Request demo

Vulnerability Search

Search CVEs by Severity, Likelihood and Known Exploitation.

A list sorted by CVSS answers one question: how bad could this be. Vulnerability Search filters Deepinfo’s CVE database field by field, so severity, the EPSS likelihood of exploitation, a CISA KEV listing, the weakness class and the affected product can sit in one query.

Open any result as a full record, or start from a URL and list the vulnerabilities in the technologies it runs.

Request demoVulnerability Search referencePlatform guide: Vulnerability search

QueryPOST /discovery/vulnerability-search?page_size=25all applied

  1. must enrichment.cisa_kev.date_added exists true
  2. must enrichment.epss_score.epss gte 0.7
  3. sort published desc

above 0.7, not in KEV: dropped

CVE-2021-44228

RecordCVE-2021-44228

  • CVSS 3.110.0
  • EPSS0.99999
  • KEVdate_added 2021-12-10

Ask for Known-Exploited and Likely CVEs in One Body.

Vulnerability Search takes the same body as Domain Search: must, should and must_not conditions and the operators, plus a sort. Any enrichment field can be a condition.

The sample query asks for CVEs that CISA lists as exploited and that EPSS scores at 0.7 or higher, newest first. Change the threshold, add a vendor or a weakness class, and export the set as JSON or CSV.

  • must when all must match, should for at least one, must_not to exclude
  • Sort on any field, such as published
  • Export with export=true, as JSON or CSV
Vulnerability Search reference
Request 
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "filters": {
    "must": [
      { "name": "enrichment.cisa_kev.date_added",
        "type": "exists", "value": true },
      { "name": "enrichment.epss_score.epss",
        "type": "gte", "value": 0.7 }
    ]
  },
  "sort": [
    { "field": "published", "order": "desc" }
  ]
}'

What the Searchable Fields Cover.

Field names follow the structure of the CVE record, so a filter reads like a path into it.

Recordid, published, last_modified, status, descriptions and references
CVSSBase score, severity, vector and every metric component for v2, v3.0, v3.1 and v4.0, such as metrics.cvss_metric_v31.cvss_data.attack_vector
vDeepDeepinfo’s own CVSS scoring layer, with its components under enrichment.vdeep_metric
EPSSScore, percentile and date, under enrichment.epss_score
CISA KEVVendor and product, date added, due date, required action and known ransomware campaign use, under enrichment.cisa_kev
CWEWeakness ID and name, CAPEC IDs, the OWASP Top 10 2021 field, scope, impact and detection methods, under enrichment.cwe
Affected productsCPE vendor, product and version ranges under enrichment.cpe, plus the configuration match criteria

The Vulnerability Search reference lists the fields under Filtering.

Open Any CVE as One Complete Record.

Search returns records. Detail returns one, by CVE ID, with everything the database holds on it: all CVSS versions, the EPSS score, the CISA KEV entry, CWE with CAPEC IDs and the affected products.

GET https://api.deepinfo.com/v1/discovery/vulnerability-detail Reference
ParameterTypeDescription
cvestringRequiredA CVE ID, for example CVE-2021-44228.

Request

curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "id": "CVE-2021-44228",
  "published": "2021-12-10T10:15:09Z",
  "status": "Analyzed",
  "cisa_exploit_add": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "metrics": {
    "cvss_metric_v31": [
      {
        "type": "Primary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "base_score": 10.0,
          "…": "…"
        }
      }
    ],
    "…": "cvss_metric_v40, cvss_metric_v30, cvss_metric_v2"
  },
  "enrichment": {
    "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    "cisa_kev": {
      "vendor_project": "Apache",
      "product": "Log4j2",
      "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability",
      "date_added": "2021-12-10",
      "…": "required_action, due_date, known_ransomware_campaign_use"
    },
    "cwe": [
      { "id": 400, "name": "Uncontrolled Resource Consumption", "capec_id": [147, 227], "…": "…" }
    ],
    "cpe": [ { "vendor": "…", "product": "…", "vulnerable": true, "…": "version ranges" }, "…" ],
    "vdeep_metric": { "cvss_data": { "version": "3.1", "…": "…" } }
  },
  "…": "descriptions, references, configurations"
}

From a URL to the CVEs It Exposes.

The finder starts from a live target instead of a query. Pass an FQDN, an IP address or a URL as url.

  1. 01

    Load

    The finder loads the target and records the connection status and the redirect chain.

  2. 02

    Fingerprint

    It detects the technologies the site runs. Each one carries a CPE name, the identifier CVE records use for affected products.

  3. 03

    Match

    The CPE names are matched against the affected products in the CVE database.

  4. 04

    Return

    The response lists the detected technologies with a vulnerability_stats summary.

Vulnerability Finder reference

One Query per Decision.

Patch Order

Which CVEs affecting our products are in CISA KEV or above an EPSS threshold, so they go ahead of the rest of the backlog.

Use case

Incident Scoping

Which known vulnerabilities affect the technologies on the host that was hit, and whether any of them are listed as exploited.

Use case

Ransomware Exposure

Which KEV entries are marked as used in ransomware campaigns, and whether any of them touch the products you run.

Use case

Supplier Review

Which CVEs affect a supplier’s product and versions, with the severity and exploitation signal for each one.

Use case

Search Pairs With the Trend View.

Search finds the records. The trend view sits above it, and the technology lookup feeds it CPE names.

DSI Vulnerability Intelligence Disclosure volume, KEV additions, severity by year and daily EPSS history. Read DSI Instant Lookups Technology lookup returns a CPE name for each technology it detects on a site. Read EASM Risk Detection This enrichment, applied to the CVEs found on your assets. Read

Query This Data Through the API

Everything Deep Search & Insights shows in the Deepinfo Platform is also available as data, through the API and as bulk feeds.

Questions About Vulnerability Search

How is this different from the vulnerabilities EASM finds?

External Attack Surface Management finds CVEs on the assets you monitor and ranks them for your team. Vulnerability Search queries the CVE database directly, with no assets involved, which is what research, supplier reviews and incident scoping need.

What is vDeep?

vDeep is Deepinfo’s own CVSS scoring layer. It sits in each record under enrichment.vdeep_metric, next to the CVSS metrics published for the CVE, and it can be searched like any other field.

Which CVSS versions are included?

CVSS v2, v3.0, v3.1 and v4.0, wherever they are published for a CVE. Each version keeps its full vector and components, not only the base score.

How current are EPSS and KEV in a record?

Each record carries its current EPSS score and percentile, with the date they apply to, and its CISA KEV entry with the date it was added.

Can the Vulnerability Finder be wrong?

It matches on the versions a site reports. A vendor backport can fix a flaw without changing that version, so treat each match as a lead to confirm on the host.

Can we export the results?

Yes. Add export=true with export_format (json or csv) and export_scope to the search request.

Search the CVEs Behind Your Stack.

Book a demo with the vendors, products and versions your team runs. We build the queries with you and open the records behind them.

Request demo Talk to us about API access