# Vulnerability Search

URL: https://www.deepinfo.com/platform/dsi/vulnerability-search/

## Search CVEs by Severity, Likelihood and Known Exploitation.

A list sorted by CVSS answers one question: how bad could this be. Vulnerability Search filters Deepinfo’s CVE database field by field, so severity, the EPSS likelihood of exploitation, a CISA KEV listing, the weakness class and the affected product can sit in one query.

Open any result as a full record, or start from a URL and list the vulnerabilities in the technologies it runs.

[Request demo](https://www.deepinfo.com/request-demo/) · [Vulnerability Search reference](https://docs.deepinfo.com/reference/vulnerability/search/) · [Platform guide: Vulnerability search](https://docs.deepinfo.com/guide/dsi/vulnerability-search/)

### Ask for Known-Exploited and Likely CVEs in One Body.

Vulnerability Search takes the same body as Domain Search: `must`, `should` and `must_not` conditions and the operators, plus a sort. Any enrichment field can be a condition.

The sample query asks for CVEs that CISA lists as exploited and that EPSS scores at 0.7 or higher, newest first. Change the threshold, add a vendor or a weakness class, and export the set as JSON or CSV.

- `must` when all must match, `should` for at least one, `must_not` to exclude
- Sort on any field, such as `published`
- Export with `export=true`, as JSON or CSV

[Vulnerability Search reference](https://docs.deepinfo.com/reference/vulnerability/search/)

Request

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "filters": {
    "must": [
      { "name": "enrichment.cisa_kev.date_added",
        "type": "exists", "value": true },
      { "name": "enrichment.epss_score.epss",
        "type": "gte", "value": 0.7 }
    ]
  },
  "sort": [
    { "field": "published", "order": "desc" }
  ]
}'
```

### What the Searchable Fields Cover.

Field names follow the structure of the CVE record, so a filter reads like a path into it.

- **Record**: `id`, `published`, `last_modified`, `status`, descriptions and references
- **CVSS**: Base score, severity, vector and every metric component for v2, v3.0, v3.1 and v4.0, such as `metrics.cvss_metric_v31.cvss_data.attack_vector`
- **vDeep**: Deepinfo’s own CVSS scoring layer, with its components under `enrichment.vdeep_metric`
- **EPSS**: Score, percentile and date, under `enrichment.epss_score`
- **CISA KEV**: Vendor and product, date added, due date, required action and known ransomware campaign use, under `enrichment.cisa_kev`
- **CWE**: Weakness ID and name, CAPEC IDs, the OWASP Top 10 2021 field, scope, impact and detection methods, under `enrichment.cwe`
- **Affected products**: CPE vendor, product and version ranges under `enrichment.cpe`, plus the configuration match criteria

The [Vulnerability Search reference](https://docs.deepinfo.com/reference/vulnerability/search/#ref-filtering) lists the fields under Filtering.

### Open Any CVE as One Complete Record.

Search returns records. Detail returns one, by CVE ID, with everything the database holds on it: all CVSS versions, the EPSS score, the CISA KEV entry, CWE with CAPEC IDs and the affected products.

GET `https://api.deepinfo.com/v1/discovery/vulnerability-detail` [Reference](https://docs.deepinfo.com/reference/vulnerability/detail/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `cve` | string | Required | A CVE ID, for example `CVE-2021-44228`. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/vulnerability-detail",
    params={"cve": "CVE-2021-44228"},
    headers={"apikey": "YOUR_API_KEY"},
)
cve = r.json()
print(cve["enrichment"]["epss_score"]["epss"], cve["cisa_exploit_add"])
```

JavaScript:

```javascript
const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const cve = await r.json()
console.log(cve.enrichment.epss_score.epss, cve.cisa_exploit_add)
```

Response

200 OK · application/json

```json
{
  "id": "CVE-2021-44228",
  "published": "2021-12-10T10:15:09Z",
  "status": "Analyzed",
  "cisa_exploit_add": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "metrics": {
    "cvss_metric_v31": [
      {
        "type": "Primary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "base_score": 10.0,
          "…": "…"
        }
      }
    ],
    "…": "cvss_metric_v40, cvss_metric_v30, cvss_metric_v2"
  },
  "enrichment": {
    "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    "cisa_kev": {
      "vendor_project": "Apache",
      "product": "Log4j2",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability",
      "date_added": "2021-12-10",
      "…": "required_action, due_date, known_ransomware_campaign_use"
    },
    "cwe": [
      { "id": 400, "name": "Uncontrolled Resource Consumption", "capec_id": [147, 227], "…": "…" }
    ],
    "cpe": [ { "vendor": "…", "product": "…", "vulnerable": true, "…": "version ranges" }, "…" ],
    "vdeep_metric": { "cvss_data": { "version": "3.1", "…": "…" } }
  },
  "…": "descriptions, references, configurations"
}
```

### From a URL to the CVEs It Exposes.

The finder starts from a live target instead of a query. Pass an FQDN, an IP address or a URL as `url`.

1. **Load**

   The finder loads the target and records the connection status and the redirect chain.
2. **Fingerprint**

   It detects the technologies the site runs. Each one carries a CPE name, the identifier CVE records use for affected products.
3. **Match**

   The CPE names are matched against the affected products in the CVE database.
4. **Return**

   The response lists the detected technologies with a `vulnerability_stats` summary.

[Vulnerability Finder reference](https://docs.deepinfo.com/reference/vulnerability/finder/)

### One Query per Decision.

#### [Patch Order](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/)

Which CVEs affecting our products are in CISA KEV or above an EPSS threshold, so they go ahead of the rest of the backlog.

#### [Incident Scoping](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/)

Which known vulnerabilities affect the technologies on the host that was hit, and whether any of them are listed as exploited.

#### [Ransomware Exposure](https://www.deepinfo.com/solutions/use-cases/ransomware-exposure-monitoring/)

Which KEV entries are marked as used in ransomware campaigns, and whether any of them touch the products you run.

#### [Supplier Review](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/)

Which CVEs affect a supplier’s product and versions, with the severity and exploitation signal for each one.

### Search Pairs With the Trend View.

Search finds the records. The trend view sits above it, and the technology lookup feeds it CPE names.

- [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/) (DSI): Disclosure volume, KEV additions, severity by year and daily EPSS history.
- [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) (DSI): Technology lookup returns a CPE name for each technology it detects on a site.
- [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) (EASM): This enrichment, applied to the CVEs found on your assets.

### Query This Data Through the API

Everything Deep Search & Insights shows in the Deepinfo Platform is also available as data, through the API and as bulk feeds.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/)
- [Data Feeds](https://www.deepinfo.com/data-api/feeds/)

### Questions About Vulnerability Search

**How is this different from the vulnerabilities EASM finds?**

External Attack Surface Management finds CVEs on the assets you monitor and ranks them for your team. Vulnerability Search queries the CVE database directly, with no assets involved, which is what research, supplier reviews and incident scoping need.

**What is vDeep?**

vDeep is Deepinfo’s own CVSS scoring layer. It sits in each record under `enrichment.vdeep_metric`, next to the CVSS metrics published for the CVE, and it can be searched like any other field.

**Which CVSS versions are included?**

CVSS v2, v3.0, v3.1 and v4.0, wherever they are published for a CVE. Each version keeps its full vector and components, not only the base score.

**How current are EPSS and KEV in a record?**

Each record carries its current EPSS score and percentile, with the date they apply to, and its CISA KEV entry with the date it was added.

**Can the Vulnerability Finder be wrong?**

It matches on the versions a site reports. A vendor backport can fix a flaw without changing that version, so treat each match as a lead to confirm on the host.

**Can we export the results?**

Yes. Add `export=true` with `export_format` (`json` or `csv`) and `export_scope` to the search request.

### Search the CVEs Behind Your Stack.

Book a demo with the vendors, products and versions your team runs. We build the queries with you and open the records behind them.

[Request demo](https://www.deepinfo.com/request-demo/) [Talk to us about API access](https://www.deepinfo.com/contact/)