Perform a full-text vulnerability search in SecDB.
## What this tool does
Searches across:
- CVE entries
- Security advisories
- Exploit references
- Product and vendor vulnerability data
Results are formatted in Markdown and include a search summary.
## Searchable fields (Lucene syntax supported):
- type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei
- id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234)
- title: resource title or name
- summary: short summary
- description: full description text
- alias: known vulnerability names (e.g. alias:log4shell)
- severity: critical, high, medium, low
- kev: true/false — CISA KEV catalog membership
- status: NVD status (CVE only) e.g. analyzed, modified
- published: publication date (e.g. published:[2026-01-01 TO 2026-12-31])
- modified: last modification date
- source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet)
- cve: related CVE ID (e.g. cve:CVE-2026-44827)
- cwe: related CWE ID (e.g. cwe:CWE-79)
- tag: advisory tag (e.g. tag:scada, tag:ics)
- attack_vector: network, adjacent, local, physical
- cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0])
Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards.
## Examples:
- "apache struts rce" → RCE vulnerabilities in Apache Struts
- "id:CVE-2026-44827" → exact CVE lookup
- "source:fortinet AND severity:critical" → critical Fortinet advisories
- "alias:log4shell" → Log4Shell by alias
- "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE
- "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs
- "tag:scada AND severity:high" → high severity ICS/SCADA advisories
## When to use this tool
Use this tool when the user asks:
- to look up a CVE, advisory, exploit, or product
- "show vulnerabilities for X"
- "search for advisories about Y"
- exploratory or broad vulnerability discovery
## Inputs
- **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.)
## Outputs
- **results**: array of Markdown-formatted search hits
- **summary**: Markdown summary with counts and a link to continue searching on SecDB
## LLM usage guidelines
- Use this tool instead of assuming whether a CVE/advisory/exploit exists.
- Present `results` and `summary` directly to the user-they are already Markdown.
- Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.
ConnectorNo auth