CERT/CC Vulnerability Notes API

openapi: 3.0.3
info:
  title: CERT/CC Vulnerability Notes API
  version: '1.0'
  description: >-
    Public, unauthenticated read API for the CERT Coordination Center's Vulnerability Notes
    database, operated by the CERT Division of the Software Engineering Institute at Carnegie
    Mellon University. Each Vulnerability Note (VU#nnnnnn) is the published result of a
    coordinated vulnerability disclosure case: overview, impact, resolution, affected systems,
    CVSS metrics, the CVE identifiers rolled into the case, and the per-vendor status statements
    CERT/CC collected during coordination. This is one of the very few genuinely
    institution-engineered public APIs in the higher-education cohort — it is not a repository
    platform, not a library discovery layer, and not a vendor tenancy. CMU publishes no OpenAPI
    for it; this document was derived from live probes.
  termsOfService: https://www.sei.cmu.edu/legal/
  contact:
    name: CERT Coordination Center — Software Engineering Institute, Carnegie Mellon University
    email: cert@cert.org
    url: https://www.sei.cmu.edu/divisions/cert/
  x-operator: institution
  x-operator-evidence: >-
    kb.cert.org is not a cmu.edu host, so the cohort audit could not see it — but cert.org is
    Carnegie Mellon University's. https://www.cert.org/ 301-redirects to
    https://www.sei.cmu.edu/divisions/cert/, and the API's sibling Atom feed at
    https://kb.cert.org/vuls/atomfeed/ declares <author><name>CERT</name>
    <email>cert@cert.org</email><uri>https://www.sei.cmu.edu</uri></author>. The CERT Division is
    a division of the Software Engineering Institute, a federally funded research and development
    center operated BY Carnegie Mellon University. The documentation hub certcc.github.io links
    only to sei.cmu.edu legal and privacy notices. Probed 2026-08-19: /vuls/api/421644/ 200
    application/json (real Vulnerability Note payload, 8,263 bytes); /vuls/api/421644/vuls/ 200
    (10 CVE records); /vuls/api/421644/vendors/ 200 (123 vendor statement records);
    /vuls/atomfeed/ 200 application/atom+xml.
  x-provenance:
    generated: '2026-08-19'
    method: derived
    source: >-
      Live probes of https://kb.cert.org/vuls/api/ on 2026-08-19 against three real Vulnerability
      Notes (VU#421644, VU#257161, VU#730793), with payloads captured into examples/.
    authorship: >-
      Written by API Evangelist, not published by Carnegie Mellon University. No OpenAPI, Swagger
      or schema document is served for this API: /vuls/api/, /vuls/api/docs/ and /vuls/api/summary/
      all return the API's generic JSON error object, and www.kb.cert.org/vuls/api returns 404.
    coverage: >-
      Three path templates and one feed are modelled — every path confirmed to return a real
      payload. Paths that returned only the catch-all error object
      ({"error":"Content requested either does not exist or you do not have permissions to view
      it!"}) are deliberately excluded rather than guessed at, and are recorded in errors/.
servers:
- url: https://kb.cert.org
  description: Production — CERT/CC Vulnerability Notes, operated by CMU SEI
tags:
- name: notes
  description: Vulnerability Notes.
- name: vendors
  description: Per-vendor coordination status.
- name: feeds
  description: Syndication.
paths:
  /vuls/api/{idnumber}/:
    get:
      tags: [notes]
      operationId: getVulnerabilityNote
      summary: Get a Vulnerability Note by its VU number
      description: >-
        Returns the full Vulnerability Note record for the given VU number (the numeric part of
        VU#nnnnnn, no hash). Unknown or unpublished identifiers return HTTP 200 with a JSON
        error object, not a 404.
      parameters:
      - name: idnumber
        in: path
        required: true
        description: Numeric Vulnerability Note identifier, e.g. 421644 for VU#421644.
        schema: {type: string, pattern: '^[0-9]{6}$'}
        example: '421644'
      responses:
        '200':
          description: The Vulnerability Note, or the generic error object if not found.
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/VulnerabilityNote'
                - $ref: '#/components/schemas/Error'
              examples:
                note:
                  $ref: '#/components/examples/VulnerabilityNoteExample'
                notFound:
                  $ref: '#/components/examples/ErrorExample'
  /vuls/api/{idnumber}/vuls/:
    get:
      tags: [notes]
      operationId: listNoteVulnerabilities
      summary: List the CVE records rolled into a Vulnerability Note
      description: >-
        Returns the individual vulnerabilities (CVE identifiers with descriptions) that the
        named coordination case covers. A single Vulnerability Note routinely covers several CVEs.
      parameters:
      - name: idnumber
        in: path
        required: true
        schema: {type: string, pattern: '^[0-9]{6}$'}
        example: '421644'
      responses:
        '200':
          description: Array of CVE records.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/NoteVulnerability'
              example:
              - note: '421644'
                cve: '2024-27268'
                description: IBM WebSphere Application Server Liberty is vulnerable to a denial of service.
                case_increment: 1
                date_added: '2024-04-03T17:15:19Z'
  /vuls/api/{idnumber}/vendors/:
    get:
      tags: [vendors]
      operationId: listNoteVendors
      summary: List vendor coordination statements for a Vulnerability Note
      description: >-
        Returns every vendor CERT/CC contacted during coordination of the case, when they were
        contacted, their published statement (if any) and when it was last updated. This is the
        machine-readable form of the coordinated-disclosure record and is the part of the API
        with no equivalent anywhere else.
      parameters:
      - name: idnumber
        in: path
        required: true
        schema: {type: string, pattern: '^[0-9]{6}$'}
        example: '421644'
      responses:
        '200':
          description: Array of vendor records (123 for VU#421644 when probed 2026-08-19).
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/VendorStatement'
              example:
              - note: '421644'
                contact_date: '2024-02-19T15:21:17.589549Z'
                vendor: Yahoo Inc.
                references: null
                statement: null
                dateupdated: '2024-04-03T17:15:19.803945Z'
                statement_date: null
                addendum: null
  /vuls/atomfeed/:
    get:
      tags: [feeds]
      operationId: getVulnerabilityNotesFeed
      summary: Atom feed of recently published Vulnerability Notes
      description: >-
        Atom 1.0 feed titled "CERT Recently Published Vulnerability Notes". Each entry links to
        the human note at /vuls/id/{idnumber}, from which the API path is derivable. The feed's
        author block is the operator evidence for this whole API.
      responses:
        '200':
          description: Atom 1.0 document.
          content:
            application/atom+xml:
              schema: {type: string}
components:
  schemas:
    VulnerabilityNote:
      type: object
      description: A CERT/CC Vulnerability Note. Field names are the API's own, verbatim.
      properties:
        vuid: {type: string, example: 'VU#421644'}
        idnumber: {type: string, example: '421644'}
        name: {type: string, example: HTTP/2 CONTINUATION frames can be utilized for DoS attacks}
        keywords: {type: string, nullable: true}
        overview: {type: string, description: Markdown overview of the vulnerability.}
        clean_desc: {type: string, nullable: true}
        impact: {type: string}
        resolution: {type: string}
        workarounds: {type: string, nullable: true}
        sysaffected: {type: string, nullable: true, description: Affected systems.}
        thanks: {type: string, nullable: true, description: Credit to the reporter.}
        author: {type: string, nullable: true}
        public: {type: array, items: {type: string}, description: Public references.}
        cveids: {type: array, items: {type: string}}
        certadvisory: {type: string, nullable: true}
        uscerttechnicalalert: {type: string, nullable: true}
        datecreated: {type: string, format: date-time}
        publicdate: {type: string, format: date-time}
        datefirstpublished: {type: string, format: date-time}
        dateupdated: {type: string, format: date-time}
        revision: {type: integer}
        ipprotocol: {type: string, nullable: true}
        metric: {type: number, nullable: true}
        vulnote: {type: string, nullable: true}
        vrda_d1_directreport: {type: string, nullable: true}
        vrda_d1_population: {type: string, nullable: true}
        vrda_d1_impact: {type: string, nullable: true}
        cam_widelyknown: {type: string, nullable: true}
        cam_exploitation: {type: string, nullable: true}
        cam_internetinfrastructure: {type: string, nullable: true}
        cam_population: {type: string, nullable: true}
        cam_impact: {type: string, nullable: true}
        cam_easeofexploitation: {type: string, nullable: true}
        cam_attackeraccessrequired: {type: string, nullable: true}
        cam_scorecurrent: {type: number, nullable: true}
        cam_scorecurrentwidelyknown: {type: number, nullable: true}
        cam_scorecurrentwidelyknownexploited: {type: number, nullable: true}
        cvss_accessvector: {type: string, nullable: true}
        cvss_accesscomplexity: {type: string, nullable: true}
        cvss_authentication: {type: string, nullable: true}
        cvss_confidentialityimpact: {type: string, nullable: true}
        cvss_integrityimpact: {type: string, nullable: true}
        cvss_availabilityimpact: {type: string, nullable: true}
        cvss_exploitablity: {type: string, nullable: true, description: Spelled this way by the API.}
        cvss_remediationlevel: {type: string, nullable: true}
        cvss_reportconfidence: {type: string, nullable: true}
        cvss_collateraldamagepotential: {type: string, nullable: true}
        cvss_targetdistribution: {type: string, nullable: true}
        cvss_securityrequirementscr: {type: string, nullable: true}
        cvss_securityrequirementsir: {type: string, nullable: true}
        cvss_securityrequirementsar: {type: string, nullable: true}
        cvss_basescore: {type: number, nullable: true}
        cvss_basevector: {type: string, nullable: true}
        cvss_temporalscore: {type: number, nullable: true}
        cvss_environmentalscore: {type: number, nullable: true}
        cvss_environmentalvector: {type: string, nullable: true}
    NoteVulnerability:
      type: object
      properties:
        note: {type: string}
        cve: {type: string, description: 'CVE identifier WITHOUT the "CVE-" prefix, e.g. 2024-27268.'}
        description: {type: string}
        uid: {type: string, nullable: true}
        case_increment: {type: integer, nullable: true}
        date_added: {type: string, format: date-time, nullable: true}
        dateupdated: {type: string, format: date-time, nullable: true}
    VendorStatement:
      type: object
      properties:
        note: {type: string}
        contact_date: {type: string, format: date-time, nullable: true}
        vendor: {type: string}
        references: {type: string, nullable: true}
        statement: {type: string, nullable: true}
        dateupdated: {type: string, format: date-time, nullable: true}
        statement_date: {type: string, format: date-time, nullable: true}
        addendum: {type: string, nullable: true}
    Error:
      type: object
      description: >-
        The API's single, undifferentiated error object. It is returned with HTTP 200 for a
        valid-shaped but unknown identifier, and it does not distinguish "not found" from
        "not permitted".
      properties:
        error: {type: string}
  examples:
    VulnerabilityNoteExample:
      summary: VU#421644 (probed 2026-08-19)
      value:
        vuid: 'VU#421644'
        idnumber: '421644'
        name: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
        keywords: null
    ErrorExample:
      summary: Unknown identifier, returned with HTTP 200 (probed 2026-08-19)
      value:
        error: Content requested either does not exist or you do not have permissions to view it!