API Reference

Get a CVE

Fetch the full intelligence record for a single CVE, including CVSS severity, EPSS probability, CISA KEV status, Shadowserver honeypot activity, risk scoring, and a chronological event timeline.

GET

/v1/cve/{cve-id}

Cost: 1 credit per successful call

Path parameters

cve-idstringrequired

A CVE identifier matching the pattern CVE-YYYY-NNNNN where the numeric suffix is 4 to 7 digits. Input is case-insensitive: cve-2024-3094 is accepted and normalised to CVE-2024-3094 server-side.

Request

curl https://api.precursorintelligence.com/functions/v1/cve/CVE-2024-3094 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "id": "CVE-2024-3094",
    "description": "Malicious code was discovered in the upstream tarballs of xz Utils versions 5.6.0 and 5.6.1, allowing an attacker to bypass SSH authentication on affected systems.",
    "published": "2024-03-29T17:15:21.000Z",
    "last_modified": "2026-02-11T09:24:01.000Z",
    "vuln_status": "Analyzed",
    "severity": {
      "cvss_score": 10.0,
      "cvss_level": "CRITICAL",
      "cvss_version": "3.1",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "impact_score": 6.0,
      "exploitability_score": 3.9
    },
    "epss": {
      "score": 0.9421,
      "percentile": 0.9989,
      "delta_7d": 0.0012,
      "score_series_7d": [0.9385, 0.9390, 0.9401, 0.9408, 0.9413, 0.9418, 0.9421],
      "updated_at": "2026-05-17T00:00:00.000Z"
    },
    "cisa_kev": {
      "listed": true,
      "date_added": "2024-03-29",
      "due_date": "2024-04-12",
      "vendor": "XZ Utils",
      "product": "XZ Utils",
      "vulnerability_name": "XZ Utils Supply Chain Compromise",
      "short_description": "XZ Utils contains a supply chain compromise via malicious code in versions 5.6.0 and 5.6.1 that allows for unauthorized access.",
      "required_action": "Apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.",
      "notes": "This vulnerability affects a common OS package. See advisory for affected distributions."
    },
    "shadowserver": {
      "exploited": true,
      "observation_date": "2026-05-17",
      "vendor": "XZ Utils",
      "product": "xz",
      "class": "RCE",
      "severity": "Critical",
      "iot": false,
      "connections": 4821,
      "unique_ips": {
        "1d": 312,
        "7d": 1840,
        "30d": 5230,
        "90d": 9910
      },
      "geo_daily": [
        {
          "date": "2026-05-17",
          "geo": "CN",
          "event_type": "sshd",
          "unique_ips": 187
        },
        {
          "date": "2026-05-17",
          "geo": "US",
          "event_type": "sshd",
          "unique_ips": 54
        }
      ]
    },
    "risk": {
      "score": 9.7,
      "priority": "CRITICAL",
      "categories": ["supply-chain", "authentication-bypass"],
      "known_exploited": true,
      "seen_in_wild": true,
      "scored_at": "2026-05-18T10:24:31.000Z"
    },
    "classification": {
      "cwe_ids": ["CWE-506"],
      "vulnerability_types": ["Supply Chain Compromise"],
      "threat_actors": ["UNC5221"],
      "malware_families": [],
      "targeted_industries": ["Technology", "Critical Infrastructure"]
    },
    "intel": {
      "blog_mention_count": 47
    },
    "cpe": [
      {
        "operator": "OR",
        "matches": [
          {
            "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "version_end_including": "5.6.1"
          }
        ]
      }
    ],
    "references": [
      {
        "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
        "source": "openwall.com",
        "tags": ["Mailing List", "Third Party Advisory"]
      },
      {
        "url": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
        "source": "cisa.gov",
        "tags": ["US Government Resource"]
      }
    ],
    "timeline": [
      {
        "event": "nvd_published",
        "at": "2024-03-29T17:15:21.000Z",
        "detail": "CVE published to NVD."
      },
      {
        "event": "cisa_kev_added",
        "at": "2024-03-29T00:00:00.000Z",
        "detail": "Added to CISA Known Exploited Vulnerabilities catalogue."
      },
      {
        "event": "high_epss_delta",
        "at": "2024-03-30T00:00:00.000Z",
        "detail": "EPSS score increased by more than 0.1 in a single day."
      }
    ]
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.idstringoptional

The canonical upper-case CVE identifier.

data.descriptionstringoptional

The primary English description from NVD.

data.publishedstringoptional

ISO-8601 UTC timestamp of original NVD publication.

data.last_modifiedstringoptional

ISO-8601 UTC timestamp of the most recent NVD modification.

data.vuln_statusstringoptional

NVD analysis status. Common values: Analyzed, Modified, Awaiting Analysis, Undergoing Analysis.

data.severityobject | nulloptional

CVSS severity block derived from the best available metric set (v3.1, then v3.0, then v2). Contains cvss_score (number), cvss_level (string), cvss_version (string), cvss_vector (string), impact_score (number), and exploitability_score (number). null when no CVSS data is available.

data.epssobject | nulloptional

EPSS (Exploit Prediction Scoring System) data. score is the current probability (0.0–1.0) that the CVE will be exploited in the wild within 30 days. percentile is the rank among all scored CVEs. delta_7d is the change over the past 7 days. score_series_7d contains the daily scores for the last 7 days (oldest to newest). null when EPSS has not yet scored this CVE.

data.cisa_kevobjectoptional

CISA Known Exploited Vulnerabilities status. Always present. When listed is false, only that field is returned. When listed is true, the object also includes date_added, due_date, vendor, product, vulnerability_name, short_description, required_action, and notes.

data.shadowserverobjectoptional

Shadowserver honeypot activity. Always present. When exploited is false, only that field and an empty geo_daily array are returned. When exploited is true, the object includes observation_date, vendor, product, class (vulnerability class), severity, iot (boolean indicating whether the targeted device class is IoT), connections (total connections on the observation date), unique_ips (a map with keys 1d, 7d, 30d, 90d showing rolling average unique source IPs), and geo_daily (up to 50 rows of daily per-geography counts for the last 30 days).

data.riskobject | nulloptional

Precursor Intelligence risk scoring. score is a numeric risk score. priority is the action priority bucket (CRITICAL, HIGH, MEDIUM, LOW). categories lists the risk category tags. known_exploited and seen_in_wild are booleans. scored_at is the ISO-8601 timestamp of the last scoring run. null when the CVE has not yet been scored.

data.classificationobjectoptional

Structured intelligence classification. cwe_ids lists mapped CWE identifiers. vulnerability_types, threat_actors, malware_families, and targeted_industries are string arrays that may be empty.

data.intelobjectoptional

Additional intelligence signals. May include blog_mention_count (integer) when available. Empty object when no signals are present.

data.cpearrayoptional

CPE applicability nodes from the NVD configuration data. Each element contains an operator string and a matches array. Each match includes criteria (the CPE 2.3 URI), vulnerable (boolean), and optional version range bounds (version_start_including, version_start_excluding, version_end_including, version_end_excluding).

data.referencesarrayoptional

NVD reference list. Each element contains url, source (the domain that submitted the reference), and tags (a string array such as "Vendor Advisory", "Patch", "Exploit").

data.timelinearrayoptional

Chronological notable events for this CVE. Each element contains event (a machine-readable event type such as nvd_published, cisa_kev_added, or high_epss_delta), at (ISO-8601 UTC timestamp), and detail (a short human-readable description).

Errors

Status	`error`	When
400	`invalid_cve_id`	The path segment did not match the `CVE-YYYY-N{4,7}` pattern.
401	`invalid_authorization`	The `Authorization` header is missing or malformed.
401	`unauthorized`	The key is invalid, revoked, or the request IP is not on the allowlist.
402	`insufficient_credits`	The organisation's credit balance is below 1.
404	`not_found`	The CVE identifier is valid but is not in the dataset.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference.