# Vulnerability Detail API

URL: https://www.deepinfo.com/data-api/apis/vulnerability-detail/

## One CVE ID Returns Its Whole Prioritization Context.

The Vulnerability Detail API takes a CVE identifier and returns one record with each CVSS version scored for it, the current EPSS score and percentile, the CISA KEV entry with its due date, the weaknesses behind it and the product versions it affects.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Vulnerability Detail reference](https://docs.deepinfo.com/reference/vulnerability/detail/)

### Here Is Log4Shell as the API Returns It.

One parameter, `cve`. The response is the real record for CVE-2021-44228.

GET `https://api.deepinfo.com/v1/discovery/vulnerability-detail` [Reference](https://docs.deepinfo.com/reference/vulnerability/detail/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `cve` | string | Required | A CVE identifier, for example `CVE-2021-44228`. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/vulnerability-detail",
    params={"cve": "CVE-2021-44228"},
    headers={"apikey": "YOUR_API_KEY"},
)
cve = r.json()
print(cve["enrichment"]["epss_score"]["epss"], cve["cisa_action_due"])
```

JavaScript:

```javascript
const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const cve = await r.json()
console.log(cve.enrichment.epss_score.epss, cve.cisa_action_due)
```

Response

200 OK · application/json

```json
{
  "id": "CVE-2021-44228",
  "published": "2021-12-10T10:15:09Z",
  "last_modified": "2026-08-11T19:33:44Z",
  "status": "Analyzed",
  "cisa_exploit_add": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "metrics": {
    "cvss_metric_v31": [
      {
        "type": "Primary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "base_score": 10.0,
          "…": "…"
        }
      }
    ],
    "cvss_metric_v40": ["…"],
    "cvss_metric_v30": ["…"],
    "cvss_metric_v2": ["…"]
  },
  "weaknesses": [
    {
      "type": "Secondary",
      "description": [
        { "lang": "en", "value": "CWE-20" },
        { "lang": "en", "value": "CWE-400" }
      ],
      "…": "…"
    }
  ],
  "enrichment": {
    "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    "cisa_kev": {
      "vendor_project": "Apache",
      "product": "Log4j2",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability",
      "date_added": "2021-12-10",
      "…": "short_description, required_action, due_date, known_ransomware_campaign_use, notes"
    },
    "cwe": [
      { "id": 400, "name": "Uncontrolled Resource Consumption", "capec_id": [147, 227], "owasptop10_2021": null, "…": "…" }
    ],
    "cpe": [
      { "vendor": "…", "product": "…", "vulnerable": true, "version_end_excluding": "…", "…": "…" },
      "…"
    ],
    "vdeep_metric": { "cvss_data": { "version": "3.1", "…": "…" }, "…": "…" }
  },
  "…": "descriptions, references, configurations, vendor_comments, evaluator_*"
}
```

Two CVEs can share a 9.8 and still need *different deadlines.*

CVSS rates the damage if a flaw is exploited. EPSS estimates the chance of exploitation in the next 30 days, and a CISA KEV entry records that it has already happened. The record carries all three with their dates: when EPSS was scored, when CISA added the CVE and the remediation due date CISA set.

### Walk Through the Record Block by Block.

| Block | Fields | What it tells you |
| --- | --- | --- |
| Record | `id`, `published`, `last_modified`, `status`, `descriptions`, `references` | What the CVE is, where it is documented and its analysis status. |
| CVSS | `metrics.cvss_metric_v2`, `_v30`, `_v31`, `_v40` | Vector string, base score and severity for each CVSS version scored. |
| Weakness | `weaknesses`, `enrichment.cwe` | The CWE behind the flaw, with its CAPEC attack patterns and an OWASP Top 10 2021 field. |
| EPSS | `enrichment.epss_score` | Probability of exploitation in the next 30 days, its percentile and the date it was scored. [EPSS History](https://docs.deepinfo.com/reference/vulnerability/epss-history/) returns the daily series. |
| CISA KEV | `enrichment.cisa_kev`, `cisa_exploit_add`, `cisa_action_due` | Date added, required action, due date and known ransomware campaign use. |
| Affected products | `enrichment.cpe` | Vendor, product and vulnerable version ranges, as CPE. |
| vDeep | `enrichment.vdeep_metric` | Deepinfo’s own CVSS scoring layer, with its own vector and base score. |

Also returned: `configurations`, `vendor_comments` and the evaluator fields. The full schema is in the [reference](https://docs.deepinfo.com/reference/vulnerability/detail/#ref-response-fields).

### Enrich a Scanner Export in a Loop.

Vulnerability tools already hand you CVE identifiers. One Detail call per ID puts EPSS, KEV status and the due date next to each finding, so the export sorts by exploitation signal instead of severity alone.

The loop keeps to the default limit of one request per second, and higher limits depend on your plan. For a long list, one [Vulnerability Search](https://www.deepinfo.com/data-api/apis/vulnerability-search/) request with `in` on `id` returns these records in pages.

[Rate limits](https://docs.deepinfo.com/getting-started/rate-limits/)

Python

```python
import time, requests

API = "https://api.deepinfo.com/v1/discovery/vulnerability-detail"
HEADERS = {"apikey": "YOUR_API_KEY"}

for cve_id in ["CVE-2021-44228", "CVE-2023-4966"]:
    rec = requests.get(API, params={"cve": cve_id}, headers=HEADERS).json()
    enr = rec.get("enrichment") or {}
    epss = (enr.get("epss_score") or {}).get("epss")
    kev = (enr.get("cisa_kev") or {}).get("date_added")
    print(cve_id, epss, kev, rec.get("cisa_action_due"))
    time.sleep(1)  # default limit: one request per second
```

### Workflows This Call Plugs Into.

#### [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/)

Pull the full record behind any CVE in your queue without stitching sources together.

#### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/)

Look up a CVE from an advisory or an alert and see at once whether it is known to be exploited.

#### [Compliance and Audit Readiness](https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/)

Map each CVE to its CWE and OWASP Top 10 2021 category for evidence exports.

#### [Threat Intelligence Operations](https://www.deepinfo.com/solutions/use-cases/threat-intelligence-operations/)

Brief stakeholders from one record: severity, exploitation signal, KEV deadline and affected versions.

### From One CVE to the Whole Database.

- [Vulnerability Search](https://www.deepinfo.com/data-api/apis/vulnerability-search/) (API): Filter the CVE database by CVSS, EPSS, CISA KEV, weakness and affected product.
- [Vulnerability Finder](https://www.deepinfo.com/data-api/apis/vulnerability-finder/) (API): The vulnerabilities in the stack behind a URL, host or IP.
- [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/) (Deep Search & Insights): Trends across the CVE database: KEV additions, EPSS history, CWE timelines.

### Questions About Vulnerability Detail API

**Why are some fields empty on a new CVE?**

New CVE records often arrive before their CVSS metrics, EPSS score or CWE classification; those fields fill in as the record is analyzed. The CISA KEV fields stay empty until CISA lists the CVE as exploited.

**Can we see how a CVE’s EPSS score changed over time?**

Yes. [EPSS History](https://docs.deepinfo.com/reference/vulnerability/epss-history/) takes the CVE ID in its path and returns one record per day, each with the score, its percentile and the date.

**How is the Vulnerability Detail API priced?**

As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing).

**Can analysts look up a CVE without writing code?**

Yes. [Vulnerability Search](https://www.deepinfo.com/platform/dsi/vulnerability-search/) in Deep Search & Insights opens any CVE in the Deepinfo Platform as one record, with CVSS, EPSS, CISA KEV and CWE together.

**What does a request without a CVE ID return?**

A `400` application error whose `parameters` entry names `cve` with `This field is required.`

### Run It on Your Queue.

Bring a handful of CVE IDs from your current backlog. We set up access and answer schema questions on a short call.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)