API Reference

Search CVEs

Search the CVE catalogue by keyword or CVE-ID prefix. Keyword queries resolve through the CPE product and vendor taxonomy, matching the same logic as the platform's vulnerability search. Use it to find all CVEs affecting a product, vendor, or technology without knowing the exact CPE string.

GET

/v1/cve/search

Cost: 1 credit per successful call

Query parameters

qstringrequired

The search term. Accepts two forms:

CVE-ID prefix - CVE-2024-3, 2021-44228 - matched against NVD.Id.
Keyword - apache http server, nginx, log4j - resolved through product and vendor names to find associated CVEs.

Minimum 2 characters, maximum 200.

limitintegeroptionaldefault 25

Maximum number of CVEs to return per page. Accepted range: 1–200.

offsetintegeroptionaldefault 0

Number of results to skip for pagination. Accepted range: 0–10 000.

Request

curl "https://api.edgeprotect.io/functions/v1/cve/search?q=apache+http+server&limit=25&offset=0" \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY"

Response

{
  "data": {
    "count": 13251,
    "items": [
      {
        "id": "CVE-2026-49268",
        "description": "A remote attacker can inject arbitrary commands via crafted HTTP requests in Apache HTTP Server before 2.4.62.",
        "published": "2026-06-17T14:17:56.903Z",
        "severity": {
          "cvss_score": 9.1,
          "cvss_version": "3.1",
          "cvss_level": "CRITICAL"
        },
        "epss_score": 0.00494,
        "is_kev": false
      },
      {
        "id": "CVE-2026-48972",
        "description": "mod_rewrite in Apache HTTP Server 2.4.59 allows SSRF via crafted RewriteRule directives.",
        "published": "2026-06-10T08:22:11.450Z",
        "severity": {
          "cvss_score": 7.5,
          "cvss_version": "3.1",
          "cvss_level": "HIGH"
        },
        "epss_score": 0.01832,
        "is_kev": false
      }
    ],
    "query": "apache http server",
    "has_more": true
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-10-27T14:30:00.000Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Total number of matching CVEs across all pages.

data.itemsarrayoptional

The current page of CVE results, sorted by publication date descending.

data.items[].idstringoptional

CVE identifier (e.g. CVE-2021-44228).

data.items[].descriptionstringoptional

English-language description from the NVD.

data.items[].publishedstringoptional

ISO 8601 UTC timestamp of when this CVE was published to the NVD.

data.items[].severityobjectoptional

CVSS scoring, preferring v3.1 over v3.0 over v2. Absent when no CVSS data exists.

data.items[].severity.cvss_scorenumberoptional

Base CVSS score (0.0–10.0).

data.items[].severity.cvss_versionstringoptional

CVSS version used (3.1, 3.0, or 2.0).

data.items[].severity.cvss_levelstringoptional

Qualitative severity: CRITICAL, HIGH, MEDIUM, LOW, or NONE.

data.items[].epss_scorenumberoptional

EPSS exploit-probability score (0.0–1.0). Absent when EPSS has no model for this CVE.

data.items[].is_kevbooleanoptional

Whether this CVE is in the CISA Known Exploited Vulnerabilities catalogue.

data.querystringoptional

The search term as received (echoed back for correlation).

data.has_morebooleanoptional

true when more pages exist beyond the current offset + limit.

Keyword resolution

Keyword queries split into tokens and match against both product and vendor names in the CPE taxonomy. A search for "apache http server" matches the vendor apache and the product http_server, surfacing all CVEs attributed to either. Multi-word queries cast a wider net than single-word ones; use the vendor-specific /cve/by-vendor endpoint when you want only one vendor's top CVEs.

Errors

Status	`error`	When
400	`missing_q`	The `q` parameter is absent or empty.
400	`invalid_q`, `invalid_limit`, `invalid_offset`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.