cve_search

{
  "properties": {
    "product": {
      "default": "",
      "description": "Product or vendor token to filter by. EXACT match (case-insensitive) against the NVD-canonical CPE product/vendor token — NOT substring/fuzzy, and NOT necessarily the common project name. Common names, vendor renames, and build-tool artifact ids often differ from the canonical token (e.g. modern nginx CVEs are under 'nginx_open_source'/'nginx_plus', vendor 'f5', not 'nginx'; Maven 'log4j-core' maps to 'log4j'). A low or zero count for a well-known product usually means the token differs — do NOT assume coverage is complete. For dependency/package lists prefer check_dependencies, and for a domain's whole tech stack tech_stack_cve_audit (both auto-normalize tokens). A product match means CVEs exist for that product, not that a specific running version is affected — verify the running version is within each CVE's affected range. Omit to search all products.",
      "title": "Product",
      "type": "string"
    },
    "severity": {
      "default": "",
      "description": "CVSS severity level. Must be one of: CRITICAL, HIGH, MEDIUM, LOW. Omit for all severities.",
      "enum": [
        "",
        "CRITICAL",
        "HIGH",
        "MEDIUM",
        "LOW"
      ],
      "title": "Severity",
      "type": "string"
    },
    "published_after": {
      "default": "",
      "description": "Inclusive lower bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names a starting point, e.g. 'since 2015' → '2015-01-01', 'after March 2024' → '2024-03-01'. Omit to not bound the lower edge. Combine with published_before for ranges.",
      "title": "Published After",
      "type": "string"
    },
    "published_before": {
      "default": "",
      "description": "Inclusive upper bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names an ending point, e.g. 'before 2020' → '2019-12-31', 'up to 2023' → '2023-12-31'. Omit to not bound the upper edge. Combine with published_after for ranges.",
      "title": "Published Before",
      "type": "string"
    },
    "kev": {
      "default": false,
      "description": "If true, return only CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog — these are actively exploited in the wild.",
      "title": "Kev",
      "type": "boolean"
    },
    "epss_min": {
      "default": 0,
      "description": "Minimum EPSS score filter (0.0-1.0). EPSS predicts exploitation probability. 0.5 = top ~5% most likely to be exploited. 0.0 = no filter.",
      "maximum": 1,
      "minimum": 0,
      "title": "Epss Min",
      "type": "number"
    },
    "sort": {
      "default": "",
      "description": "Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first (default=published_desc).",
      "enum": [
        "",
        "published_desc",
        "epss_desc",
        "cvss_desc"
      ],
      "title": "Sort",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "description": "Maximum results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "offset": {
      "default": 0,
      "description": "Skip N results for pagination. Use with limit to page through results.",
      "maximum": 5000,
      "minimum": 0,
      "title": "Offset",
      "type": "integer"
    },
    "cwe_id": {
      "default": "",
      "description": "Filter by CWE weakness ID. Exact match, case-insensitive. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-120 (buffer overflow), CWE-78 (command injection). Format: CWE-<number>. Omit to not filter by CWE.",
      "title": "Cwe Id",
      "type": "string"
    },
    "cvss_min": {
      "default": 0,
      "description": "Minimum CVSS v3 base score (0.0-10.0). Default 0.0 = no filter (sentinel, not applied). Set > 0 to filter — CVEs with null CVSS are excluded when active. Use 7.0 for high+critical, 9.0 for critical only.",
      "maximum": 10,
      "minimum": 0,
      "title": "Cvss Min",
      "type": "number"
    },
    "cvss_max": {
      "default": 10,
      "description": "Maximum CVSS v3 base score (0.0-10.0). Default 10.0 = no filter (sentinel, not applied). Set < 10.0 to filter — CVEs with null CVSS are excluded when active. Combine with cvss_min for a range.",
      "maximum": 10,
      "minimum": 0,
      "title": "Cvss Max",
      "type": "number"
    },
    "vendor": {
      "default": "",
      "description": "Filter by vendor name (case-insensitive). When combined with product, both must match the same CPE row — prevents cross-row false matches. Example: vendor=apache, product=struts.",
      "title": "Vendor",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. Even with 'full', per-result affected_products and references may be truncated (the per-result total_products/total_references report the honest counts); use cve_lookup for the guaranteed-complete per-CVE lists. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload).",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "title": "cve_searchArguments",
  "type": "object"
}