Search Vulnerabilities
search_vulnerabilitiesSearch for vulnerabilities (CVEs) with full-text search and filters for severity, exploit status, CISA KEV, ransomware, and CVSS/EPSS thresholds. Returns exploitation signals and attribution.
Instructions
Search the Exploit Intelligence Platform for vulnerabilities (CVEs). Returns a list of matching CVEs with CVSS scores, EPSS exploitation probability, exploit counts, CISA KEV status, VulnCheck KEV, InTheWild.io exploitation signals, and ransomware attribution. Supports full-text search, severity/vendor/product/ecosystem/CWE filters, CVSS/EPSS thresholds, plus any_exploited and ransomware filters. When sort is omitted, the API may automatically prefer newest exploitation, exploit, or nuclei-template activity based on the filters you set. Examples: query='apache httpd' with has_exploits=true; vendor='fortinet' with severity='critical' and is_kev=true sorted by epss_desc; any_exploited=true with ransomware=true for ransomware-linked CVEs; cwe='89' with min_cvss=9 for critical SQL injection CVEs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Search keywords (e.g. 'apache httpd', 'log4j'). Optional if filters are provided. | |
| severity | No | Filter by severity level | |
| has_exploits | No | Only return CVEs with public exploit code | |
| is_kev | No | Only return CISA Known Exploited Vulnerabilities | |
| any_exploited | No | Only return CVEs exploited in the wild (CISA KEV + VulnCheck KEV + InTheWild.io) | |
| ransomware | No | Only return CVEs with confirmed ransomware campaign use | |
| has_nuclei | No | Only return CVEs with Nuclei scanner templates | |
| vendor | No | Filter by vendor name (e.g. 'microsoft', 'fortinet') | |
| product | No | Filter by product name (e.g. 'exchange', 'pan-os') | |
| ecosystem | No | Filter by package ecosystem | |
| cwe | No | Filter by CWE ID (e.g. '79' or 'CWE-79') | |
| min_cvss | No | Minimum CVSS v3 score (0-10) | |
| min_score | No | Minimum score for the selected score_version (0-10) | |
| score_version | No | Score family for min_score / score_desc | |
| min_epss | No | Minimum EPSS score (0-1) | |
| year | No | Filter by CVE year (e.g. 2024) | |
| date_from | No | Start date for CVE publication (YYYY-MM-DD) | |
| date_to | No | End date for CVE publication (YYYY-MM-DD) | |
| sort | No | Sort order. Aliases are normalized to the current server schema. | |
| page | No | Page number (default: 1) | |
| per_page | No | Results per page (1-25, default: 10) |