Vulnerability Detail API

One CVE ID Returns Its Whole Prioritization Context.

Q: What does a request without a CVE ID return?

A 400 application error whose parameters entry names cve with This field is required.

The Vulnerability Detail API takes a CVE identifier and returns one record with each CVSS version scored for it, the current EPSS score and percentile, the CISA KEV entry with its due date, the weaknesses behind it and the product versions it affects.

Talk to us about access Vulnerability Detail reference

One CVE

CVE-2021-44228

Apache Log4j2 · published 2021-12-10

CVSS 3.1the damage if exploited

10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Versions in the record: v2v3.0v3.1 (shown)v4.0

EPSSthe chance in the next 30 days

0.99999

percentile 1.0 · 2026-09-21

CISA KEVit has already happened

Known exploited

added 2021-12-10 · due 2021-12-24 · Apache Log4j2

CWE-20 · CWE-400 Uncontrolled Resource Consumption · CAPEC 147, 227

Here Is Log4Shell as the API Returns It.

One parameter, cve. The response is the real record for CVE-2021-44228.

GET https://api.deepinfo.com/v1/discovery/vulnerability-detail Reference

Parameter	Type		Description
`cve`	string	Required	A CVE identifier, for example `CVE-2021-44228`.

Request

curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"

import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/vulnerability-detail",
    params={"cve": "CVE-2021-44228"},
    headers={"apikey": "YOUR_API_KEY"},
)
cve = r.json()
print(cve["enrichment"]["epss_score"]["epss"], cve["cisa_action_due"])

const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const cve = await r.json()
console.log(cve.enrichment.epss_score.epss, cve.cisa_action_due)

Response

200 OK · application/json

{
  "id": "CVE-2021-44228",
  "published": "2021-12-10T10:15:09Z",
  "last_modified": "2026-08-11T19:33:44Z",
  "status": "Analyzed",
  "cisa_exploit_add": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "metrics": {
    "cvss_metric_v31": [
      {
        "type": "Primary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "base_score": 10.0,
          "…": "…"
        }
      }
    ],
    "cvss_metric_v40": ["…"],
    "cvss_metric_v30": ["…"],
    "cvss_metric_v2": ["…"]
  },
  "weaknesses": [
    {
      "type": "Secondary",
      "description": [
        { "lang": "en", "value": "CWE-20" },
        { "lang": "en", "value": "CWE-400" }
      ],
      "…": "…"
    }
  ],
  "enrichment": {
    "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    "cisa_kev": {
      "vendor_project": "Apache",
      "product": "Log4j2",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability",
      "date_added": "2021-12-10",
      "…": "short_description, required_action, due_date, known_ransomware_campaign_use, notes"
    },
    "cwe": [
      { "id": 400, "name": "Uncontrolled Resource Consumption", "capec_id": [147, 227], "owasptop10_2021": null, "…": "…" }
    ],
    "cpe": [
      { "vendor": "…", "product": "…", "vulnerable": true, "version_end_excluding": "…", "…": "…" },
      "…"
    ],
    "vdeep_metric": { "cvss_data": { "version": "3.1", "…": "…" }, "…": "…" }
  },
  "…": "descriptions, references, configurations, vendor_comments, evaluator_*"
}

Two CVEs can share a 9.8 and still need different deadlines.

CVSS rates the damage if a flaw is exploited. EPSS estimates the chance of exploitation in the next 30 days, and a CISA KEV entry records that it has already happened. The record carries all three with their dates: when EPSS was scored, when CISA added the CVE and the remediation due date CISA set.

Walk Through the Record Block by Block.

Block	Fields	What it tells you
Record	`id`, `published`, `last_modified`, `status`, `descriptions`, `references`	What the CVE is, where it is documented and its analysis status.
CVSS	`metrics.cvss_metric_v2`, `_v30`, `_v31`, `_v40`	Vector string, base score and severity for each CVSS version scored.
Weakness	`weaknesses`, `enrichment.cwe`	The CWE behind the flaw, with its CAPEC attack patterns and an OWASP Top 10 2021 field.
EPSS	`enrichment.epss_score`	Probability of exploitation in the next 30 days, its percentile and the date it was scored. EPSS History returns the daily series.
CISA KEV	`enrichment.cisa_kev`, `cisa_exploit_add`, `cisa_action_due`	Date added, required action, due date and known ransomware campaign use.
Affected products	`enrichment.cpe`	Vendor, product and vulnerable version ranges, as CPE.
vDeep	`enrichment.vdeep_metric`	Deepinfo’s own CVSS scoring layer, with its own vector and base score.

Also returned: configurations, vendor_comments and the evaluator fields. The full schema is in the reference.

Enrich a Scanner Export in a Loop.

Vulnerability tools already hand you CVE identifiers. One Detail call per ID puts EPSS, KEV status and the due date next to each finding, so the export sorts by exploitation signal instead of severity alone.

The loop keeps to the default limit of one request per second, and higher limits depend on your plan. For a long list, one Vulnerability Search request with in on id returns these records in pages.

Rate limits

Python

import time, requests

API = "https://api.deepinfo.com/v1/discovery/vulnerability-detail"
HEADERS = {"apikey": "YOUR_API_KEY"}

for cve_id in ["CVE-2021-44228", "CVE-2023-4966"]:
    rec = requests.get(API, params={"cve": cve_id}, headers=HEADERS).json()
    enr = rec.get("enrichment") or {}
    epss = (enr.get("epss_score") or {}).get("epss")
    kev = (enr.get("cisa_kev") or {}).get("date_added")
    print(cve_id, epss, kev, rec.get("cisa_action_due"))
    time.sleep(1)  # default limit: one request per second

Workflows This Call Plugs Into.

Vulnerability Management

Pull the full record behind any CVE in your queue without stitching sources together.

Use case

Incident Investigation

Look up a CVE from an advisory or an alert and see at once whether it is known to be exploited.

Use case

Compliance and Audit Readiness

Map each CVE to its CWE and OWASP Top 10 2021 category for evidence exports.

Use case

Threat Intelligence Operations

Brief stakeholders from one record: severity, exploitation signal, KEV deadline and affected versions.

Use case

Questions About Vulnerability Detail API

Why are some fields empty on a new CVE?

New CVE records often arrive before their CVSS metrics, EPSS score or CWE classification; those fields fill in as the record is analyzed. The CISA KEV fields stay empty until CISA lists the CVE as exploited.

Can we see how a CVE’s EPSS score changed over time?

Yes. EPSS History takes the CVE ID in its path and returns one record per day, each with the score, its percentile and the date.

How is the Vulnerability Detail API priced?

As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.

Can analysts look up a CVE without writing code?

Yes. Vulnerability Search in Deep Search & Insights opens any CVE in the Deepinfo Platform as one record, with CVSS, EPSS, CISA KEV and CWE together.

What does a request without a CVE ID return?

A 400 application error whose parameters entry names cve with This field is required.

Run It on Your Queue.

Bring a handful of CVE IDs from your current backlog. We set up access and answer schema questions on a short call.

Talk to us about access All API services

Platform

Solutions

Data & API

Resources

Company

One CVE ID Returns Its Whole Prioritization Context.

Here Is Log4Shell as the API Returns It.

Walk Through the Record Block by Block.

Enrich a Scanner Export in a Loop.

Workflows This Call Plugs Into.

Vulnerability Management

Incident Investigation

Compliance and Audit Readiness

Threat Intelligence Operations

Questions About Vulnerability Detail API

Run It on Your Queue.