Given a single CVE ID, this endpoint searches every V3 index your token can reach and returns each matching document in one aggregated response. It is the quickest way to see everything VulnCheck holds on a vulnerability — advisories, exploits, threat intelligence, KEV entries, scoring, and vendor data — without querying each index in turn.
cve is the only required parameter. It must be a well-formed CVE identifier; anything else is rejected with a 400.
Results are scoped to your entitlements. Indices your token cannot access are filtered out silently rather than raising an error, so _meta.queried_index_count reports how many indices were actually searched for you.
Results are paginated: by default the endpoint returns the first 500 matching documents. Two independent pagination modes are available and they cannot be combined — see below.
CVE-2025-20654. The value must be a well-formed CVE ID. A missing or malformed value returns a 400.500; the maximum is 1000. Values above the maximum are clamped to 1000 rather than rejected, and non-numeric or non-positive values fall back to the default.The endpoint supports two mutually exclusive pagination modes. Combining page with either cursor parameter returns a 400.
1.page multiplied by limit must not exceed 10000 — see ._meta.next_cursor value from the previous response to fetch the next page.cursor with an empty value.Every response carries a _meta object describing the current page:
| Field | Description |
|---|---|
timestamp | When the query was executed, in UTC. |
cve | The CVE identifier that was searched for. |
page | The 1-indexed page returned. |
limit | The page size applied to this request. |
total_count | The total number of documents matching the CVE, across every index searched. |
current_count | The number of documents returned in this response. |
total_pages | total_count divided by limit, rounded up. Page mode only. |
queried_index_count | The number of indices searched, after your entitlements were applied. |
indices_with_hits | The number of those indices that contained at least one match. |
top_index_counts | The indices with the most matches, and their document counts. Capped at 10 entries. |
next_cursor | The cursor to pass to fetch the next page. Cursor mode only. |
Pass page and limit. This mode populates total_pages, so you can tell up front how many requests you need.
total_count reports every match, but only the first 10,000 are reachable this way. Requests where page multiplied by limit exceeds 10000 are rejected with a 400:
{
"error": true,
"errors": [
"failed executing cve search query: All attempts fail:\n#1: Status: 400, Type: search_phase_execution_exception, Reason: all shards failed ... Reason: Result window is too large, from + size must be less than or equal to: [10000] but was [11000] ..."
]
}
Use cursor mode instead for any CVE with more than 10,000 matching documents.
Pass cursor with an empty value to start, then feed _meta.next_cursor back in on each subsequent request. This mode walks the full result set with no depth limit, but does not populate total_pages.
next_cursor is only returned when current_count equals limit. When a response returns fewer documents than you asked for, you have reached the end of the result set and should stop — there is no trailing request that comes back empty.
In cursor mode _meta.page is always reported as 1; it does not track your position. Use the cursor itself for that.
data is a flat array of matching documents drawn from across the indices. Each entry describes where the document came from as well as its contents:
| Field | Description |
|---|---|
index | The name of the index the document was found in. |
id | The document's unique identifier within that index. |
score | The relevance score. Higher is more relevant, and results are returned in descending score order. |
source | The full document. Its structure varies by index — see the documentation for the index named in index. |
Because source is the raw index document, the shape of entries in data is not uniform across a single response. Read index first, then parse source accordingly.
curl --request GET \
--url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=3" \
--header "Accept: application/json" \
--header "Authorization: Bearer insert_token_here"
{
"_benchmark": 1.319464,
"_meta": {
"timestamp": "2026-08-28T11:19:19.867546203Z",
"cve": "CVE-2025-20654",
"page": 1,
"limit": 3,
"total_count": 36,
"current_count": 3,
"total_pages": 12,
"queried_index_count": 475,
"indices_with_hits": 23,
"top_index_counts": [
{ "index": "advisories", "doc_count": 11 },
{ "index": "macert", "doc_count": 2 },
{ "index": "mediatek", "doc_count": 2 },
{ "index": "mitre-attack-cve", "doc_count": 2 },
{ "index": "alibaba-advs", "doc_count": 1 },
{ "index": "bdu", "doc_count": 1 },
{ "index": "cnnvd", "doc_count": 1 },
{ "index": "cves_identity_mappings", "doc_count": 1 },
{ "index": "epss", "doc_count": 1 },
{ "index": "euvd", "doc_count": 1 }
]
},
"data": [
{
"index": "advisories",
"id": "d38a1df50f6723bdb672995d2db7e588",
"score": 30.4604,
"source": {
"external_id": [],
"url": "http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202504-1044",
"tags": [
"Government Advisory",
"VDB Entry"
],
"date_added": "2025-04-07T00:00:00Z",
"refsource": "cnnvd",
"cve": [
"CVE-2025-20654"
],
"name": "MediaTek Chipsets 安全漏洞",
"lang": "cn",
"_timestamp": "2025-04-09T00:42:44.021248Z"
}
},
{
"index": "advisories",
"id": "2ae88c424ec0628fbe7f80456a00f949",
"score": 30.40173,
"source": {
"external_id": [],
"url": "https://github.com/github/advisory-database/blob/main/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json",
"tags": [
"VDB Entry"
],
"date_added": "2025-04-07T06:30:27Z",
"refsource": "ghsa",
"cve": [
"CVE-2025-20654"
],
"name": "GHSA Advisory",
"lang": "en",
"_timestamp": "2025-04-07T10:34:55.927322Z"
}
}
]
}
Send cursor with no value to request the first page.
curl --request GET \
--url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=2&cursor" \
--header "Accept: application/json" \
--header "Authorization: Bearer insert_token_here"
_meta.next_cursor is present because current_count equals limit, so more results are available. Note that total_pages is absent in this mode.
{
"_meta": {
"timestamp": "2026-08-28T11:19:30.402323776Z",
"cve": "CVE-2025-20654",
"page": 1,
"limit": 2,
"total_count": 36,
"current_count": 2,
"queried_index_count": 475,
"indices_with_hits": 23,
"top_index_counts": [
{ "index": "advisories", "doc_count": 11 },
{ "index": "macert", "doc_count": 2 }
],
"next_cursor": "WzMwLjM4NTc3MywiYWR2aXNvcmllcyIsIjJhZTg4YzQyNGVjMDYyOGZiZTdmODA0NTZhMDBmOTQ5Il0="
},
"data": [
{
"index": "advisories",
"id": "d38a1df50f6723bdb672995d2db7e588",
"score": 30.4604,
"source": { "...": "..." }
},
{
"index": "advisories",
"id": "2ae88c424ec0628fbe7f80456a00f949",
"score": 30.385773,
"source": { "...": "..." }
}
]
}
Pass the next_cursor value from the previous response.
curl --request GET \
--url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=2&cursor=WzMwLjM4NTc3MywiYWR2aXNvcmllcyIsIjJhZTg4YzQyNGVjMDYyOGZiZTdmODA0NTZhMDBmOTQ5Il0=" \
--header "Accept: application/json" \
--header "Authorization: Bearer insert_token_here"
{
"_meta": {
"cve": "CVE-2025-20654",
"limit": 2,
"total_count": 36,
"current_count": 2,
"queried_index_count": 475,
"indices_with_hits": 23,
"next_cursor": "WzI5LjU5Nzc3LCJhZHZpc29yaWVzIiwiNTE4NTdhZWU5ODNhOGVkNDNhNzQ5YWViNTFmZGFjNzYiXQ=="
},
"data": [
{
"index": "advisories",
"id": "4df2e4e22c55de1a2a5991453cb72651",
"score": 29.59777,
"source": {
"external_id": [],
"url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/20xxx/CVE-2025-20654.json",
"tags": [
"Government Advisory"
],
"date_added": "2025-04-07T03:14:45Z",
"refsource": "vulnrichment",
"cve": [
"CVE-2025-20654"
],
"name": "VULNRICHMENT Advisory",
"lang": "en",
"_timestamp": "2025-04-07T17:37:04.927385Z"
}
}
]
}
A missing or malformed cve returns a 400:
{
"error": true,
"errors": [
"invalid endpoint parameters: cve is required"
]
}
{
"error": true,
"errors": [
"invalid endpoint parameters: invalid cve format"
]
}
Mixing the two pagination modes returns a 400:
{
"error": true,
"errors": [
"invalid endpoint parameters: invalid endpoint parameter: page cannot be combined with cursor pagination"
]
}