API Resources

GET
/v3/search/cve

Search every accessible index for records referencing a CVE

Given a single CVE ID, this endpoint searches every V3 index your token can reach and returns each matching document in one aggregated response. It is the quickest way to see everything VulnCheck holds on a vulnerability — advisories, exploits, threat intelligence, KEV entries, scoring, and vendor data — without querying each index in turn.

cve is the only required parameter. It must be a well-formed CVE identifier; anything else is rejected with a 400.

Results are scoped to your entitlements. Indices your token cannot access are filtered out silently rather than raising an error, so _meta.queried_index_count reports how many indices were actually searched for you.

Results are paginated: by default the endpoint returns the first 500 matching documents. Two independent pagination modes are available and they cannot be combined — see below.

Query Parameters

cve
string required
The CVE identifier to search for, for example CVE-2025-20654. The value must be a well-formed CVE ID. A missing or malformed value returns a 400.
limit
integer
The number of documents to return per page. Defaults to 500; the maximum is 1000. Values above the maximum are clamped to 1000 rather than rejected, and non-numeric or non-positive values fall back to the default.

Pagination Parameters

The endpoint supports two mutually exclusive pagination modes. Combining page with either cursor parameter returns a 400.

page
integer
Page mode. The 1-indexed page of results to return. Defaults to 1.page multiplied by limit must not exceed 10000 — see .
cursor
string
Cursor mode. Pass the parameter with an empty value to begin cursor paging, then pass the _meta.next_cursor value from the previous response to fetch the next page.
start_cursor
string
Cursor mode. An alternative way to begin cursor paging, equivalent to sending cursor with an empty value.

Pagination

Every response carries a _meta object describing the current page:

FieldDescription
timestampWhen the query was executed, in UTC.
cveThe CVE identifier that was searched for.
pageThe 1-indexed page returned.
limitThe page size applied to this request.
total_countThe total number of documents matching the CVE, across every index searched.
current_countThe number of documents returned in this response.
total_pagestotal_count divided by limit, rounded up. Page mode only.
queried_index_countThe number of indices searched, after your entitlements were applied.
indices_with_hitsThe number of those indices that contained at least one match.
top_index_countsThe indices with the most matches, and their document counts. Capped at 10 entries.
next_cursorThe cursor to pass to fetch the next page. Cursor mode only.

Page mode

Pass page and limit. This mode populates total_pages, so you can tell up front how many requests you need.

total_count reports every match, but only the first 10,000 are reachable this way. Requests where page multiplied by limit exceeds 10000 are rejected with a 400:

{
  "error": true,
  "errors": [
    "failed executing cve search query: All attempts fail:\n#1: Status: 400, Type: search_phase_execution_exception, Reason: all shards failed ... Reason: Result window is too large, from + size must be less than or equal to: [10000] but was [11000] ..."
  ]
}

Use cursor mode instead for any CVE with more than 10,000 matching documents.

Cursor mode

Pass cursor with an empty value to start, then feed _meta.next_cursor back in on each subsequent request. This mode walks the full result set with no depth limit, but does not populate total_pages.

next_cursor is only returned when current_count equals limit. When a response returns fewer documents than you asked for, you have reached the end of the result set and should stop — there is no trailing request that comes back empty.

In cursor mode _meta.page is always reported as 1; it does not track your position. Use the cursor itself for that.

Response Fields

data is a flat array of matching documents drawn from across the indices. Each entry describes where the document came from as well as its contents:

FieldDescription
indexThe name of the index the document was found in.
idThe document's unique identifier within that index.
scoreThe relevance score. Higher is more relevant, and results are returned in descending score order.
sourceThe full document. Its structure varies by index — see the documentation for the index named in index.

Because source is the raw index document, the shape of entries in data is not uniform across a single response. Read index first, then parse source accordingly.

Example Requests

Search every accessible index for a CVE

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=3" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

{
  "_benchmark": 1.319464,
  "_meta": {
    "timestamp": "2026-08-28T11:19:19.867546203Z",
    "cve": "CVE-2025-20654",
    "page": 1,
    "limit": 3,
    "total_count": 36,
    "current_count": 3,
    "total_pages": 12,
    "queried_index_count": 475,
    "indices_with_hits": 23,
    "top_index_counts": [
      { "index": "advisories", "doc_count": 11 },
      { "index": "macert", "doc_count": 2 },
      { "index": "mediatek", "doc_count": 2 },
      { "index": "mitre-attack-cve", "doc_count": 2 },
      { "index": "alibaba-advs", "doc_count": 1 },
      { "index": "bdu", "doc_count": 1 },
      { "index": "cnnvd", "doc_count": 1 },
      { "index": "cves_identity_mappings", "doc_count": 1 },
      { "index": "epss", "doc_count": 1 },
      { "index": "euvd", "doc_count": 1 }
    ]
  },
  "data": [
    {
      "index": "advisories",
      "id": "d38a1df50f6723bdb672995d2db7e588",
      "score": 30.4604,
      "source": {
        "external_id": [],
        "url": "http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202504-1044",
        "tags": [
          "Government Advisory",
          "VDB Entry"
        ],
        "date_added": "2025-04-07T00:00:00Z",
        "refsource": "cnnvd",
        "cve": [
          "CVE-2025-20654"
        ],
        "name": "MediaTek Chipsets 安全漏洞",
        "lang": "cn",
        "_timestamp": "2025-04-09T00:42:44.021248Z"
      }
    },
    {
      "index": "advisories",
      "id": "2ae88c424ec0628fbe7f80456a00f949",
      "score": 30.40173,
      "source": {
        "external_id": [],
        "url": "https://github.com/github/advisory-database/blob/main/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json",
        "tags": [
          "VDB Entry"
        ],
        "date_added": "2025-04-07T06:30:27Z",
        "refsource": "ghsa",
        "cve": [
          "CVE-2025-20654"
        ],
        "name": "GHSA Advisory",
        "lang": "en",
        "_timestamp": "2025-04-07T10:34:55.927322Z"
      }
    }
  ]
}

Start cursor paging

Send cursor with no value to request the first page.

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=2&cursor" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

_meta.next_cursor is present because current_count equals limit, so more results are available. Note that total_pages is absent in this mode.

{
  "_meta": {
    "timestamp": "2026-08-28T11:19:30.402323776Z",
    "cve": "CVE-2025-20654",
    "page": 1,
    "limit": 2,
    "total_count": 36,
    "current_count": 2,
    "queried_index_count": 475,
    "indices_with_hits": 23,
    "top_index_counts": [
      { "index": "advisories", "doc_count": 11 },
      { "index": "macert", "doc_count": 2 }
    ],
    "next_cursor": "WzMwLjM4NTc3MywiYWR2aXNvcmllcyIsIjJhZTg4YzQyNGVjMDYyOGZiZTdmODA0NTZhMDBmOTQ5Il0="
  },
  "data": [
    {
      "index": "advisories",
      "id": "d38a1df50f6723bdb672995d2db7e588",
      "score": 30.4604,
      "source": { "...": "..." }
    },
    {
      "index": "advisories",
      "id": "2ae88c424ec0628fbe7f80456a00f949",
      "score": 30.385773,
      "source": { "...": "..." }
    }
  ]
}

Continue cursor paging

Pass the next_cursor value from the previous response.

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cve?cve=CVE-2025-20654&limit=2&cursor=WzMwLjM4NTc3MywiYWR2aXNvcmllcyIsIjJhZTg4YzQyNGVjMDYyOGZiZTdmODA0NTZhMDBmOTQ5Il0=" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

{
  "_meta": {
    "cve": "CVE-2025-20654",
    "limit": 2,
    "total_count": 36,
    "current_count": 2,
    "queried_index_count": 475,
    "indices_with_hits": 23,
    "next_cursor": "WzI5LjU5Nzc3LCJhZHZpc29yaWVzIiwiNTE4NTdhZWU5ODNhOGVkNDNhNzQ5YWViNTFmZGFjNzYiXQ=="
  },
  "data": [
    {
      "index": "advisories",
      "id": "4df2e4e22c55de1a2a5991453cb72651",
      "score": 29.59777,
      "source": {
        "external_id": [],
        "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/20xxx/CVE-2025-20654.json",
        "tags": [
          "Government Advisory"
        ],
        "date_added": "2025-04-07T03:14:45Z",
        "refsource": "vulnrichment",
        "cve": [
          "CVE-2025-20654"
        ],
        "name": "VULNRICHMENT Advisory",
        "lang": "en",
        "_timestamp": "2025-04-07T17:37:04.927385Z"
      }
    }
  ]
}

Errors

A missing or malformed cve returns a 400:

{
  "error": true,
  "errors": [
    "invalid endpoint parameters: cve is required"
  ]
}
{
  "error": true,
  "errors": [
    "invalid endpoint parameters: invalid cve format"
  ]
}

Mixing the two pagination modes returns a 400:

{
  "error": true,
  "errors": [
    "invalid endpoint parameters: invalid endpoint parameter: page cannot be combined with cursor pagination"
  ]
}