.8.0. The primary assessment, the one the CVE page gives visual priority, with its scorer and CVSS version beside the number: best, or, when this dataset holds no CVSS v4.0, v3.1 or v3.0 score from any source, a CVSS v2.0 score as a legacy reference (the CNA's, then NVD's), with legacy true. Null when no score is held (the page reads Not scored). - `score` number - `severity` string, nullable - `source` string, nullable: nvd, cna or the ADP's short name. - `scorer` string, nullable: The scorer as the CVE page names it. - `version` string, nullable: 4.0, 3.1, 3.0, or 2.0 when legacy. - `vector` string, nullable - `legacy` boolean: True for a CVSS v2.0 score, which heads the record only when no modern score is held; v2.0 has its own severity cut-points. - `highest_modern` object, nullable: New in 1.8.0. The CVSS v4.0, v3.1 or v3.0 assessment in the highest severity band among every scorer and version held (then the higher score, then NVD, the CNA, CISA ADP), with score, severity, source, scorer, version and vector. Null when no modern score is held. - `has_higher_band_assessment` boolean: New in 1.8.0. True when highest_modern sits in a higher severity band than primary: the CVE page flags it beside the primary, naming its scorer and version. A higher number inside the same band is not flagged. - `scoring_policy` string: New in 1.8.0. The rule behind primary and best: tiered-2026-10b from 1.9.0 (the assigning CNA's score leads only where it makes the product, decided per CVE), tiered-2026-10 before. - `cna_makes_product` boolean, nullable: New in 1.9.0. Whether the assigning CNA makes the product the CVE names, for a CNA the CVE Program lists as a vendor or open-source organization: false when the per-CVE maker check reads the record as a product another organization makes (such as a distribution's record for an upstream package, an extension in a CMS's ecosystem or a scope that reaches third-party research), and its score then ranks after NVD's and CISA ADP's. Null for any other CNA, whose score ranks there too, and when the record does not say. - `cna_name` string, nullable: New in 1.7.0. The assigning CNA's name, from the CVE List record's assignerShortName, which labels the CNA's rows in by_source. Null when the record does not carry it. - `nvd_v2` number, nullable: NVD CVSS v2 (legacy scale, listed but kept out of the v3/v4 severity bands) - `nvd_v2_severity` string, nullable - `epss` number, nullable - `epss_percentile` number, nullable - `by_source` object[]: Per-scorer CVSS rows (NVD, the assigning CNA, CISA-ADP, Red Hat), every version each scorer gave from 1.8.0, each with source, scorer (the label the CVE page prints), score, severity, vector and spec (cvssV4_0, cvssV3_1, cvssV3_0, cvssV2_0). New in 1.7.0: source nvd-secondary marks NVD's copy of a CNA's or an ADP's metric (such a copy is left out when another row already holds the same spec and score), and best adds a row here when the scorer rows this record holds do not yet carry its source, or takes the place of that source's row, without its vector, when the row holds an older score. - `source` string - `scorer` string - `score` number - `severity` string, nullable - `vector` string, nullable - `spec` string - `exploitation` object - `cisa_kev` boolean - `kev_name` string, nullable: The name CISA gives the KEV entry, exactly as CISA writes it. Null outside KEV. - `kev_date` string, nullable - `kev_due_date` string, nullable - `known_ransomware_use` string, nullable - `sightings` object, nullable: Field sightings: a day on which a named sensor network recorded traffic aimed at this CVE. first, last, days_7d, days_30d, sensors[], and per-sensor detail with a 30-day presence strip. Presence per day, without volume; it stays apart from state and claims. Null means this dataset holds no sighting. - `ssvc` object, nullable: CISA SSVC decision points. exploitation 'none' is a dated assessment, not an absence; 'poc' means exploit CODE is public, NOT observed exploitation. - `exploitation` 'none' | 'poc' | 'active' - `automatable` 'yes' | 'no' - `technical_impact` 'partial' | 'total' - `ssvc_timestamp` string, nullable - `vulncheck` object, nullable - `circl` object, nullable - `msrc` object, nullable - `project_zero_itw` object, nullable - `bod_26_04` object: BOD 26-04 (CISA, June 10, 2026): the Table 1 read on both exposure branches from KEV status and CISA's SSVC Automatable and Technical impact, with CISA's own KEV due date, forensic triage flag and the KEV entry's action text. The agency's exposure tag decides the row; the read is a mapping and carries no date beyond CISA's KEV due date. Rows as CERT/CC encodes them (cisa:DT_BOD2604:1.0.0). - `in_kev` boolean - `automatable` 'yes' | 'no' | 'null', nullable: The value the read used; CISA's interim value 'no' when basis is cisa_interim; null when basis is kev_unassessed - `technical_impact` 'total' | 'partial' | 'null', nullable: The value the read used; CISA's interim value 'total' when basis is cisa_interim; null when basis is kev_unassessed - `ssvc_held` boolean: True when both values come from CISA's Vulnrichment assessment of this CVE - `basis` 'cisa_ssvc' | 'cisa_interim' | 'kev_unassessed': Where the values came from: CISA's assessment; CISA's interim values for a CVE outside KEV with no assessment held; or a KEV entry with no values held, which gets no rows - `ssvc_timestamp` string, nullable - `if_exposed` Table1Row: One BOD 26-04 Table 1 row: CISA's row number, the outcome key, the timeline in words, calendar days (null for fix on system upgrade) and whether the row carries forensic triage. - `row` integer - `outcome` '3DF' | '3D' | '14D' | '60D' | 'FSU' - `label` string - `days` integer, nullable - `forensic_triage` boolean - `if_internal` Table1Row: One BOD 26-04 Table 1 row: CISA's row number, the outcome key, the timeline in words, calendar days (null for fix on system upgrade) and whether the row carries forensic triage. - `row` integer - `outcome` '3DF' | '3D' | '14D' | '60D' | 'FSU' - `label` string - `days` integer, nullable - `forensic_triage` boolean - `table_version` string - `kev_date` string, nullable - `kev_due_date` string, nullable: CISA's due date on the KEV entry - `kev_forensic_triage` boolean, nullable: CISA's forensicTriage flag on the KEV entry; null when not listed or not held - `kev_required_action` string, nullable: The KEV entry's action text, CISA's requiredAction field, verbatim - `kev_feed` object, nullable: Which Table 1 branch reproduces CISA's due date and flag pair: both, exposed, internal, or null for neither; pre_directive true means CISA listed the entry before June 10, 2026, and no comparison is made; null overall outside KEV - `due_days` integer, nullable - `triage_flag` boolean, nullable - `matches` 'both' | 'exposed' | 'internal' | 'null', nullable - `pre_directive` boolean - `note` string - `detection` object - `nuclei` boolean - `nuclei_template_id` string, nullable - `metasploit_check` boolean - `emerging_threats` object, nullable: Proofpoint Emerging Threats Open network-IDS rules held for this CVE. rules[] lists up to five of rule_count, each with sid, msg, classtype and severity, plus created (the rule's publish date, ISO) and disabled (true when ET ships the rule disabled by default; those rules still count). first_published and first_sid name the earliest rule written for this CVE; both are absent when an older generic rule also covers it. - `snort` object, nullable - `sigma_log_detection` object, nullable: LOG-HOST layer (SIEM/EDR telemetry); a separate claim from the remote modalities and kept outside scannable coverage - `host_check` object, nullable: HOST tier: a self-contained Nuclei template or a Metasploit local or post module that runs on the system itself ({nuclei: {template_id, path, url, protocol, tags} | null, metasploit: {module} | null}); a separate claim from the remote modalities, kept outside scannable coverage. nuclei and metasploit_check above mean a check that works over the network. - `remediation` object - `affected_versions` object[]: fixed = first patched build; affected_through = the last vulnerable build, so upgrade past it - `vendor_sources` object[] - `products` object: The products the CVE page lists: vendor and product pairs (items), CPE 2.3 names (cpes) and, when this dataset holds them, NVD's configurations whole (configurations). note gives the same reading guidance as these field descriptions, as one string. - `items` object[]: Vendor and product pairs, up to 40; the CVE page lists the first 20. Each carries vendor, vendor_slug, vendor_url, product, product_slug and product_url. For the CNA's affected and fixed builds, read remediation.affected_versions. - `vendor` string - `vendor_slug` string - `vendor_url` string - `product` string - `product_slug` string - `product_url` string - `items_source` 'nvd' | 'cna' | 'null', nullable: nvd: the pairs come from the CPE names our NVD ingest stores for the CVE; where the list also names an application from a vendor other than a Linux distributor, this dataset reads an unversioned Windows, macOS, Linux kernel, AIX, Solaris or HP-UX entry as the platform the application runs on and leaves it out; versioned entries such as Windows 10, other platforms and hardware stay, so a pair can name what a vulnerable product runs on. cna: the pairs come from the products the assigning CNA lists in its CVE record, which this dataset shows until it holds NVD's CPE names for the CVE. Null when items is empty. - `items_may_be_incomplete` boolean: True when items holds 40 pairs, the record's cap, or when items_source is nvd and the CPE name list our NVD ingest stores for the CVE holds 25 names, the length it keeps, because those pairs come from that list. - `cpes` string[]: CPE 2.3 names, verbatim; cpes_source says where they come from. nvd_configurations: the distinct names of the configurations held, in NVD's order; configurations gives each entry's role and NVD's version bounds. nvd_cpe_list: the names our NVD ingest stores, in sort order. NVD's configurations name the vulnerable products and the platforms or hardware they run on, and this list keeps both, so read an entry as a product the configuration names. A version of * matches any version; NVD may narrow it with version bounds in its configuration data, which this list leaves out. Our NVD ingest keeps the first 25 names in sort order, which puts application names ahead of hardware names and hardware ahead of operating system and firmware names, so a list cut there can leave out every operating system and firmware name NVD's configurations hold. Parse the names with a CPE 2.3 library, because the formatted string escapes colons. - `cpes_source` 'nvd_configurations' | 'nvd_cpe_list' | 'null', nullable: nvd_configurations: this dataset holds NVD's configurations for the CVE whole, and cpes and configurations come from them. nvd_cpe_list: cpes holds the CPE names our NVD ingest stores, the first 25 in sort order, and configurations is null. Null when cpes is empty and configurations is null. - `cpes_may_be_incomplete` boolean: With cpes_source nvd_configurations, true when configurations holds fewer matches than NVD lists (the cap, or a read that stopped short). With nvd_cpe_list, true when cpes holds 25 names, the length our NVD ingest keeps; NVD's configurations may name more, operating system and firmware names first among them. - `configurations` object[], nullable: NVD's configurations for the CVE as NVD writes them, in NVD's order, when cpes_source is nvd_configurations; null with nvd_cpe_list. Each configuration and each node keeps NVD's operator (AND or OR) and negate flag; an AND configuration holds when all of its nodes match, so a vulnerable firmware and the hardware it runs on read as one combination. Each match carries NVD's vulnerable flag: true marks a product NVD lists as vulnerable, and false marks a platform or hardware the vulnerable product runs on. Each match keeps NVD's version bounds verbatim, under NVD's names in snake case (version_start_including, version_start_excluding, version_end_including and version_end_excluding), and a version of * in a name matches any version the bounds allow. An end bound marks where NVD's range stops; the fixed versions this dataset holds are in remediation. A bound NVD leaves out is left out of the match. - `operator` 'AND' | 'OR' | 'null', nullable - `negate` boolean - `nodes` object[] - `operator` 'AND' | 'OR' | 'null', nullable - `negate` boolean - `matches` object[] - `criteria` string - `vulnerable` boolean - `version_start_including` string - `version_start_excluding` string - `version_end_including` string - `version_end_excluding` string - `configurations_match_count` integer, nullable: Every match NVD lists for the CVE, counted across all of its configurations; configurations holds up to 500 of them (MCP get_cve: 100 by default). Null when configurations is null. - `configurations_may_be_incomplete` boolean, nullable: True when configurations holds fewer matches than configurations_match_count. configurations holds NVD's configurations in NVD's order up to 500 matches (MCP get_cve: 100 by default, configurations_cap to 500); a configuration that would pass the cap keeps its AND nodes, its negated nodes and the nodes of a negated configuration whole, keeps the first matches of its other nodes and is the last one held, and one that cannot fit that way is left out. Null when configurations is null. - `note` string: Reading guidance for items, cpes and configurations as one string: where each comes from and where it stops. - `oss_packages` object, nullable: OSV.dev open-source package mapping (CVE-linked, GitHub-reviewed; CC-BY-4.0) - `coverage` object - `news` object, nullable - `community` object, nullable - `attack` object - `techniques` object[]: MITRE ATT&CK techniques with source confidence (observed > exploit > detection > capability > weakness): observed is a MITRE CTID mapping from published exploitation with observed_role; exploit a Metasploit module tag; detection a detection-rule tag; capability based on exploit-capability analysis by the CVE Security intelligence team (what an exploit of the CVE needs and gains, crosswalked to techniques), with capability_role (exploitation or impact); weakness the CWE to CAPEC to ATT&CK chain. A derived association with the record; observed is the only source that reports use - `malware` object[]: Malware families, tools, campaigns and ransomware groups a published source ties to this CVE (MITRE ATT&CK relationship text; Ransomware Vulnerability Matrix rows verified against their cited page); each row carries name, type, note (affiliate, initial-access broker, state actor), source, source_url and the quoted sentence or table row. An empty array means this dataset holds no such row. - `papers` object, nullable: Academic papers that name this CVE: n (the total) and items[] (up to eight: title, venue, year, type peer|preprint, work_type, authors, n_authors, url, arxiv, oa, cited, match title|abstract|fulltext, via openalex|semantic_scholar, chains[] the partner CVEs the paper's own sentence names in chaining language, summary). OpenAlex metadata (CC0); via semantic_scholar credits Semantic Scholar; titles and links only. Null means this dataset holds no such paper. - `chains` object: Exploit chains. known[]: pairs a cited source reports were used together in one exploit chain; each entry carries partner_cve_id, partner_url, claim_kind (observed: the source reports attacks; potential: the source reports they can be chained), evidence[] with source, source_label, source_url, date and the quoted sentence, the sources that report an attack listed first with observed_basis and support, code_summary on a row of exploit code, and discussed (community threads naming both CVEs, which shows discussion and is not a chain claim). candidates[]: KCV Watch chain candidates, possible chains for teams to research: pairs whose extracted exploit capabilities connect or whose records tie them together, each with partner_cve_id, tier and tier_rule (the estimated rate at which pairs with these signals are possible chains), lane and reasons (how the pair was admitted and the record facts behind it), basis, exploited_count and kev_count (how many of the two CVEs carry an exploitation report or field sighting, and how many CISA lists), product (the platform the pair shares, with its page; null when cross_product is true), bridge and grade, entry_cve with entry_reach where a handoff is extracted (network, authenticated, adjacent, victim or local; a local entry means a prior step could supply the access) and a one-sentence explanation, derived from exploit-capability analysis by the CVE Security intelligence team; a candidate is not a confirmed chain. An empty known list means this dataset holds no such row. - `intelligence_summary` string, nullable - `intelligence_summary_updated` string, nullable - `cwes` object[] - `other_databases` object[]: Records of this CVE in other vulnerability databases: ENISA's EU Vulnerability Database (euvd), BDU of Russia's Federal Service for Technical and Export Control (bdu), the China National Vulnerability Database run by CNCERT/CC (cnvd) and JVN iPedia of Japan's JPCERT/CC and IPA (jvndb), three records a database at most. Each entry carries database, label, database_name, id, url (the address the page's link opens), source_url (the record's page at the database), circl_url (the record as CIRCL Vulnerability-Lookup serves it, null for euvd), published (the day the database published its record, where held) and basis: mapping (ENISA's own mapping of CVE ids to EUVD ids), cited (this CVE's references cite the record's page or, for JVN iPedia, the JVN advisory the record carries), single (the record names this CVE alone and a product this CVE's record names) or advisory (the record names two to 10 CVE ids and a product this CVE's record names). The bdu, cnvd and jvndb ids were read through CIRCL Vulnerability-Lookup. An empty array means this dataset holds no tied record. The database may still hold one. - `references` object[]: References from the CVE record, one entry per URL, merged from NVD, the assigning CNA and the CVE Program's authorized data publishers: url, tags (one spelling per tag across the NVD and CVE List vocabularies), tagged_by (nvd, cna, adp: the sources that supplied a tag) and name when the CNA gave the reference one. Records exported before Sept. 26, 2026 carry one source's copy and no tagged_by. - `_meta` object - `source` string - `attribution` string - `enrichment_updated` string, nullable - `absence_semantics` string ## Other responses - `400`: Malformed CVE id - `401`: Missing or invalid key - `403`: Account suspended - `404`: CVE not in the catalog - `410`: Identifier withdrawn by MITRE, it does not name a vulnerability - `429`: Daily limit exhausted (resets 00:00 UTC) - `503`: Temporary datastore error, the key is fine, retry shortly --- [API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)