---
title: "CVE lookup, search and recent list"
method: GET
path: "/cve"
tags: ["cve"]
---

# CVE lookup, search and recent list

`GET /cve`

One path, three shapes, chosen by the query string:

- `id=CVE-…` — one catalog document (PostgreSQL `CveCatalog`): `id`,
  `description`, `severity`, `cvssScore`, `cvssVector`, `published`,
  `lastModified`, `title`, `epssScore`, `epssPercent` (0–100), `isKev`,
  `kev{listed, dateAdded, dueDate, requiredAction, ransomwareUse,
  shortDescription}`, `ssvcExploitation`, `zdcIsWeaponized`,
  `zdcIsZeroDay`, `zdcExploitCount`, `msrcExploited`, `hasNucleiTemplate`,
  `exploitdbIds`, `ghsaIds`, `certfrLink`, `vendorAdvisoryId`,
  `vendorAdvisoryLink`, `references[{source, url}]`,
  `affectedPackages[]`, `vendorAdvisories[]`. Legacy aliases `summary`,
  `publishedDate`, `lastModifiedDate`, `opencveTitle` are kept. 400 when
  the id is malformed, 404 when the catalog has no entry.
- `recent=true` — `{"count", "days", "cves": […]}`, newest first, from
  the Redis `cve:recent` list with a catalog fallback when it is empty.
- otherwise — `{"query", "severity" ("ALL" when unset), "count",
  "cves": […]}`; `query` searches Redis `cve:search:{query}` then the
  catalog (ILIKE on id, title, description); without `query` it is the
  recent list in this envelope.

Items in `cves` carry `id`/`cveId`, `description`, `summary`, `severity`,
`cvssScore`, `cvssVector`, `published`, `lastModified` (each also under
its legacy alias) and, from the Redis lists, whatever the ingest stored.
Costs one request of the monthly quota.

## Query parameters

- `query` string
- `limit` integer
- `id` string
- `recent` string
- `days` integer
- `severity` string

## Response `200`

A catalog document (`id=`), `{count, days, cves}` (`recent=true`) or `{query, severity, count, cves}` — see the operation description for the keys

- object

## Other responses

- `400` — `id` is not of the form `CVE-YYYY-NNNNN`
- `401` — Unauthorized - Missing or invalid API key
- `404` — `id` set and no catalog entry for it
- `429` — Too many requests - Rate limit exceeded
- `500` — Database error on the `id=` branch (the list branches degrade to an empty `cves` instead)

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)