CVE Security · Schema
CveRecord
Per-CVE intelligence record returned by GET /api/cve/{id} and the MCP get_cve tool (identical shape). Absence semantics: a null or empty field means this dataset holds no such record. The source may still hold one.
CompanySecurityVulnerabilitiesCVEThreat IntelligenceCISA KEVEPSSVulnerability ManagementMCP
Properties
| Name | Type | Description |
|---|---|---|
| cve_id | string | |
| title | stringnull | The CVE's title in the house format: vendor, product, component and weakness, in that order, in sentence case. title_source says where it came from. Null when this dataset holds no title that meets th |
| title_source | stringnull | Where the title came from: cisa_kev (the name CISA gives the KEV entry, set in the house format), cna: |
| published | stringnull | |
| last_modified | stringnull | |
| description | stringnull | |
| scores | object | |
| exploitation | object | |
| bod_26_04 | object | BOD 26-04 (CISA, June 10, 2026): the Table 1 read on both exposure branches from KEV status and CISA's SSVC Automatable and Technical impact, with CISA's own KEV due date, forensic triage flag and the |
| detection | object | |
| remediation | object | |
| products | object | The products the CVE page lists: vendor and product pairs (items), CPE 2.3 names (cpes) and, when this dataset holds them, NVD's configurations whole (configurations). note gives the same reading guid |
| oss_packages | objectnull | OSV.dev open-source package mapping (CVE-linked, GitHub-reviewed; CC-BY-4.0) |
| coverage | object | |
| attack | object | |
| malware | array | Malware families, tools, campaigns and ransomware groups a published source ties to this CVE (MITRE ATT&CK relationship text; Ransomware Vulnerability Matrix rows verified against their cited page); e |
| papers | objectnull | Academic papers that name this CVE: n (the total) and items[] (up to eight: title, venue, year, type peer|preprint, work_type, authors, n_authors, url, arxiv, oa, cited, match title|abstract|fulltext, |
| chains | object | Exploit chains. known[]: pairs a cited source reports were used together in one exploit chain; each entry carries partner_cve_id, partner_url, claim_kind (observed: the source reports attacks; potenti |
| intelligence_summary | stringnull | |
| intelligence_summary_updated | stringnull | |
| cwes | array | |
| other_databases | array | Records of this CVE in other vulnerability databases: ENISA's EU Vulnerability Database (euvd), BDU of Russia's Federal Service for Technical and Export Control (bdu), the China National Vulnerability |
| references | array | References from the CVE record, one entry per URL, merged from NVD, the assigning CNA and the CVE Program's authorized data publishers: url, tags (one spelling per tag across the NVD and CVE List voca |
| _meta | object |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://artifacts.apis.io/cve-security-com/json-schema/cve-security-com-cve-record-schema.json",
"title": "CveRecord",
"description": "Per-CVE intelligence record returned by GET /api/cve/{id} and the MCP get_cve tool (identical shape). Absence semantics: a null or empty field means this dataset holds no such record. The source may still hold one.",
"x-generated": "2026-11-05",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/cve-security-com-openapi.yml#/components/schemas/CveRecord",
"type": "object",
"required": [
"cve_id"
],
"properties": {
"cve_id": {
"type": "string"
},
"title": {
"type": [
"string",
"null"
],
"description": "The CVE's title in the house format: vendor, product, component and weakness, in that order, in sentence case. title_source says where it came from. Null when this dataset holds no title that meets the standard; lists then show the description."
},
"title_source": {
"type": [
"string",
"null"
],
"description": "Where the title came from: cisa_kev (the name CISA gives the KEV entry, set in the house format), cna:<name> (the assigning CNA's own title), vendor:<source> (the vendor's advisory title), ghsa (the GitHub Advisory Database summary, CC BY 4.0), rule (written from the CVE record by our rules), model (drafted by a language model from the CVE record and checked against it) or none (this dataset holds no title that meets the standard). Null on a record the title pipeline has not reached."
},
"published": {
"type": [
"string",
"null"
]
},
"last_modified": {
"type": [
"string",
"null"
]
},
"description": {
"type": [
"string",
"null"
]
},
"scores": {
"type": "object",
"properties": {
"nvd_v31": {
"type": [
"number",
"null"
],
"description": "NVD's own CVSS v3.1 base score (NVD's metric, source nvd@nist.gov). Null when this dataset holds no NVD v3.1 score. New in 1.7.0: until Oct. 5, 2026, about 104,000 records held a CNA's metric here; the CNA's score now reads under the CNA in best and by_source."
},
"nvd_v31_severity": {
"type": [
"string",
"null"
]
},
"nvd_v40": {
"type": [
"number",
"null"
],
"description": "NVD's own CVSS v4.0 base score (NVD's metric, source nvd@nist.gov). Null when this dataset holds no NVD v4.0 score."
},
"nvd_v40_severity": {
"type": [
"string",
"null"
],
"description": "New in 1.7.0."
},
"best": {
"type": [
"object",
"null"
],
"description": "New in 1.7.0. The one score behind the listing's severity band and sort, with its scorer. From 1.8.0 it follows scoring_policy (the same assessment as primary, without a legacy CVSS v2.0 score): the CNA's CVSS v4.0, v3.1 or v3.0 when the CVE Program lists the CNA as a vendor or open-source organization (and, from 1.9.0, the record names a product it makes: cna_makes_product), then NVD, then CISA ADP, then any other CNA, then other ADPs; within a source v4.0, v3.1, v3.0. Until 1.8.0 it was NVD's v3.1, then NVD's v4.0, then the best CNA or ADP score. Null when this dataset holds no v3 or v4 score. Kept through a deprecation period; read primary.",
"properties": {
"score": {
"type": "number"
},
"severity": {
"type": [
"string",
"null"
]
},
"source": {
"type": [
"string",
"null"
],
"description": "nvd, cna or the ADP's short name (cisa-adp, redhat-sadp). Null on a record exported before Oct. 5, 2026 whose catalog row names no source."
},
"version": {
"type": [
"string",
"null"
],
"description": "3.1, 4.0 or 3.0"
},
"scorer": {
"type": [
"string",
"null"
],
"description": "The scorer as the CVE page names it: NVD, the CNA by name (such as VulDB (CNA), or CNA (assigner) when the name is not held), CISA-ADP or Red Hat."
}
}
},
"primary": {
"type": [
"object",
"null"
],
"description": "New in 1.8.0. The primary assessment, the one the CVE page gives visual priority, with its scorer and CVSS version beside the number: best, or, when this dataset holds no CVSS v4.0, v3.1 or v3.0 score from any source, a CVSS v2.0 score as a legacy reference (the CNA's, then NVD's), with legacy true. Null when no score is held (the page reads Not scored).",
"properties": {
"score": {
"type": "number"
},
"severity": {
"type": [
"string",
"null"
]
},
"source": {
"type": [
"string",
"null"
],
"description": "nvd, cna or the ADP's short name."
},
"scorer": {
"type": [
"string",
"null"
],
"description": "The scorer as the CVE page names it."
},
"version": {
"type": [
"string",
"null"
],
"description": "4.0, 3.1, 3.0, or 2.0 when legacy."
},
"vector": {
"type": [
"string",
"null"
]
},
"legacy": {
"type": "boolean",
"description": "True for a CVSS v2.0 score, which heads the record only when no modern score is held; v2.0 has its own severity cut-points."
}
}
},
"highest_modern": {
"type": [
"object",
"null"
],
"description": "New in 1.8.0. The CVSS v4.0, v3.1 or v3.0 assessment in the highest severity band among every scorer and version held (then the higher score, then NVD, the CNA, CISA ADP), with score, severity, source, scorer, version and vector. Null when no modern score is held."
},
"has_higher_band_assessment": {
"type": "boolean",
"description": "New in 1.8.0. True when highest_modern sits in a higher severity band than primary: the CVE page flags it beside the primary, naming its scorer and version. A higher number inside the same band is not flagged."
},
"scoring_policy": {
"type": "string",
"description": "New in 1.8.0. The rule behind primary and best: tiered-2026-10b from 1.9.0 (the assigning CNA's score leads only where it makes the product, decided per CVE), tiered-2026-10 before."
},
"cna_makes_product": {
"type": [
"boolean",
"null"
],
"description": "New in 1.9.0. Whether the assigning CNA makes the product the CVE names, for a CNA the CVE Program lists as a vendor or open-source organization: false when the per-CVE maker check reads the record as a product another organization makes (such as a distribution's record for an upstream package, an extension in a CMS's ecosystem or a scope that reaches third-party research), and its score then ranks after NVD's and CISA ADP's. Null for any other CNA, whose score ranks there too, and when the record does not say."
},
"cna_name": {
"type": [
"string",
"null"
],
"description": "New in 1.7.0. The assigning CNA's name, from the CVE List record's assignerShortName, which labels the CNA's rows in by_source. Null when the record does not carry it."
},
"nvd_v2": {
"type": [
"number",
"null"
],
"description": "NVD CVSS v2 (legacy scale, listed but kept out of the v3/v4 severity bands)"
},
"nvd_v2_severity": {
"type": [
"string",
"null"
]
},
"epss": {
"type": [
"number",
"null"
]
},
"epss_percentile": {
"type": [
"number",
"null"
]
},
"by_source": {
"type": "array",
"items": {
"type": "object",
"properties": {
"source": {
"type": "string"
},
"scorer": {
"type": "string"
},
"score": {
"type": "number"
},
"severity": {
"type": [
"string",
"null"
]
},
"vector": {
"type": [
"string",
"null"
]
},
"spec": {
"type": "string"
}
}
},
"description": "Per-scorer CVSS rows (NVD, the assigning CNA, CISA-ADP, Red Hat), every version each scorer gave from 1.8.0, each with source, scorer (the label the CVE page prints), score, severity, vector and spec (cvssV4_0, cvssV3_1, cvssV3_0, cvssV2_0). New in 1.7.0: source nvd-secondary marks NVD's copy of a CNA's or an ADP's metric (such a copy is left out when another row already holds the same spec and score), and best adds a row here when the scorer rows this record holds do not yet carry its source, or takes the place of that source's row, without its vector, when the row holds an older score."
}
}
},
"exploitation": {
"type": "object",
"properties": {
"cisa_kev": {
"type": "boolean"
},
"kev_name": {
"type": [
"string",
"null"
],
"description": "The name CISA gives the KEV entry, exactly as CISA writes it. Null outside KEV."
},
"kev_date": {
"type": [
"string",
"null"
]
},
"kev_due_date": {
"type": [
"string",
"null"
]
},
"known_ransomware_use": {
"type": [
"string",
"null"
]
},
"sightings": {
"type": [
"object",
"null"
],
"description": "Field sightings: a day on which a named sensor network recorded traffic aimed at this CVE. first, last, days_7d, days_30d, sensors[], and per-sensor detail with a 30-day presence strip. Presence per day, without volume; it stays apart from state and claims. Null means this dataset holds no sighting."
},
"ssvc": {
"type": [
"object",
"null"
],
"description": "CISA SSVC decision points. exploitation 'none' is a dated assessment, not an absence; 'poc' means exploit CODE is public, NOT observed exploitation.",
"properties": {
"exploitation": {
"type": "string",
"enum": [
"none",
"poc",
"active"
]
},
"automatable": {
"type": "string",
"enum": [
"yes",
"no"
]
},
"technical_impact": {
"type": "string",
"enum": [
"partial",
"total"
]
},
"ssvc_timestamp": {
"type": [
"string",
"null"
]
}
}
},
"vulncheck": {
"type": [
"object",
"null"
]
},
"circl": {
"type": [
"object",
"null"
]
},
"msrc": {
"type": [
"object",
"null"
]
},
"project_zero_itw": {
"type": [
"object",
"null"
]
}
}
},
"bod_26_04": {
"type": "object",
"description": "BOD 26-04 (CISA, June 10, 2026): the Table 1 read on both exposure branches from KEV status and CISA's SSVC Automatable and Technical impact, with CISA's own KEV due date, forensic triage flag and the KEV entry's action text. The agency's exposure tag decides the row; the read is a mapping and carries no date beyond CISA's KEV due date. Rows as CERT/CC encodes them (cisa:DT_BOD2604:1.0.0).",
"properties": {
"in_kev": {
"type": "boolean"
},
"automatable": {
"type": [
"string",
"null"
],
"enum": [
"yes",
"no",
null
],
"description": "The value the read used; CISA's interim value 'no' when basis is cisa_interim; null when basis is kev_unassessed"
},
"technical_impact": {
"type": [
"string",
"null"
],
"enum": [
"total",
"partial",
null
],
"description": "The value the read used; CISA's interim value 'total' when basis is cisa_interim; null when basis is kev_unassessed"
},
"ssvc_held": {
"type": "boolean",
"description": "True when both values come from CISA's Vulnrichment assessment of this CVE"
},
"basis": {
"type": "string",
"enum": [
"cisa_ssvc",
"cisa_interim",
"kev_unassessed"
],
"description": "Where the values came from: CISA's assessment; CISA's interim values for a CVE outside KEV with no assessment held; or a KEV entry with no values held, which gets no rows"
},
"ssvc_timestamp": {
"type": [
"string",
"null"
]
},
"if_exposed": {
"oneOf": [
{
"$ref": "#/$defs/Table1Row"
},
{
"type": "null"
}
]
},
"if_internal": {
"oneOf": [
{
"$ref": "#/$defs/Table1Row"
},
{
"type": "null"
}
]
},
"table_version": {
"type": "string"
},
"kev_date": {
"type": [
"string",
"null"
]
},
"kev_due_date": {
"type": [
"string",
"null"
],
"description": "CISA's due date on the KEV entry"
},
"kev_forensic_triage": {
"type": [
"boolean",
"null"
],
"description": "CISA's forensicTriage flag on the KEV entry; null when not listed or not held"
},
"kev_required_action": {
"type": [
"string",
"null"
],
"description": "The KEV entry's action text, CISA's requiredAction field, verbatim"
},
"kev_feed": {
"type": [
"object",
"null"
],
"description": "Which Table 1 branch reproduces CISA's due date and flag pair: both, exposed, internal, or null for neither; pre_directive true means CISA listed the entry before June 10, 2026, and no comparison is made; null overall outside KEV",
"properties": {
"due_days": {
"type": [
"integer",
"null"
]
},
"triage_flag": {
"type": [
"boolean",
"null"
]
},
"matches": {
"type": [
"string",
"null"
],
"enum": [
"both",
"exposed",
"internal",
null
]
},
"pre_directive": {
"type": "boolean"
}
}
},
"note": {
"type": "string"
}
}
},
"detection": {
"type": "object",
"properties": {
"nuclei": {
"type": "boolean"
},
"nuclei_template_id": {
"type": [
"string",
"null"
]
},
"metasploit_check": {
"type": "boolean"
},
"emerging_threats": {
"type": [
"object",
"null"
],
"description": "Proofpoint Emerging Threats Open network-IDS rules held for this CVE. rules[] lists up to five of rule_count, each with sid, msg, classtype and severity, plus created (the rule's publish date, ISO) and disabled (true when ET ships the rule disabled by default; those rules still count). first_published and first_sid name the earliest rule written for this CVE; both are absent when an older generic rule also covers it."
},
"snort": {
"type": [
"object",
"null"
]
},
"sigma_log_detection": {
"type": [
"object",
"null"
],
"description": "LOG-HOST layer (SIEM/EDR telemetry); a separate claim from the remote modalities and kept outside scannable coverage"
},
"host_check": {
"type": [
"object",
"null"
],
"description": "HOST tier: a self-contained Nuclei template or a Metasploit local or post module that runs on the system itself ({nuclei: {template_id, path, url, protocol, tags} | null, metasploit: {module} | null}); a separate claim from the remote modalities, kept outside scannable coverage. nuclei and metasploit_check above mean a check that works over the network."
}
}
},
"remediation": {
"type": "object",
"properties": {
"affected_versions": {
"type": "array",
"items": {
"type": "object"
},
"description": "fixed = first patched build; affected_through = the last vulnerable build, so upgrade past it"
},
"vendor_sources": {
"type": "array",
"items": {
"type": "object"
}
}
}
},
"products": {
"type": "object",
"description": "The products the CVE page lists: vendor and product pairs (items), CPE 2.3 names (cpes) and, when this dataset holds them, NVD's configurations whole (configurations). note gives the same reading guidance as these field descriptions, as one string.",
"properties": {
"items": {
"type": "array",
"description": "Vendor and product pairs, up to 40; the CVE page lists the first 20. Each carries vendor, vendor_slug, vendor_url, product, product_slug and product_url. For the CNA's affected and fixed builds, read remediation.affected_versions.",
"items": {
"type": "object",
"properties": {
"vendor": {
"type": "string"
},
"vendor_slug": {
"type": "string"
},
"vendor_url": {
"type": "string"
},
"product": {
"type": "string"
},
"product_slug": {
"type": "string"
},
"product_url": {
"type": "string"
}
}
}
},
"items_source": {
"type": [
"string",
"null"
],
"enum": [
"nvd",
"cna",
null
],
"description": "nvd: the pairs come from the CPE names our NVD ingest stores for the CVE; where the list also names an application from a vendor other than a Linux distributor, this dataset reads an unversioned Windows, macOS, Linux kernel, AIX, Solaris or HP-UX entry as the platform the application runs on and leaves it out; versioned entries such as Windows 10, other platforms and hardware stay, so a pair can name what a vulnerable product runs on. cna: the pairs come from the products the assigning CNA lists in its CVE record, which this dataset shows until it holds NVD's CPE names for the CVE. Null when items is empty."
},
"items_may_be_incomplete": {
"type": "boolean",
"description": "True when items holds 40 pairs, the record's cap, or when items_source is nvd and the CPE name list our NVD ingest stores for the CVE holds 25 names, the length it keeps, because those pairs come from that list."
},
"cpes": {
"type": "array",
"description": "CPE 2.3 names, verbatim; cpes_source says where they come from. nvd_configurations: the distinct names of the configurations held, in NVD's order; configurations gives each entry's role and NVD's version bounds. nvd_cpe_list: the names our NVD ingest stores, in sort order. NVD's configurations name the vulnerable products and the platforms or hardware they run on, and this list keeps both, so read an entry as a product the configuration names. A version of * matches any version; NVD may narrow it with version bounds in its configuration data, which this list leaves out. Our NVD ingest keeps the first 25 names in sort order, which puts application names ahead of hardware names and hardware ahead of operating system and firmware names, so a list cut there can leave out every operating system and firmware name NVD's configurations hold. Parse the names with a CPE 2.3 library, because the formatted string escapes colons.",
"items": {
"type": "string"
}
},
"cpes_source": {
"type": [
"string",
"null"
],
"enum": [
"nvd_configurations",
"nvd_cpe_list",
null
],
"description": "nvd_configurations: this dataset holds NVD's configurations for the CVE whole, and cpes and configurations come from them. nvd_cpe_list: cpes holds the CPE names our NVD ingest stores, the first 25 in sort order, and configurations is null. Null when cpes is empty and configurations is null."
},
"cpes_may_be_incomplete": {
"type": "boolean",
"description": "With cpes_source nvd_configurations, true when configurations holds fewer matches than NVD lists (the cap, or a read that stopped short). With nvd_cpe_list, true when cpes holds 25 names, the length our NVD ingest keeps; NVD's configurations may name more, operating system and firmware names first among them."
},
"configurations": {
"type": [
"array",
"null"
],
"description": "NVD's configurations for the CVE as NVD writes them, in NVD's order, when cpes_source is nvd_configurations; null with nvd_cpe_list. Each configuration and each node keeps NVD's operator (AND or OR) and negate flag; an AND configuration holds when all of its nodes match, so a vulnerable firmware and the hardware it runs on read as one combination. Each match carries NVD's vulnerable flag: true marks a product NVD lists as vulnerable, and false marks a platform or hardware the vulnerable product runs on. Each match keeps NVD's version bounds verbatim, under NVD's names in snake case (version_start_including, version_start_excluding, version_end_including and version_end_excluding), and a version of * in a name matches any version the bounds allow. An end bound marks where NVD's range stops; the fixed versions this dataset holds are in remediation. A bound NVD leaves out is left out of the match.",
"items": {
"type": "object",
"properties": {
"operator": {
"type": [
"string",
"null"
],
"enum": [
"AND",
"OR",
null
]
},
"negate": {
"type": "boolean"
},
"nodes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"operator": {
"type": [
"string",
"null"
],
"enum": [
"AND",
"OR",
null
]
},
"negate": {
"type": "boolean"
},
"matches": {
"type": "array",
"items": {
"type": "object",
"properties": {
"criteria": {
"type": "string"
},
"vulnerable": {
"type": "boolean"
},
"version_start_including": {
"type": "string"
},
"version_start_excluding": {
"type": "string"
},
"version_end_including": {
"type": "string"
},
"version_end_excluding": {
"type": "string"
}
}
}
}
}
}
}
}
}
},
"configurations_match_count": {
"type": [
"integer",
"null"
],
"description": "Every match NVD lists for the CVE, counted across all of its configurations; configurations holds up to 500 of them (MCP get_cve: 100 by default). Null when configurations is null."
},
"configurations_may_be_incomplete": {
"type": [
"boolean",
"null"
],
"description": "True when configurations holds fewer matches than configurations_match_count. configurations holds NVD's configurations in NVD's order up to 500 matches (MCP get_cve: 100 by default, configurations_cap to 500); a configuration that would pass the cap keeps its AND nodes, its negated nodes and the nodes of a negated configuration whole, keeps the first matches of its other nodes and is the last one held, and one that cannot fit that way is left out. Null when configurations is null."
},
"note": {
"type": "string",
"description": "Reading guidance for items, cpes and configurations as one string: where each comes from and where it stops."
}
}
},
"oss_packages": {
"type": [
"object",
"null"
],
"description": "OSV.dev open-source package mapping (CVE-linked, GitHub-reviewed; CC-BY-4.0)"
},
"coverage": {
"type": "object",
"properties": {
"news": {
"type": [
"object",
"null"
]
},
"community": {
"type": [
"object",
"null"
]
}
}
},
"attack": {
"type": "object",
"properties": {
"techniques": {
"type": "array",
"items": {
"type": "object"
},
"description": "MITRE ATT&CK techniques with source confidence (observed > exploit > detection > capability > weakness): observed is a MITRE CTID mapping from published exploitation with observed_role; exploit a Metasploit module tag; detection a detection-rule tag; capability based on exploit-capability analysis by the CVE Security intelligence team (what an exploit of the CVE needs and gains, crosswalked to techniques), with capability_role (exploitation or impact); weakness the CWE to CAPEC to ATT&CK chain. A derived association with the record; observed is the only source that reports use"
}
}
},
"malware": {
"type": "array",
"items": {
"type": "object"
},
"description": "Malware families, tools, campaigns and ransomware groups a published source ties to this CVE (MITRE ATT&CK relationship text; Ransomware Vulnerability Matrix rows verified against their cited page); each row carries name, type, note (affiliate, initial-access broker, state actor), source, source_url and the quoted sentence or table row. An empty array means this dataset holds no such row."
},
"papers": {
"type": [
"object",
"null"
],
"description": "Academic papers that name this CVE: n (the total) and items[] (up to eight: title, venue, year, type peer|preprint, work_type, authors, n_authors, url, arxiv, oa, cited, match title|abstract|fulltext, via openalex|semantic_scholar, chains[] the partner CVEs the paper's own sentence names in chaining language, summary). OpenAlex metadata (CC0); via semantic_scholar credits Semantic Scholar; titles and links only. Null means this dataset holds no such paper."
},
"chains": {
"type": "object",
"description": "Exploit chains. known[]: pairs a cited source reports were used together in one exploit chain; each entry carries partner_cve_id, partner_url, claim_kind (observed: the source reports attacks; potential: the source reports they can be chained), evidence[] with source, source_label, source_url, date and the quoted sentence, the sources that report an attack listed first with observed_basis and support, code_summary on a row of exploit code, and discussed (community threads naming both CVEs, which shows discussion and is not a chain claim). candidates[]: KCV Watch chain candidates, possible chains for teams to research: pairs whose extracted exploit capabilities connect or whose records tie them together, each with partner_cve_id, tier and tier_rule (the estimated rate at which pairs with these signals are possible chains), lane and reasons (how the pair was admitted and the record facts behind it), basis, exploited_count and kev_count (how many of the two CVEs carry an exploitation report or field sighting, and how many CISA lists), product (the platform the pair shares, with its page; null when cross_product is true), bridge and grade, entry_cve with entry_reach where a handoff is extracted (network, authenticated, adjacent, victim or local; a local entry means a prior step could supply the access) and a one-sentence explanation, derived from exploit-capability analysis by the CVE Security intelligence team; a candidate is not a confirmed chain. An empty known list means this dataset holds no such row."
},
"intelligence_summary": {
"type": [
"string",
"null"
]
},
"intelligence_summary_updated": {
"type": [
"string",
"null"
]
},
"cwes": {
"type": "array",
"items": {
"type": "object"
}
},
"other_databases": {
"type": "array",
"items": {
"type": "object"
},
"description": "Records of this CVE in other vulnerability databases: ENISA's EU Vulnerability Database (euvd), BDU of Russia's Federal Service for Technical and Export Control (bdu), the China National Vulnerability Database run by CNCERT/CC (cnvd) and JVN iPedia of Japan's JPCERT/CC and IPA (jvndb), three records a database at most. Each entry carries database, label, database_name, id, url (the address the page's link opens), source_url (the record's page at the database), circl_url (the record as CIRCL Vulnerability-Lookup serves it, null for euv
# --- truncated at 32 KB (34 KB total) ---
# Full source: https://artifacts.apis.io/cve-security-com/json-schema/cve-security-com-cve-record-schema.json
Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/cve-security-com-cve-record"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.