CVE Security Search API

openapi: 3.2.0
info:
  title: Cve Security Com Search API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Search across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Search
paths:
  /api/search:
    get:
      operationId: searchCves
      summary: Search the CVE catalog with structured filters (keyless)
      description: 'Three modes. (1) q shaped like a CVE id → exact:true with one row, filters ignored (filters_ignored:true is set). (2) q + filters → full-text rank restricted to the filtered set. (3) Filters only, no q → the /browse slice as JSON, ordered KEV-first then EPSS/CVSS, with `page` and `has_more`. Filter semantics: fix=0 means ''computed, and no fix held'', rows not yet computed are excluded from both fix=1 and fix=0 (absence semantics). detect covers the four DETECTION-CONTENT engines (Nuclei, Metasploit check, Emerging Threats, Snort), not exploit code. Per-IP rate limited (30/min).'
      parameters:
      - name: q
        in: query
        required: false
        schema:
          type: string
        example: citrix bleed
        description: Free text or a CVE id. Optional when at least one filter is present.
      - name: vendor
        in: query
        schema:
          type: string
        example: microsoft
        description: Vendor slug (see /api/entities)
      - name: cwe
        in: query
        schema:
          type: string
          pattern: ^CWE-\d{1,5}$
        example: CWE-502
      - name: technique
        in: query
        schema:
          type: string
          pattern: ^T\d{4}(\.\d{3})?$
        example: T1190
        description: MITRE ATT&CK technique id, CVEs whose weakness classes map to it (see /attack)
      - name: year
        in: query
        schema:
          type: string
        example: 2024,2025
        description: Publication year(s), comma-separated
      - name: sev
        in: query
        schema:
          type: string
        example: critical,high
        description: 'Severity band(s), comma-separated: critical|high|medium|low|none'
      - name: kev
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: In CISA KEV
      - name: kev_from
        in: query
        schema:
          type: string
          format: date
        example: '2026-03-01'
        description: Inclusive lower bound on the CISA KEV listing date (YYYY-MM-DD). Implies kev=1 unless kev is given explicitly.
      - name: kev_to
        in: query
        schema:
          type: string
          format: date
        example: '2026-04-01'
        description: 'Exclusive upper bound on the CISA KEV listing date (YYYY-MM-DD): the window is [kev_from, kev_to).'
      - name: kev_vendor
        in: query
        schema:
          type: string
          maxLength: 80
        example: Palo Alto Networks
        description: CISA's vendorProject for the KEV entry, verbatim and case-sensitive. A different axis from `vendor` (our CPE/CNA vendor slug).
      - name: ransomware
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: CISA known-ransomware-campaign flag
      - name: detect
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: Detection content we track (1) / none we track (0)
      - name: fix
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: Actionable vendor fix held (1) / computed-and-none-held (0)
      - name: automatable
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'CISA SSVC Automatable: 1 = yes, 0 = CISA assessed no. A CVE with no CISA assessment held matches neither value.'
      - name: ti
        in: query
        schema:
          type: string
          enum:
          - total
          - partial
        description: CISA SSVC Technical impact, for CVEs with a CISA assessment held.
      - name: triage_flag
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'CISA''s forensic triage flag on the KEV entry (BOD 26-04, the catalog''s forensicTriage field): 1 = Yes, 0 = No. Both values select KEV entries; a CVE outside KEV carries no flag.'
      - name: ssvc
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'Whether this dataset holds a CISA SSVC assessment (Automatable and Technical impact) for the CVE: 1 = held, 0 = no assessment held, the set where CISA''s interim values apply outside KEV.'
      - name: bod
        in: query
        schema:
          type: string
          enum:
          - 3df
          - 3d
          - 14d
          - 60d
          - fsu
        description: 'BOD 26-04 Table 1 read at the stated exposure (see exposed): the outcome key Table 1 gives the row''s KEV status and CISA''s two SSVC values. 3df = three days and forensic triage, 3d = three days, 14d = 14 days, 60d = 60 days, fsu = fix on system upgrade. A mapping at that exposure; an agency''s timeline for an asset also needs its own enumeration date. A KEV entry with no CISA values held matches no key; a CVE outside KEV with a value missing reads on CISA''s interim value for it (Automatable no, Technical impact total). The per-CVE read is the bod_26_04 object on /api/cve/{id}.'
      - name: exposed
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'The exposure branch for bod: 1 = publicly exposed (the default when bod is set), 0 = internal. Ignored without bod.'
      - name: eco
        in: query
        schema:
          type: string
        example: npm
        description: OSS ecosystem by its OSV name (npm, PyPI, Maven, Go, crates.io and so on), joined through the package mapping. For version ranges use /api/package.
      - name: pkg
        in: query
        schema:
          type: string
        example: npm/lodash
        description: Package key, ecosystem/name (such as npm/lodash or maven/org.apache.logging.log4j:log4j-core), joined through the package mapping.
      - name: sighted
        in: query
        schema:
          type: string
          enum:
          - '7'
          - '30'
        description: 'Field sighting window in days: a named sensor network (Shadowserver honeypots per VulnCheck KEV, VulnCheck canary sensors) recorded the CVE within the last 7 or 30 days. Presence per day, apart from the exploitation claims.'
      - name: malware
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'Malware claim: a published source (MITRE ATT&CK, or a Ransomware Vulnerability Matrix row verified against its cited page) ties a named malware family, tool, campaign or ransomware group to the CVE.'
      - name: watch
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: 'KEV Watch: on the watch list at tier 1 or 2, reported as exploited by trackers other than CISA (VulnCheck KEV, Microsoft, Google Project Zero, ENISA, CIRCL, FortiGuard) while outside CISA KEV. Mirrors /kev-watch.'
      - name: chained
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: '1: in a known exploit chain (a cited source reports the CVE was used together with another CVE in one exploit chain); 0: no known chain in our sources.'
      - name: chainability
        in: query
        schema:
          type: string
          enum:
          - '0'
          - '1'
        description: '1: on KCV Watch™, the CVE carries at least one chain candidate at tier A or B (a pair whose extracted exploit capabilities connect or whose records tie the two CVEs together); 0: no such candidate we hold. A candidate is not a confirmed chain.'
      - name: epss_gte
        in: query
        schema:
          type: number
          minimum: 0
          maximum: 1
        example: 0.5
      - name: page
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 500
          default: 1
        description: 'Filter-only mode: page through the slice'
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 50
          default: 20
      responses:
        '200':
          description: '{ query, exact, results[], filters?, filters_ignored?, page?, has_more? }, each result carries cve_id, slug, title, severity, epss_score, kev_listed, detection flags, and url (site-relative). `filters` echoes the active slice in canonical (alphabetical, byte-stable) form.'
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Neither q nor any filter provided
        '429':
          description: Rate limited (Retry-After header)
        '503':
          description: Search unavailable, an outage, NOT an empty result
      tags:
      - Search
    servers:
    - url: https://cve-security.com
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml