Vulnerability Search API

Filter Every CVE by Exploitation Signal and Severity Together.

Q: Can I search for a list of specific CVEs?

Yes. Use the in operator on id with an array of CVE identifiers. For a single CVE, the Vulnerability Detail API returns that record directly.

Q: How do we know when an EPSS score was computed?

enrichment.epss_score.date holds the date of the score, and it can be filtered like the other fields. The daily series for one CVE comes from EPSS History.

POST one filter body. Combine CVSS, EPSS, CISA KEV, weakness and affected-product conditions, sort on what drives your queue, and page through the matches or export them.

Talk to us about access Vulnerability Search reference

QueryPOST /discovery/vulnerability-searchall applied

must enrichment.cisa_kev.date_added exists true
must enrichment.epss_score.epss gte 0.7
sort enrichment.epss_score.epss desc

above 0.7, not in KEV: dropped

CVE-2021-44228

Results

CVE-2021-44228Log4j2 · epss 0.99999 · percentile 1 · KEV 2021-12-10

Find CVEs Exploited Before and Likely Exploited Again.

This request asks for CVEs in CISA KEV with an EPSS score of 0.7 or higher, highest EPSS first.

POST https://api.deepinfo.com/v1/discovery/vulnerability-search Reference

Parameter	In	Type		Description
`filters`	body	object	Optional	`must`, `should` and `must_not` clauses, each a list of `{name, type, value}` conditions.
`sort`	body	array	Optional	A list of `{field, order}` pairs.
`page`	query	integer	Optional	Page number, from 1.
`page_size`	query	integer	Optional	Results per page. See pagination.
`export`	query	boolean	Optional	Default `false`. Set `true` to take the result set as an export.
`export_format`	query	string	Optional	`json` or `csv`.
`export_scope`	query	string	Optional	`basic`, `default` or `extended`.

Request

curl -X POST "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "enrichment.cisa_kev.date_added", "type": "exists", "value": true },
        { "name": "enrichment.epss_score.epss", "type": "gte", "value": 0.7 }
      ]
    },
    "sort": [ { "field": "enrichment.epss_score.epss", "order": "desc" } ]
  }'

import requests

body = {
    "filters": {
        "must": [
            {"name": "enrichment.cisa_kev.date_added", "type": "exists", "value": True},
            {"name": "enrichment.epss_score.epss", "type": "gte", "value": 0.7},
        ]
    },
    "sort": [{"field": "enrichment.epss_score.epss", "order": "desc"}],
}
r = requests.post(
    "https://api.deepinfo.com/v1/discovery/vulnerability-search",
    params={"page_size": 25},
    json=body,
    headers={"apikey": "YOUR_API_KEY"},
)
for cve in r.json()["results"]:
    print(cve["id"], cve["enrichment"]["epss_score"]["epss"])

const body = {
  filters: {
    must: [
      { name: 'enrichment.cisa_kev.date_added', type: 'exists', value: true },
      { name: 'enrichment.epss_score.epss', type: 'gte', value: 0.7 },
    ],
  },
  sort: [{ field: 'enrichment.epss_score.epss', order: 'desc' }],
}
const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
  {
    method: 'POST',
    headers: { apikey: 'YOUR_API_KEY', 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  }
)
const { result_count, results } = await r.json()
console.log(result_count, results.map((c) => c.id))

Response

200 OK · application/json

{
  "page": 1,
  "page_size": 25,
  "result_count": "…",
  "results": [
    {
      "id": "CVE-2021-44228",
      "published": "2021-12-10T10:15:09Z",
      "last_modified": "2026-08-11T19:33:44Z",
      "status": "Analyzed",
      "cisa_exploit_add": "2021-12-10",
      "cisa_action_due": "2021-12-24",
      "metrics": { "cvss_metric_v31": ["…"], "…": "…" },
      "weaknesses": ["…"],
      "enrichment": {
        "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
        "cisa_kev": { "product": "Log4j2", "date_added": "2021-12-10", "…": "…" },
        "cwe": ["…"],
        "cpe": ["…"],
        "vdeep_metric": { "…": "…" }
      },
      "…": "descriptions, references, configurations"
    },
    "…"
  ]
}

Searchable Fields Grouped by Family.

A sample from each family. All fields listed can be filtered on, and the right-hand column names the fields that can also order the results.

Family	Example fields	Sortable
Record	`id`, `published`, `last_modified`, `status`, `references.url`	`id`, `published`, `last_modified`
CVSS v2 to v4.0	`metrics.cvss_metric_v31.cvss_data.base_score`, `…attack_vector`, `…vector_string`	Filter only
EPSS	`enrichment.epss_score.epss`, `.percentile`, `.date`	`enrichment.epss_score.epss`
CISA KEV	`enrichment.cisa_kev.date_added`, `.due_date`, `.known_ransomware_campaign_use`	`enrichment.cisa_kev.date_added`
Weakness	`enrichment.cwe.id`, `.owasptop10_2021`, `.capec_id`	Filter only
Affected products	`enrichment.cpe.vendor`, `.product`, `.affected_versions`	`enrichment.cpe.vendor`, `enrichment.cpe.product`
vDeep	`enrichment.vdeep_metric.cvss_data.base_score`, `.base_severity`	Both fields

vDeep is Deepinfo’s own CVSS scoring layer. The full field list is in the filtering reference.

Filter Bodies Worth Keeping.

Each body drops into the request above as it stands.

{
  "filters": {
    "must": [
      { "name": "enrichment.epss_score.epss", "type": "gte", "value": 0.5 }
    ],
    "must_not": [
      { "name": "enrichment.cisa_kev.date_added", "type": "exists", "value": true }
    ]
  },
  "sort": [ { "field": "enrichment.epss_score.epss", "order": "desc" } ]
}

{
  "filters": {
    "must": [
      { "name": "enrichment.cisa_kev.date_added", "type": "gte", "value": "2026-09-01" }
    ]
  },
  "sort": [ { "field": "enrichment.cisa_kev.date_added", "order": "desc" } ]
}

{
  "filters": {
    "must": [
      { "name": "enrichment.cpe.vendor", "type": "eq", "value": "apache" },
      { "name": "published", "type": "gte", "value": "2026-01-01T00:00:00Z" }
    ]
  },
  "sort": [ { "field": "published", "order": "desc" } ]
}

{
  "filters": {
    "must": [
      { "name": "enrichment.cwe.id", "type": "eq", "value": 79 }
    ]
  },
  "sort": [ { "field": "enrichment.vdeep_metric.cvss_data.base_score", "order": "desc" } ]
}

The Query Rules in One Place.

Operators	`eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `gte`, `lte`, `gt`, `lt`, `exists`. See search and filters.
Empty body	An empty body `{}` matches all CVEs in the database. Start with a filter.
Result cap	A query returns at most 10,000 results. Narrow it with filters rather than paging further.
Unknown fields	A filter on a field that does not exist returns a 400. See errors.
Rate limits	Plan-dependent. The default is one request per second per key and endpoint. See rate limits.

Workflows This Search Plugs Into.

Vulnerability Management

Build the patch queue from EPSS, CISA KEV and CVSS together.

Use case

Threat Intelligence Operations

Track new KEV additions and route them to the teams that own the affected products.

Use case

Threat Hunting

Pull the CVEs that match a vendor, product or weakness class you are hunting for.

Use case

Compliance and Audit Readiness

Group CVEs by CWE and OWASP Top 10 2021 category for evidence and reporting.

Use case

See This Data at Work in the Platform

External Attack Surface Management ranks the CVEs on your assets with this CVSS, EPSS and CISA KEV data, and Deep Search & Insights opens the whole catalog to your analysts.

Questions About Vulnerability Search API

How do CVSS, EPSS and CISA KEV differ?

CVSS rates how severe a vulnerability is if it is exploited. EPSS estimates the probability that it will be exploited in the next 30 days. CISA’s Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of exploitation in the wild.

Each answers a different question, which is why the search lets you combine all three in one filter.

Can I search for a list of specific CVEs?

Yes. Use the in operator on id with an array of CVE identifiers. For a single CVE, the Vulnerability Detail API returns that record directly.

How is the Vulnerability Search API priced?

As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.

Can we filter with greater-than and less-than?

Yes, here. Among the searches that take a filter body, Vulnerability Search alone accepts gt and lt, on its date and number fields and on id. On id, use them in place of gte and lte, which return a 400 there.

How do we know when an EPSS score was computed?

enrichment.epss_score.date holds the date of the score, and it can be filtered like the other fields. The daily series for one CVE comes from EPSS History.

Can analysts run these searches without writing code?

Yes. Vulnerability Search in Deep Search & Insights filters the CVE database in the Deepinfo Platform, on severity, weakness, product, EPSS and KEV.

Start With the Products You Run.

Most teams begin with EPSS and KEV filters over their own vendors and products. We set up access and walk through the field set on a short call.

Talk to us about access All API services

Platform

Solutions

Data & API

Resources

Company

Filter Every CVE by Exploitation Signal and Severity Together.

Find CVEs Exploited Before and Likely Exploited Again.

Searchable Fields Grouped by Family.

Filter Bodies Worth Keeping.

The Query Rules in One Place.

Workflows This Search Plugs Into.

Vulnerability Management

Threat Intelligence Operations

Threat Hunting

Compliance and Audit Readiness

See This Data at Work in the Platform

Questions About Vulnerability Search API

Start With the Products You Run.