addedInput schema / properties / include_reference_tags
Added value: +{
+ "default": false,
+ "description": "Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) instead of plain URL list (default: False). Set True to inspect which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection becomes tag-first when refs_with_tags is populated (NVD Patch/Vendor Advisory whitelist); legacy cached rows fall back to Batch 1 regex patterns automatically.",
+ "title": "Include Reference Tags",
+ "type": "boolean"
+}
addedInput schema / properties / include_severity_breakdown
Added value: +{
+ "default": false,
+ "description": "Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: False). Set True to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE).",
+ "title": "Include Severity Breakdown",
+ "type": "boolean"
+}
addedOutput schema / $defs / CveResponse / properties / cve_tags
Added value: +{
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "NVD cveTags (e.g. 'disputed', 'unsupported-when-assigned', 'exclusively-hosted-service'). When 'disputed' is present, summary is prefixed with [DISPUTED].",
+ "title": "Cve Tags"
+}
addedOutput schema / $defs / CveResponse / properties / cvss_v2
Added value: +{
+ "anyOf": [
+ {
+ "type": "number"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "CVSS v2.0 base score (0.0-10.0). Always present (additive, non-opt-in); null for CVEs with no v2 metric or for legacy cached rows synced before v1.29.x. Pre-2010 CVEs and select dual-scored entries have v2-only or v2+v3 metrics.",
+ "title": "Cvss V2"
+}
addedOutput schema / $defs / CveResponse / properties / cvss_v2_vector
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "CVSS v2.0 vector string, e.g. 'AV:N/AC:L/Au:N/C:C/I:C/A:C'. Null when cvss_v2 is None.",
+ "title": "Cvss V2 Vector"
+}
changedOutput schema / $defs / CveResponse / properties / kev / description
Previous value: -"CISA Known Exploited Vulnerabilities catalog: in_kev flag and date_added (ISO 8601)."New value: +"CISA Known Exploited Vulnerabilities catalog: in_kev flag, date_added, plus 10 fields populated when in_kev=true (due_date, required_action, known_ransomware_use, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed)."
addedOutput schema / $defs / CveResponse / properties / references_full
Added value: +{
+ "anyOf": [
+ {
+ "items": {
+ "$ref": "#/$defs/ReferenceItem"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Structured references with NVD reference tags + source provenance. Populated only when ?include_reference_tags=true (or body field include_reference_tags=true for bulk_cve_lookup). Default None for backward compat. Same truncation as `references` field — use include_full_references=true for the complete list.",
+ "title": "References Full"
+}
addedOutput schema / $defs / CveResponse / properties / severity_consensus
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Majority-bucket consensus severity computed from severity_sources. On a tie, the highest severity wins (CRITICAL > HIGH > MEDIUM > LOW > NONE). Null when severity_breakdown was not requested or when no source reported a severity.",
+ "title": "Severity Consensus"
+}
addedOutput schema / $defs / CveResponse / properties / severity_disagreement
Added value: +{
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "True when 2+ severity buckets appear across severity_sources entries — counts both across-source disagreement (NVD CRITICAL vs GHSA HIGH) and within-source v2-vs-v3 disagreement (v2 HIGH vs v3 MEDIUM on the same NVD entry). Null when severity_breakdown was not requested.",
+ "title": "Severity Disagreement"
+}
addedOutput schema / $defs / CveResponse / properties / severity_sources
Added value: +{
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": true,
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Multi-source severity breakdown (one entry per source: nvd, mitre, ghsa, osv). Populated only when ?include_severity_breakdown=true (or body field include_severity_breakdown=true for bulk_cve_lookup). Each entry has {source, severity, cvss_v3, cvss_v2}. Use to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH).",
+ "title": "Severity Sources"
+}
addedOutput schema / $defs / CveResponse / properties / total_references_unique
Added value: +{
+ "anyOf": [
+ {
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Unique-URL upstream count from refs_with_tags (Batch 6A). None for legacy cached rows synced before v1.29.x; populated after the next sync run for all 4 sources (NVD/MITRE/GHSA/OSV).",
+ "title": "Total References Unique"
+}
addedOutput schema / $defs / CveResponse / properties / vulnerability_status
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "NVD lifecycle status: 'Analyzed', 'Modified', 'Awaiting Analysis', 'Deferred', 'Rejected', 'Withdrawn'. Drives verdict.completeness downgrade for Rejected/Withdrawn/Awaiting Analysis.",
+ "title": "Vulnerability Status"
+}
addedOutput schema / $defs / KevInfo / properties / cwes
Added value: +{
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered).",
+ "title": "Cwes"
+}
addedOutput schema / $defs / KevInfo / properties / date_removed
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV.",
+ "title": "Date Removed"
+}
addedOutput schema / $defs / KevInfo / properties / due_date
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021).",
+ "title": "Due Date"
+}
addedOutput schema / $defs / KevInfo / properties / known_ransomware_use
Added value: +{
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV.",
+ "title": "Known Ransomware Use"
+}
addedOutput schema / $defs / KevInfo / properties / notes
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Reference URLs published by CISA, separated by '; '.",
+ "title": "Notes"
+}
addedOutput schema / $defs / KevInfo / properties / product
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Affected product name as published by CISA (mirrors kev_detail.product).",
+ "title": "Product"
+}
addedOutput schema / $defs / KevInfo / properties / required_action
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "CISA-specified remediation action text (mirrors kev_detail.required_action).",
+ "title": "Required Action"
+}
addedOutput schema / $defs / KevInfo / properties / short_description
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "CISA's one-sentence summary (mirrors kev_detail.short_description).",
+ "title": "Short Description"
+}
addedOutput schema / $defs / KevInfo / properties / vendor_project
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Vendor or project name as published by CISA (mirrors kev_detail.vendor_project).",
+ "title": "Vendor Project"
+}
addedOutput schema / $defs / KevInfo / properties / vulnerability_name
Added value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'.",
+ "title": "Vulnerability Name"
+}
addedOutput schema / $defs / ReferenceItem
Added value: +{
+ "description": "Structured reference object with NVD upstream tags + source provenance.\nEmitted in CveResponse.references_full when ?include_reference_tags=true.",
+ "properties": {
+ "source": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null,
+ "description": "Upstream source identifier. NVD: raw 'source' field (UUID/email of the CVE Numbering Authority); MITRE/GHSA/OSV: parser-name normalized to 'mitre'/'ghsa'/'osv'.",
+ "title": "Source"
+ },
+ "tags": {
+ "description": "NVD reference tags: Patch, Vendor Advisory, Mailing List, Exploit, Third Party Advisory, Issue Tracking, Release Notes, Technical Description, US Government Resource, VDB Entry. Empty list for MITRE/GHSA/OSV refs (those upstream feeds don't carry tags).",
+ "items": {
+ "type": "string"
+ },
+ "title": "Tags",
+ "type": "array"
+ },
+ "url": {
+ "description": "Reference URL (advisory, patch commit, exploit PoC, mailing list, etc.)",
+ "title": "Url",
+ "type": "string"
+ }
+ },
+ "required": [
+ "url"
+ ],
+ "title": "ReferenceItem",
+ "type": "object"
+}
