Vulnerability Intelligence & CVE Prioritization API
Look up any CVE or software dependency and get more than a CVSS score. Every response tells you whether it's actively exploited (CISA KEV), how likely exploitation is (FIRST EPSS) and how severe it is (NVD), combined into one P1-P5 priority verdict. Scan dependencies across PyPI, npm, Go, Maven and more via OSV, with the versions that fix each issue. Built for vulnerability management, SBOM scanning, SOC enrichment and patch prioritisation.
From CVE to decision, in one call
Anyone can echo a CVSS score. The question that matters is "do I need to patch this tonight?" So every response combines severity, real-world exploitation and exploit probability into an action.
A 0-100 fix-first score
One sortable number that fuses CVSS, CISA KEV, EPSS and public-exploit signals, weighted to real-world risk. An actively-exploited medium outranks a quiet critical, so you patch what actually matters first.
Rank a whole backlog
Send up to 100 CVEs (or your scanner output) in one call and get them back sorted fix-first, with a per-tier summary. Stop looping and writing your own prioritisation.
Is it weaponized?
Real exploitation intelligence, not just a flag: whether a working Metasploit module, Nuclei template or Exploit-DB entry exists, plus CISA KEV and ransomware use. The signal the expensive tools charge for.
Dependency & SBOM scanning
"Is django 3.0 vulnerable?" across PyPI, npm, Go, Maven, RubyGems, crates.io, NuGet & Packagist (OSV). Each vuln is prioritised, with the versions that fix it.
What just became exploited
A live feed of CVEs newly added to CISA KEV, newest first, with EPSS. Wire it to a daily SOC digest so you hear about active exploitation the day it lands.
Cited & current
Every response names its sources (NVD, CISA, FIRST, OSV) and snapshot date. Data refreshes daily, because stale vulnerability data is its own risk.
Simple GET requests, structured JSON
No SDK required. A CVE or a dependency in, a prioritised verdict out. Agent- and MCP-friendly.
# should I panic about Log4Shell? GET /cve?id=CVE-2021-44228 { "cvss": 10.0, "kev": true, "epss": 0.975, "exploitation": { "weaponized": true, "metasploit": true, "nuclei": true, "exploit_db": true }, "priority": { "tier": "P1", "score": 100, "reason": "actively exploited in ransomware campaigns; 97%" } }
# is this dependency version vulnerable? GET /package?ecosystem=PyPI&name=django&version=3.0 { "vulnerable": true, "vuln_count": 31, "highest_priority": "P2", "vulnerabilities": [{ "cve": "CVE-2020-7471", "cvss": 9.8, "priority": {"tier": "P2"}, "fixed_versions": ["2.2.10", "3.0.3"] }] }
# rank a whole list fix-first (paste your scanner output) GET /cve/batch?ids=CVE-2021-44228,CVE-2019-19844,CVE-2014-0160 { "requested": 3, "resolved": 3, "by_tier": { "P1": 2, "P2": 1 }, "results": [ { "id": "CVE-2021-44228", "priority": { "score": 100, "tier": "P1" }, "kev": true, "exploit_available": true }, { "id": "CVE-2014-0160", "priority": { "score": 84, "tier": "P1" } }, { "id": "CVE-2019-19844", "priority": { "score": 35, "tier": "P2" } } ] }
Ten simple endpoints
Every endpoint is a GET with query params, returning JSON. Open the interactive reference →
| Endpoint | What it does |
|---|---|
| GET /cve | One CVE → CVSS + KEV + EPSS + exploit signals + P1-P5 verdict + 0-100 score |
| GET /cve/batch | Up to 100 CVEs ranked fix-first (GET or POST) with a per-tier summary |
| GET /cve/search | Search CVEs by keyword, CPE or severity, enriched |
| GET /cve/recent | Recently published CVEs (last N days), enriched |
| GET /package | Dependency vulns (OSV) + priority + fixed versions. PyPI, npm, Go, Maven & more |
| GET /osv | One OSV / GHSA advisory by id, enriched |
| GET /kev/recent | CVEs newly added to CISA KEV, newest first (monitoring feed) |
| GET /kev | CISA KEV catalog (vendor, product, ransomware filters) |
| GET /epss | EPSS exploit-probability score + percentile for a CVE |
| GET / | Service metadata & endpoint index |
Built on open, authoritative data
No relicensed black boxes. Authoritative sources, aggregated and composed into one verdict, and every response cites where each signal came from and its snapshot date. When NVD has not scored a CVE yet, we fall back to CVE.org so you never get "unknown severity".
Start free, scale when you're ready
Free tier to evaluate every endpoint. Paid plans with flat, transparent pricing. No seats, no sales calls. Query from a browser, curl or an LLM agent.