Nucleus Security Vulnerabilities API

openapi: 3.2.0
info:
  title: Nucleus Security Vulnerability Intelligence Vulnerabilities API
  version: v1
  summary: Public, unauthenticated read API behind the Nucleus Security vulnerability intelligence dataset.
  description: 'A live, public, unauthenticated JSON API served from Nucleus Security''s own domain at

    `https://nucleussec.com/wp-json/nucleussec/v1/`. It exposes the vulnerability

    intelligence dataset that backs the Nucleus Security public research pages -

    CVE records enriched with EPSS, CVSS v3/v4, CISA notes, GreyNoise tags, Shadowserver

    30-day averages, VulnCheck XDB entries, and Nucleus Insights'' own exploitation flags

    (`nucleus_exploited_by_malware`, `nucleus_public_exploit_available`, `nucleus_impacts_ot`).


    THIS IS NOT THE NUCLEUS PLATFORM API. The Nucleus platform REST API is a separate,

    authenticated, per-tenant surface at `https://[instance-name].nucleussec.com/nucleus/api`

    whose Swagger definition is published only inside a logged-in customer console. See

    `apis.yml` and `conventions/nucleus-security-conventions.yml` for that distinction.


    PROVENANCE: this document was GENERATED by API Evangelist, not published by Nucleus

    Security. Paths, methods, parameter names and parameter defaults are transcribed

    verbatim from the provider''s own machine-readable WordPress REST route descriptor at

    https://nucleussec.com/wp-json/nucleussec/v1 (saved in `openapi/_original/`). The

    response schema is transcribed field-for-field from live 200 responses observed on

    2026-08-26. Nothing here is inferred beyond the observed types. Nucleus Security does

    not publish an OpenAPI for this surface.

    '
  contact:
    name: Nucleus Security
    url: https://nucleussec.com/contact/
  x-provenance:
    method: generated
    generated_by: API Evangelist enrichment pipeline
    generated: '2026-08-26'
    route_descriptor: https://nucleussec.com/wp-json/nucleussec/v1
    observed_response: https://nucleussec.com/wp-json/nucleussec/v1/vulnerabilities/list?per_page=3&page=1
    observed_http_status: 200
    observed_total_records: 1638
    ownership_check: Served from nucleussec.com, the company's own primary domain, under a vendor-namespaced route (nucleussec/v1), returning records whose fields are Nucleus-branded (nucleus_exploited_by_malware, nucleus_public_exploit_available, nucleus_impacts_ot) and sourced from Nucleus Insights. Ownership is unambiguous.
servers:
- url: https://nucleussec.com/wp-json/nucleussec/v1
  description: Public vulnerability intelligence API on the Nucleus Security corporate host.
tags:
- name: Vulnerabilities
  description: Enriched CVE records from the Nucleus Security public vulnerability intelligence dataset.
paths:
  /vulnerabilities/list:
    get:
      operationId: listVulnerabilities
      summary: List enriched vulnerability records
      description: Returns a paginated page of enriched CVE records. Unauthenticated. Parameter names and defaults are taken verbatim from the provider's route descriptor.
      tags:
      - Vulnerabilities
      security: []
      parameters:
      - name: page
        in: query
        required: false
        description: 1-based page number.
        schema:
          type: integer
          minimum: 1
          default: 1
      - name: per_page
        in: query
        required: false
        description: Records per page.
        schema:
          type: integer
          minimum: 1
          default: 25
      - name: search
        in: query
        required: false
        description: Free-text search across the record set.
        schema:
          type: string
          default: ''
      - name: sort_by
        in: query
        required: false
        description: Field to sort by.
        schema:
          type: string
          default: date_added
      - name: sort_dir
        in: query
        required: false
        description: Sort direction.
        schema:
          type: string
          default: DESC
          enum:
          - ASC
          - DESC
      responses:
        '200':
          description: A page of enriched vulnerability records.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnerabilityListResponse'
        '404':
          description: No matching route. WordPress REST envelope, NOT RFC 9457 problem+json.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPRestError'
  /vulnerabilities:
    post:
      operationId: queryVulnerabilities
      summary: Query the vulnerability dataset
      description: POST-only route declared by the provider's route descriptor. The descriptor publishes an empty `args` array, so the request body shape is NOT declared by the provider and is NOT documented here. API Evangelist did not send a speculative body to this endpoint. Request body shape requires provider documentation.
      tags:
      - Vulnerabilities
      security: []
      responses:
        '200':
          description: Query result. Response shape not declared by the provider descriptor.
        '404':
          description: No matching route.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPRestError'
components:
  schemas:
    VulnerabilityListResponse:
      type: object
      description: Envelope returned by GET /vulnerabilities/list.
      required:
      - success
      - data
      - total
      - page
      - per_page
      - total_pages
      properties:
        success:
          type: boolean
        data:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
        total:
          type: integer
          description: Total records in the dataset matching the query. Observed 1638 on 2026-08-26.
        page:
          type: integer
        per_page:
          type: integer
        total_pages:
          type: integer
    WPRestError:
      type: object
      description: WordPress REST API error envelope. Not RFC 9457.
      properties:
        code:
          type: string
          examples:
          - rest_no_route
        message:
          type: string
        data:
          type: object
          properties:
            status:
              type: integer
    Vulnerability:
      type: object
      description: One enriched CVE record. All scalar values are serialised as JSON strings by the provider, including numeric scores; nullable fields are emitted as JSON null.
      properties:
        id:
          type: string
          description: Provider-internal record identifier.
        cve_id:
          type: string
          description: CVE identifier (MITRE CVE scheme).
          examples:
          - CVE-2025-67038
        cve_link:
          type: string
          format: uri
          description: Canonical NVD detail URL for the CVE.
        vendor:
          type: string
        product:
          type: string
        date_added:
          type: string
          format: date
          description: Date the record entered the dataset (YYYY-MM-DD).
        epss_score:
          type:
          - string
          - 'null'
          description: FIRST EPSS probability score, serialised as a decimal string.
        cvssv3_base:
          type:
          - string
          - 'null'
          description: CVSS v3.x base score, serialised as a decimal string.
        cvssv4_base:
          type:
          - string
          - 'null'
          description: CVSS v4.0 base score, serialised as a decimal string.
        cisa_notes:
          type:
          - string
          - 'null'
          description: CISA-published note or advisory URL for the vulnerability.
        greynoise_tags:
          type:
          - string
          - 'null'
          description: GreyNoise tag(s) associated with observed exploitation traffic.
        shadowserver_30d_avg:
          type:
          - string
          - 'null'
          description: Shadowserver 30-day average observation count.
        vulncheck_xdb_entries:
          type:
          - string
          - 'null'
          description: VulnCheck XDB exploit database entries.
        nucleus_exploited_by_malware:
          type:
          - string
          - 'null'
          description: Nucleus Insights flag - known malware exploitation. "TRUE" or "FALSE".
        nucleus_public_exploit_available:
          type:
          - string
          - 'null'
          description: Nucleus Insights flag - public exploit available. "TRUE" or "FALSE".
        nucleus_impacts_ot:
          type:
          - string
          - 'null'
          description: Nucleus Insights flag - impacts operational technology. "TRUE" or "FALSE".
        created_at:
          type:
          - string
          - 'null'
          description: Record creation timestamp (YYYY-MM-DD HH:MM:SS).
        updated_at:
          type:
          - string
          - 'null'
          description: Record last-update timestamp (YYYY-MM-DD HH:MM:SS).