---
title: "CVE Vulnerability Lookup"
method: POST
path: "/v1/tools/vulnerability_lookup"
---

# CVE Vulnerability Lookup

`POST /v1/tools/vulnerability_lookup`

## Request

- Base URL: `https://unstuckapi.com`
- URL: `https://unstuckapi.com/v1/tools/vulnerability_lookup`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Look up a security vulnerability by CVE id, or search CVEs by keyword (product, library, attack; newest first): description, CVSS score and severity, published and modified dates, affected vendors/products, CWE weaknesses, known-exploited flag and reference links. Data source: NVD. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Price: $0.002 per call. Charged once per call that returns a result, including an empty result list. Failed calls are free.

## Request body

- object
  - `cve_id` string: Exact CVE id, e.g. "CVE-2021-44228". Give this or keyword.
  - `keyword` string: Words to search CVE descriptions for, e.g. "log4j remote code execution".
  - `limit` integer: Max results for a keyword search. Default 5, max 10.

## Response `200`

Success

- object
  - `tool` 'vulnerability_lookup', required
  - `result` object, required
    - `source` 'NVD', required
    - `notice` 'This product uses data from the NVD API but is not endorsed or certified by the NVD.', required
    - `total_results` integer, required: Total matches in NVD (keyword searches may have more than returned).
    - `order` 'exact_match' | 'newest_first' | 'oldest_first', required: Keyword results are newest first unless NVD's rate limit forced the oldest page.
    - `results` object[], required
      - `cve_id` string, required
      - `description` string, nullable, required
      - `cvss_score` number, nullable, required: Base score 0-10 (newest CVSS version available).
      - `severity` string, nullable, required: CRITICAL, HIGH, MEDIUM, LOW or NONE.
      - `cvss_version` string, nullable, required
      - `cvss_vector` string, nullable, required
      - `published` string, nullable, required
      - `last_modified` string, nullable, required
      - `status` string, nullable, required: NVD analysis status, e.g. "Analyzed".
      - `known_exploited` boolean, required: Listed in CISA's Known Exploited Vulnerabilities catalog.
      - `weaknesses` string[], required: CWE ids, e.g. "CWE-502".
      - `affected_products` string[], required: Vulnerable "vendor:product" pairs from the CPE configurations, applications first (up to 25).
      - `affected_products_total` integer, required
      - `references` object[], required: Up to 15 reference links.
        - `url` string, required
        - `tags` string[], required
      - `nvd_url` string, required
  - `charged_usd` number, required
  - `balance_usd` number, required

## Other responses

- `400`: Invalid JSON or input. Not charged.
- `401`: Paid tool without a valid API key.
- `402`: Balance too low for this call. Not charged.
- `404`: Unknown tool.
- `422`: The tool failed. Not charged.
- `429`: Rate limited, free tries used up, or the uncharged-result limit reached. See Retry-After.

---

[API](https://skmtc.dev/unstuckapi/apis/unstuck-api.md) · [All operations](https://skmtc.dev/unstuckapi/apis/unstuck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/unstuckapi/apis/unstuck-api/revisions/ef3ec951224f?raw)