Nucleus Security Vulnerability Intelligence API

openapi: 3.1.0
info:
  title: Nucleus Security Vulnerability Intelligence API
  version: v1
  summary: Public, unauthenticated read API behind the Nucleus Security vulnerability intelligence dataset.
  description: |
    A live, public, unauthenticated JSON API served from Nucleus Security's own domain at
    `https://nucleussec.com/wp-json/nucleussec/v1/`. It exposes the vulnerability
    intelligence dataset that backs the Nucleus Security public research pages -
    CVE records enriched with EPSS, CVSS v3/v4, CISA notes, GreyNoise tags, Shadowserver
    30-day averages, VulnCheck XDB entries, and Nucleus Insights' own exploitation flags
    (`nucleus_exploited_by_malware`, `nucleus_public_exploit_available`, `nucleus_impacts_ot`).

    THIS IS NOT THE NUCLEUS PLATFORM API. The Nucleus platform REST API is a separate,
    authenticated, per-tenant surface at `https://[instance-name].nucleussec.com/nucleus/api`
    whose Swagger definition is published only inside a logged-in customer console. See
    `apis.yml` and `conventions/nucleus-security-conventions.yml` for that distinction.

    PROVENANCE: this document was GENERATED by API Evangelist, not published by Nucleus
    Security. Paths, methods, parameter names and parameter defaults are transcribed
    verbatim from the provider's own machine-readable WordPress REST route descriptor at
    https://nucleussec.com/wp-json/nucleussec/v1 (saved in `openapi/_original/`). The
    response schema is transcribed field-for-field from live 200 responses observed on
    2026-08-26. Nothing here is inferred beyond the observed types. Nucleus Security does
    not publish an OpenAPI for this surface.
  contact:
    name: Nucleus Security
    url: https://nucleussec.com/contact/
  x-provenance:
    method: generated
    generated_by: API Evangelist enrichment pipeline
    generated: '2026-08-26'
    route_descriptor: https://nucleussec.com/wp-json/nucleussec/v1
    observed_response: https://nucleussec.com/wp-json/nucleussec/v1/vulnerabilities/list?per_page=3&page=1
    observed_http_status: 200
    observed_total_records: 1638
    ownership_check: >-
      Served from nucleussec.com, the company's own primary domain, under a
      vendor-namespaced route (nucleussec/v1), returning records whose fields are
      Nucleus-branded (nucleus_exploited_by_malware, nucleus_public_exploit_available,
      nucleus_impacts_ot) and sourced from Nucleus Insights. Ownership is unambiguous.
servers:
- url: https://nucleussec.com/wp-json/nucleussec/v1
  description: Public vulnerability intelligence API on the Nucleus Security corporate host.
tags:
- name: Vulnerabilities
  description: Enriched CVE records from the Nucleus Security public vulnerability intelligence dataset.
paths:
  /vulnerabilities/list:
    get:
      operationId: listVulnerabilities
      summary: List enriched vulnerability records
      description: >-
        Returns a paginated page of enriched CVE records. Unauthenticated. Parameter
        names and defaults are taken verbatim from the provider's route descriptor.
      tags:
      - Vulnerabilities
      security: []
      parameters:
      - name: page
        in: query
        required: false
        description: 1-based page number.
        schema:
          type: integer
          minimum: 1
          default: 1
      - name: per_page
        in: query
        required: false
        description: Records per page.
        schema:
          type: integer
          minimum: 1
          default: 25
      - name: search
        in: query
        required: false
        description: Free-text search across the record set.
        schema:
          type: string
          default: ''
      - name: sort_by
        in: query
        required: false
        description: Field to sort by.
        schema:
          type: string
          default: date_added
      - name: sort_dir
        in: query
        required: false
        description: Sort direction.
        schema:
          type: string
          default: DESC
          enum: [ASC, DESC]
      responses:
        '200':
          description: A page of enriched vulnerability records.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnerabilityListResponse'
        '404':
          description: >-
            No matching route. WordPress REST envelope, NOT RFC 9457 problem+json.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPRestError'
  /vulnerabilities:
    post:
      operationId: queryVulnerabilities
      summary: Query the vulnerability dataset
      description: >-
        POST-only route declared by the provider's route descriptor. The descriptor
        publishes an empty `args` array, so the request body shape is NOT declared by the
        provider and is NOT documented here. API Evangelist did not send a speculative
        body to this endpoint. Request body shape requires provider documentation.
      tags:
      - Vulnerabilities
      security: []
      responses:
        '200':
          description: Query result. Response shape not declared by the provider descriptor.
        '404':
          description: No matching route.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPRestError'
components:
  schemas:
    VulnerabilityListResponse:
      type: object
      description: Envelope returned by GET /vulnerabilities/list.
      required: [success, data, total, page, per_page, total_pages]
      properties:
        success:
          type: boolean
        data:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
        total:
          type: integer
          description: Total records in the dataset matching the query. Observed 1638 on 2026-08-26.
        page:
          type: integer
        per_page:
          type: integer
        total_pages:
          type: integer
    Vulnerability:
      type: object
      description: >-
        One enriched CVE record. All scalar values are serialised as JSON strings by the
        provider, including numeric scores; nullable fields are emitted as JSON null.
      properties:
        id:
          type: string
          description: Provider-internal record identifier.
        cve_id:
          type: string
          description: CVE identifier (MITRE CVE scheme).
          examples: ['CVE-2025-67038']
        cve_link:
          type: string
          format: uri
          description: Canonical NVD detail URL for the CVE.
        vendor:
          type: string
        product:
          type: string
        date_added:
          type: string
          format: date
          description: Date the record entered the dataset (YYYY-MM-DD).
        epss_score:
          type: [string, 'null']
          description: FIRST EPSS probability score, serialised as a decimal string.
        cvssv3_base:
          type: [string, 'null']
          description: CVSS v3.x base score, serialised as a decimal string.
        cvssv4_base:
          type: [string, 'null']
          description: CVSS v4.0 base score, serialised as a decimal string.
        cisa_notes:
          type: [string, 'null']
          description: CISA-published note or advisory URL for the vulnerability.
        greynoise_tags:
          type: [string, 'null']
          description: GreyNoise tag(s) associated with observed exploitation traffic.
        shadowserver_30d_avg:
          type: [string, 'null']
          description: Shadowserver 30-day average observation count.
        vulncheck_xdb_entries:
          type: [string, 'null']
          description: VulnCheck XDB exploit database entries.
        nucleus_exploited_by_malware:
          type: [string, 'null']
          description: Nucleus Insights flag - known malware exploitation. "TRUE" or "FALSE".
        nucleus_public_exploit_available:
          type: [string, 'null']
          description: Nucleus Insights flag - public exploit available. "TRUE" or "FALSE".
        nucleus_impacts_ot:
          type: [string, 'null']
          description: Nucleus Insights flag - impacts operational technology. "TRUE" or "FALSE".
        created_at:
          type: [string, 'null']
          description: Record creation timestamp (YYYY-MM-DD HH:MM:SS).
        updated_at:
          type: [string, 'null']
          description: Record last-update timestamp (YYYY-MM-DD HH:MM:SS).
    WPRestError:
      type: object
      description: WordPress REST API error envelope. Not RFC 9457.
      properties:
        code:
          type: string
          examples: ['rest_no_route']
        message:
          type: string
        data:
          type: object
          properties:
            status:
              type: integer