Search the CVE catalog with structured filters (keyless)

Free text or a CVE id. Optional when at least one filter is present.

Vendor slug (see /api/entities)

MITRE ATT&CK technique id, CVEs whose weakness classes map to it (see /attack)

Publication year(s), comma-separated

Severity band(s), comma-separated: critical|high|medium|low|none

In CISA KEV

Inclusive lower bound on the CISA KEV listing date (YYYY-MM-DD). Implies kev=1 unless kev is given explicitly.

Exclusive upper bound on the CISA KEV listing date (YYYY-MM-DD): the window is [kev_from, kev_to).

CISA's vendorProject for the KEV entry, verbatim and case-sensitive. A different axis from vendor (our CPE/CNA vendor slug).

CISA known-ransomware-campaign flag

Detection content we track (1) / none we track (0)

Actionable vendor fix held (1) / computed-and-none-held (0)

CISA SSVC Automatable: 1 = yes, 0 = CISA assessed no. A CVE with no CISA assessment held matches neither value.

CISA SSVC Technical impact, for CVEs with a CISA assessment held.

CISA's forensic triage flag on the KEV entry (BOD 26-04, the catalog's forensicTriage field): 1 = Yes, 0 = No. Both values select KEV entries; a CVE outside KEV carries no flag.

Whether this dataset holds a CISA SSVC assessment (Automatable and Technical impact) for the CVE: 1 = held, 0 = no assessment held, the set where CISA's interim values apply outside KEV.

BOD 26-04 Table 1 read at the stated exposure (see exposed): the outcome key Table 1 gives the row's KEV status and CISA's two SSVC values. 3df = three days and forensic triage, 3d = three days, 14d = 14 days, 60d = 60 days, fsu = fix on system upgrade. A mapping at that exposure; an agency's timeline for an asset also needs its own enumeration date. A KEV entry with no CISA values held matches no key; a CVE outside KEV with a value missing reads on CISA's interim value for it (Automatable no, Technical impact total). The per-CVE read is the bod_26_04 object on /api/cve/{id}.

The exposure branch for bod: 1 = publicly exposed (the default when bod is set), 0 = internal. Ignored without bod.

OSS ecosystem by its OSV name (npm, PyPI, Maven, Go, crates.io and so on), joined through the package mapping. For version ranges use /api/package.

Package key, ecosystem/name (such as npm/lodash or maven/org.apache.logging.log4j:log4j-core), joined through the package mapping.

Field sighting window in days: a named sensor network (Shadowserver honeypots per VulnCheck KEV, VulnCheck canary sensors) recorded the CVE within the last 7 or 30 days. Presence per day, apart from the exploitation claims.

Malware claim: a published source (MITRE ATT&CK, or a Ransomware Vulnerability Matrix row verified against its cited page) ties a named malware family, tool, campaign or ransomware group to the CVE.

KEV Watch: on the watch list at tier 1 or 2, reported as exploited by trackers other than CISA (VulnCheck KEV, Microsoft, Google Project Zero, ENISA, CIRCL, FortiGuard) while outside CISA KEV. Mirrors /kev-watch.

1: in a known exploit chain (a cited source reports the CVE was used together with another CVE in one exploit chain); 0: no known chain in our sources.

1: on KCV Watch™, the CVE carries at least one chain candidate at tier A or B (a pair whose extracted exploit capabilities connect or whose records tie the two CVEs together); 0: no such candidate we hold. A candidate is not a confirmed chain.

Filter-only mode: page through the slice