API Reference

Get CVEs by Version

Retrieve up to 200 full CVE records affecting a specific vendor, product, and version combination.

GET

/cpe/{vendor}/{product}/{version}

Cost: 1 credit per successful call

Path parameters

vendorstringrequired

The CPE vendor token (case-insensitive, 1–255 characters, no / or control characters).

productstringrequired

The CPE product token (same constraints as vendor).

versionstringrequired

The exact version string. Version matching is case-sensitive. URL-encode special characters (e.g. +, ~).

Request

curl https://api.precursorintelligence.com/functions/v1/cpe/tukaani/xz/5.6.0 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "vendor": "tukaani",
    "product": "xz",
    "version": "5.6.0",
    "cve_count": 1,
    "returned": 1,
    "truncated": false,
    "cap": 200,
    "cves": {
      "CVE-2024-3094": {
        "id": "CVE-2024-3094",
        "description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The backdoor manipulates sshd authentication, allowing an attacker to gain unauthorized access.",
        "published": "2024-03-29T17:15:21.000Z",
        "last_modified": "2024-04-03T18:11:00.000Z",
        "vuln_status": "Analyzed",
        "severity": {
          "cvss_score": 10.0,
          "cvss_level": "CRITICAL",
          "cvss_version": "3.1",
          "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "impact_score": 6.0,
          "exploitability_score": 3.9
        },
        "epss": {
          "score": 0.9731,
          "percentile": 0.9998,
          "delta_7d": 0.0012,
          "score_series_7d": [0.9719, 0.9722, 0.9724, 0.9726, 0.9728, 0.9730, 0.9731],
          "updated_at": "2026-05-17T00:00:00.000Z"
        },
        "cisa_kev": {
          "listed": true,
          "date_added": "2024-03-29",
          "due_date": "2024-04-05",
          "vendor": "XZ Utils",
          "product": "XZ Utils",
          "vulnerability_name": "XZ Utils Backdoor",
          "short_description": "XZ Utils contains a backdoor that allows unauthorized remote access.",
          "required_action": "Apply mitigations per vendor instructions or discontinue use.",
          "notes": ""
        },
        "shadowserver": {
          "exploited": true,
          "observation_date": "2024-04-01",
          "vendor": "tukaani",
          "product": "xz",
          "class": "supply-chain",
          "severity": "CRITICAL",
          "iot": false,
          "connections": 4821,
          "unique_ips": {
            "1d": 12,
            "7d": 89,
            "30d": 341,
            "90d": 812
          }
        },
        "risk": {
          "score": 98,
          "priority": "CRITICAL",
          "categories": ["supply-chain", "rce"],
          "known_exploited": true,
          "seen_in_wild": true,
          "scored_at": "2026-05-17T00:00:00.000Z"
        },
        "classification": {
          "cwe_ids": ["CWE-506"],
          "vulnerability_types": ["Supply Chain Compromise"],
          "threat_actors": ["UNC4736"],
          "malware_families": ["CHAINSABRE"],
          "targeted_industries": ["Technology", "Government"]
        },
        "intel": {
          "blog_mention_count": 47
        },
        "references": [
          {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
            "source": "nvd",
            "tags": []
          }
        ]
      }
    }
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Result cap

This endpoint returns at most 200 CVE records. When truncated is true, the full set exceeds the cap. There is no pagination cursor. To retrieve a smaller, more targeted set, narrow your query to a more specific version string.

Response fields

data.vendorstringoptional

The vendor token as matched (lowercased).

data.productstringoptional

The product token as matched (lowercased).

data.versionstringoptional

The exact version string as supplied.

data.cve_countintegeroptional

Total number of CVEs known to affect this vendor/product/version combination.

data.returnedintegeroptional

Number of CVE records included in this response. Equal to cve_count when not truncated, otherwise cap (200).

data.truncatedbooleanoptional

true when cve_count exceeds the cap and only a partial set is returned.

data.capintegeroptional

Maximum number of CVE records this endpoint will return. Currently 200.

data.cvesobjectoptional

Object keyed by CVE identifier (e.g. "CVE-2024-3094"). Each value is a full CVE record with the fields below.

data.cves[id].idstringoptional

CVE identifier (e.g. CVE-2024-3094).

data.cves[id].descriptionstringoptional

Primary English description from NVD.

data.cves[id].publishedstringoptional

ISO 8601 timestamp of the NVD publication date.

data.cves[id].last_modifiedstringoptional

ISO 8601 timestamp of the most recent NVD modification.

data.cves[id].vuln_statusstringoptional

NVD analysis status (e.g. Analyzed, Modified, Awaiting Analysis).

data.cves[id].severityobjectoptional

CVSS scoring summary: cvss_score, cvss_level, cvss_version, cvss_vector, impact_score, and exploitability_score. Fields are omitted when not available.

data.cves[id].epssobjectoptional

EPSS probability data: score (0–1), percentile, delta_7d (7-day change), score_series_7d (array of the 7 most recent daily scores, oldest first), and updated_at.

data.cves[id].cisa_kevobjectoptional

CISA KEV status. Always present. listed is false when not in the catalog. When listed is true, additional fields are included: date_added, due_date, vendor, product, vulnerability_name, short_description, required_action, and notes.

data.cves[id].shadowserverobjectoptional

Shadowserver honeypot activity. exploited is false when no activity is recorded. When exploited is true, additional fields are included: observation_date, vendor, product, class, severity, iot (boolean), connections, and unique_ips broken down by 1d, 7d, 30d, and 90d windows.

data.cves[id].riskobjectoptional

Precursor Intelligence risk summary: score (0–100), priority, categories[], known_exploited, seen_in_wild, and scored_at. Fields are omitted when not available.

data.cves[id].classificationobjectoptional

Threat classification: cwe_ids[], vulnerability_types[], threat_actors[], malware_families[], and targeted_industries[].

data.cves[id].intelobjectoptional

Additional intelligence signals: blog_mention_count (number of blog posts referencing this CVE). Fields are omitted when not available.

data.cves[id].referencesobject[]optional

Reference URLs from NVD: url, source, and tags[] per entry.

Errors

Status	`error`	When
401	`unauthorized`	The API key is missing, revoked, or invalid.
402	`insufficient_credits`	Your credit balance is zero. Top up from the dashboard.
404	`not_found`	The `vendor/product/version` combination is not tracked, or a path parameter contains invalid characters or exceeds the length limit. A different version of the same product may exist.
405	`method_not_allowed`	A method other than GET or OPTIONS was used.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference including response body format and header details.