search_cves
Read-onlyIdempotent
Search public CVEs by text, risk signals and affected products. Vendor/product must be NVD CPE names; call find_product first. KEV is the strongest priority signal, then EPSS, then CVSS. A capped total is a lower bound.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | Web-style full-text search (quoted phrases, OR, exclusions), or an exact CVE ID. | |
| cwe | No | Weakness ID, e.g. CWE-79 or 79. | |
| kev | No | true: known-exploited only; false: exclude KEV; omitted: either. | |
| page | No | Page number, starting at 1; capped at the API's maximum offset. | |
| sort | No | Descending order: published (default), modified, cvss, epss or kev. | |
| since | No | Inclusive publication lower bound, ISO 8601 date/timestamp; dates use UTC midnight. | |
| until | No | Inclusive publication upper bound, ISO 8601 date/timestamp; dates use UTC midnight. | |
| vendor | No | Vendor CPE name, e.g. microsoft; call find_product first. | |
| product | No | Product CPE name, e.g. windows_server_2022; requires vendor. Call find_product first. | |
| min_cvss | No | Minimum CVSS score, 0 to 10. | |
| min_epss | No | Minimum EPSS probability, 0 to 1 (0.1 means 10%). | |
| severity | No | Comma list: CRITICAL,HIGH,MEDIUM,LOW. | |
| page_size | No | Results per page, default 10; clamped to 1–50. | |
| ransomware | No | true: CISA ransomware-linked only; false/omitted: no ransomware filter. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| link | Yes | ||
| page | Yes | ||
| items | Yes | ||
| total | Yes | ||
| pageSize | Yes | ||
| totalCapped | Yes |