CVE Vulnerability API: VulnCheck KEV, Exploits, NVD++ and CPE

Pull CVE vulnerability and exploit intelligence from the VulnCheck API with your own token, as one clean dataset row per CVE record, search hit, CPE or package.

VulnCheck is a vulnerability and exploit intelligence platform. Its API on api.vulncheck.com serves VulnCheck KEV (known exploited vulnerabilities, a superset of CISA KEV), NVD++ (the NIST NVD 2.0 data with CVSS scores, served reliably), exploit intelligence with exploit maturity, counts and timelines, initial access detection artifacts, EPSS scores, threat actor, ransomware and botnet links, and hundreds of advisory feeds. This actor wraps the documented v3 read routes so you can prioritize patching, enrich vulnerability scanner output, check an SBOM for vulnerable packages, and feed CVE data into SIEM tools, ticketing, BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every route, parameter and field comes from the OpenAPI document VulnCheck serves at api.vulncheck.com/v3/openapi and the docs at docs.vulncheck.com. The routes were probed on 2026-10-25 with an invalid token, and the actor has not been run against a live VulnCheck token.

What it does

• Index query: read any of 31 VulnCheck indexes by CVE ID, alias, threat actor, MITRE ATT&CK group, ransomware family, botnet, published date or last modified date, following VulnCheck's server side cursor through as many pages as you ask for. VulnCheck KEV is the default.
• VulnCheck KEV and CISA KEV: vendor, product, vulnerability name, required action, due date, known ransomware use, CWE IDs, the VulnCheck exploit database (XDB) entries and the public evidence of exploitation.
• NVD++ (nist-nvd2) and VulnCheck NVD V2: the NVD 2.0 CVE record with descriptions, CVSS v4.0, v3.1, v3.0 and v2 metrics, weaknesses, references, configurations and VulnCheck's own vulnerable CPEs.
• Exploit intelligence (exploits index): max exploit maturity (weaponized or POC), public, commercial and weaponized exploit flags, exploited by threat actors, ransomware, botnets or honeypots, EPSS, the full exploit list with validation levels and the exploitation timeline. Filter by maturity, validation level, CISA KEV or VulnCheck KEV.
• CVE search across all indexes: every document VulnCheck holds on a CVE (advisories, exploits, KEV entries, scoring, vendor data), each with its index name and full source.
• CPE lookup and CPE search: the CVEs tied to a CPE string, or to a vendor, product and version, optionally only where that product is the vulnerable component.
• PURL lookup: the CVEs and fixed versions of an open source package version (npm, PyPI, Go, Maven, NuGet and the other supported package managers).
• Index list: the indexes your token is licensed for, with descriptions and endpoint links.
• Pay only for results: empty, malformed and refused lookups are recorded as a free row that says why, never charged.

How to use it

1. Sign in at vulncheck.com (a free community account reaches VulnCheck KEV, NVD++ and other community data) and create a token at vulncheck.com/settings/tokens. Exploit intelligence, initial access intelligence and most other indexes need a paid VulnCheck subscription.
2. Paste the token into the API token field (or set the DATA_API_KEY secret). It is sent only to api.vulncheck.com in the Authorization header and is removed from everything the actor logs.
3. Pick a mode, add CVE IDs, CPEs or package URLs (or index filters), and start the run. Download the rows as JSON, CSV or Excel, or call the actor from your own code.

A missing or rejected token, an index your plan does not cover or an empty input ends the run cleanly with a status message that says what to change. Tokens unused for 30 days expire on VulnCheck's side.

Input

Field	Modes	Description
mode	all	indexQuery (default), cveSearch, cpeLookup, cpeSearch, purlLookup or indexList
index	Index query	One of 31 indexes, such as vulncheck-kev, nist-nvd2, exploits, initial-access, epss, cisa-kev
cves	Index query, CVE search	CVE IDs such as CVE-2024-4577, one per line
alias, threatActor, mitreId, ransomware, botnet	Index query	Optional documented filters
pubStartDate, pubEndDate, lastModStartDate, lastModEndDate	Index query	Optional dates as YYYY-MM-DD
exploitMaturity, validationLevels, inKev, inVcKev	Index query on exploits	Optional exploit filters
sort, order	Index query	_timestamp or date_added, asc or desc
cpes	CPE lookup	CPE strings in v2.3 or v2.2 form
cpePart, cpeVendor, cpeProduct, cpeVersion	CPE search	CPE fields; set a vendor, a product or both
isVulnerable	CPE lookup, CPE search	Only CVEs where the CPE itself is vulnerable
purls	PURL lookup	Package URLs such as pkg:npm/lodash@4.17.20
maxResults	all	Most rows to return and charge for
requestsPerMinute	all	Pacing for calls to VulnCheck (community limit 1,000 a minute)
apiKey	all	Your VulnCheck API token (secret)

Output

Index rows keep every field VulnCheck returns, plus flat columns that are easy to filter: cve, cves, title, description, vendor, product, published, lastModified, dateAdded, cvssScore, cvssSeverity, cvssVersion, cvssVector, epssScore, epssPercentile, inKev, inVcKev, exploitMaturity, exploitCount and reportedExploited. CVE search rows add hitId, score and the full source document under record. CPE rows carry cpe, cpeStruct, cves and cveCount; PURL rows carry purl, purlStruct, cves, vulnerabilities and fixedVersions. A refused or empty lookup has found set to false and a note with VulnCheck's own words.

Example VulnCheck KEV row (values from the VulnCheck documentation sample, lists shortened):

{
    "mode": "indexQuery",
    "modeLabel": "Index query",
    "recordType": "indexRecord",
    "index": "vulncheck-kev",
    "query": "CVE-2024-4577",
    "found": true,
    "cve": "CVE-2024-4577",
    "cves": ["CVE-2024-4577"],
    "title": "PHP-CGI OS Command Injection Vulnerability",
    "description": "PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.",
    "vendor": "PHP Group",
    "product": "PHP",
    "dateAdded": "2024-06-07T00:00:00Z",
    "inKev": true,
    "inVcKev": true,
    "exploitCount": 1,
    "reportedExploited": true,
    "vendorProject": "PHP Group",
    "vulnerabilityName": "PHP-CGI OS Command Injection Vulnerability",
    "required_action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
    "knownRansomwareCampaignUse": "Known",
    "cwes": ["CWE-78"],
    "vulncheck_xdb": [
        { "xdb_id": "081170ce66e7", "xdb_url": "https://vulncheck.com/xdb/081170ce66e7", "date_added": "2024-06-18T13:19:21Z", "exploit_type": "initial-access" }
    ],
    "vulncheck_reported_exploitation": [
        { "url": "https://x.com/Shadowserver/status/1799053497490698548", "date_added": "2024-06-07T00:00:00Z" }
    ],
    "reported_exploited_by_vulncheck_canaries": true,
    "dueDate": "2024-07-03T00:00:00Z",
    "cisa_date_added": "2024-06-12T00:00:00Z",
    "retrievedAt": "2026-10-25T12:00:00.000Z",
    "note": null
}

Pricing

Event	Price	Charged for
vulnerability-record	0.008 USD	Each document read from an index
cve-search-hit	0.005 USD	Each document found by CVE search
cpe-vulnerabilities	0.008 USD	Each CPE returned with its CVEs
package-vulnerabilities	0.01 USD	Each package URL returned with its CVEs and fixed versions
index-listed	0.005 USD	Each index in the index list

Empty, malformed and refused lookups are never charged. Your VulnCheck plan is billed separately by VulnCheck.

FAQ

What is the VulnCheck API?

The VulnCheck API is the programmatic interface to VulnCheck's exploit and vulnerability intelligence platform, run by VulnCheck Inc. Version 3 at api.vulncheck.com/v3 exposes hundreds of indexes (VulnCheck KEV, NVD++, exploits, initial access, EPSS, advisories), a cross index CVE search and CPE and PURL vulnerability lookups, all with a Bearer token.

Do I need my own VulnCheck token?

Yes. This is a bring your own key actor: it calls VulnCheck with your token, under your plan, its rate limit and its terms. Create a token at vulncheck.com/settings/tokens after signing in.

Can I use a free VulnCheck community account?

Yes, for the community data: VulnCheck KEV, NVD++ (nist-nvd2) and the other indexes VulnCheck opens to community users. The Index list mode shows exactly which indexes your token reaches. Exploit intelligence, initial access intelligence and most advisory indexes need a paid subscription, and VulnCheck answers HTTP 402 or 403 for them, which ends the run with a clear message.

What is the difference between VulnCheck KEV and CISA KEV?

CISA KEV is the US government catalog of known exploited vulnerabilities. VulnCheck KEV tracks every vulnerability publicly reported as exploited in the wild, usually earlier and with more entries than CISA KEV, and adds the evidence links and exploit database references. Both are indexes here; the inKev and inVcKev columns show membership.

How do I prioritize CVEs for patching?

Query the exploits index with your CVE IDs: exploitMaturity (weaponized or POC), reportedExploited, inKev, inVcKev, epssScore and exploitCount sit side by side in each row. Weaponized, in KEV and a high EPSS score is the strongest signal to patch first.

How do I check an SBOM or dependency list for vulnerabilities?

Use PURL lookup with one package URL per dependency, such as pkg:npm/lodash@4.17.20. Each row lists the CVEs and the fixed versions VulnCheck knows for that exact package version. For commercial software use CPE lookup or CPE search instead.

How do I sync NVD data incrementally?

Run Index query on nist-nvd2 (or vulncheck-nvd2) with a last modified from date and a high maximum results. The actor follows VulnCheck's cursor through every page. For a full copy of an index, VulnCheck offers offline backups to licensed customers directly; this actor does not download them.

What do I pay?

Pay per result: 0.005 USD per CVE search hit or index listing, 0.008 USD per index record or CPE, and 0.01 USD per package lookup. Empty and refused lookups are free. See the pricing table above.

Keyword map

CVE API, vulnerability API, CVE database API, exploit intelligence API, known exploited vulnerabilities API, KEV API, VulnCheck KEV, CISA KEV, NVD API alternative, NVD++ API, CVSS score lookup, EPSS score API, exploit maturity, weaponized exploit check, initial access intelligence, CPE to CVE lookup, CPE search, PURL vulnerability lookup, SBOM vulnerability scan, open source package vulnerabilities, vulnerability prioritization, patch prioritization, threat actor CVE, ransomware CVE, VulnCheck API, VulnCheck CVE search.

Routes and verification

Routes taken from VulnCheck's own OpenAPI document (api.vulncheck.com/v3/openapi) and docs: GET /v3/index, /v3/index/{index}, /v3/search/cve, /v3/search/cpe, /v3/cpe and /v3/purl. A probe on 2026-10-25 with an invalid token answered every route, and invented paths too, with 401 {"error":true,"errors":["unauthorized"]}: VulnCheck checks the token before the route, so the probe confirms the token handling but cannot tell real routes from invented ones. The /v3/backup bulk download routes and the POST routes are deliberately not wrapped.

Licensing and data use

This actor works only with your own VulnCheck account and token, and every request is made under that token's licence. VulnCheck's Service Terms grant a personal, non sublicensable, non transferable licence and forbid distributing, renting or otherwise transferring the Service or using it for the benefit of a third party outside the terms. Do not republish or resell what you pull here unless your VulnCheck agreement allows it. VulnCheck KEV and NVD++ community data may be used in your own products at no cost with prominent attribution to VulnCheck, as the VulnCheck attribution notices describe. This actor is not affiliated with or endorsed by VulnCheck.