---
title: "Bulk CVE Lookup"
method: POST
path: "/v3/cves"
tags: ["CVE"]
---

# Bulk CVE Lookup

`POST /v3/cves`

Retrieve information about multiple CVEs in a single request. Supports up to 10,000 CVEs per request.

This endpoint requires a business email address and appropriate entitlements.
Response type depends on user entitlements (minimal, basic, or advanced).

## Request body

- object
  - `cves` string[], required — Array of CVE IDs to lookup

## Response `200`

OK - request successful.

- union[]
  - union
    - CVEAdvancedResponse
      - `id` string — The CVE identifier.
      - `details` CVEDetails
        - `vulnerability_name` string — The name of the vulnerability.
        - `vulnerability_description` string — Description of the vulnerability.
        - `cve_cvss_score` number — The CVSS score of the CVE.
        - `product` string — The product affected by the vulnerability.
        - `vendor` string — The vendor of the affected product.
        - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.
      - `timeline` CVETimeline
        - `cve_published_date` string, date — The date the CVE was published.
        - `cve_last_updated_date` string, date — The date the CVE was last updated.
        - `first_known_published_date` string, date — The first known published date of the CVE.
        - `cisa_kev_date_added` string, date — The date the CVE was added to the CISA KEV list.
      - `exploitation_details` CVEExploitationDetails
        - `attack_vector` string — The attack vector for the CVE.
        - `exploit_found` boolean — Whether an exploit has been found for this CVE.
        - `exploitation_registered_in_kev` boolean — Whether the exploitation is registered in KEV.
        - `epss_score` number — The EPSS score for the CVE.
      - `exploitation_stats` CVEExploitationStats
        - `number_of_available_exploits` integer — The number of available exploits for the CVE.
        - `number_of_threat_actors_exploiting_vulnerability` integer — The number of threat actors exploiting the vulnerability.
        - `number_of_botnets_exploiting_vulnerability` integer — The number of botnets exploiting the vulnerability.
      - `exploitation_activity` CVEExploitationActivity
        - `activity_seen` boolean — Whether exploitation activity has been observed.
        - `benign_ip_count_1d` integer — The count of benign IPs in the last day.
        - `benign_ip_count_10d` integer — The count of benign IPs in the last 10 days.
        - `benign_ip_count_30d` integer — The count of benign IPs in the last 30 days.
        - `threat_ip_count_1d` integer — The count of threat IPs in the last day.
        - `threat_ip_count_10d` integer — The count of threat IPs in the last 10 days.
        - `threat_ip_count_30d` integer — The count of threat IPs in the last 30 days.
    - CVEBasicResponse
      - `id` string — The CVE identifier.
      - `details` CVEDetails
        - `vulnerability_name` string — The name of the vulnerability.
        - `vulnerability_description` string — Description of the vulnerability.
        - `cve_cvss_score` number — The CVSS score of the CVE.
        - `product` string — The product affected by the vulnerability.
        - `vendor` string — The vendor of the affected product.
        - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.
      - `timeline` CVETimeline
        - `cve_published_date` string, date — The date the CVE was published.
        - `cve_last_updated_date` string, date — The date the CVE was last updated.
        - `first_known_published_date` string, date — The first known published date of the CVE.
        - `cisa_kev_date_added` string, date — The date the CVE was added to the CISA KEV list.
      - `exploitation_details` CVEExploitationDetails
        - `attack_vector` string — The attack vector for the CVE.
        - `exploit_found` boolean — Whether an exploit has been found for this CVE.
        - `exploitation_registered_in_kev` boolean — Whether the exploitation is registered in KEV.
        - `epss_score` number — The EPSS score for the CVE.
    - CVEMinimalResponse
      - `id` string — The CVE identifier.
      - `details` CVEDetails
        - `vulnerability_name` string — The name of the vulnerability.
        - `vulnerability_description` string — Description of the vulnerability.
        - `cve_cvss_score` number — The CVSS score of the CVE.
        - `product` string — The product affected by the vulnerability.
        - `vendor` string — The vendor of the affected product.
        - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.

## Other responses

- `400` — Bad request - invalid CVE format or too many CVEs requested.
- `403` — Forbidden - bulk CVE search requires a business email address.
- `429` — Too many requests. You've hit the rate-limit.
- `500` — Unexpected error

---

[API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)