CVE Intelligence

CV One merged record for each CVE: CVE List, CISA KEV, EPSS, exploit links, NVD status and fixed versions.

Since April 2026, NIST NVD fully enriches only a small part of new CVEs. CVE Intelligence reads the CVE List (with the CISA-ADP container), CISA KEV, FIRST EPSS, public exploit indexes, NVD and OSV, and returns one record for each CVE. The enrichment_gap flag shows when NVD has no CVSS score or CPE data.

Get a free key Live docs OpenAPI 3.1

1,000 free calls a month on each API. No card.

What it answers

How severe is this CVE, by the CNA, CISA-ADP and NVD scores side by side?
Is it in CISA KEV, and is it used in ransomware campaigns?
How likely is exploitation (EPSS), and did that change this week?
Is there public exploit evidence, and which package versions fix it?
Which of my packages (purl or CPE) have known CVEs?

What it holds now

CV-CVE CVE records: loading
CV-KEV KEV entries: loading
CV-EPSS EPSS scores: loading
CV-XPL Exploit links: loading

Read live from https://api.elysianintelligence.com/cve/status.

Example

curl "https://api.elysianintelligence.com/cve/v1/cve/CVE-2021-44228" \
  -H "Authorization: Bearer $EP_KEY"

{
  "id": "CVE-2021-44228",
  "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
  "severity": {
    "cisa_adp": {
      "cvss3": {
        "score": 10,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
      }
    }
  },
  "nvd_status": "analyzed",
  "ssvc": {
    "exploitation": "active",
    "automatable": "yes",
    "technical_impact": "total"
  },
  "kev": {
    "listed": true,
    "date_added": "2021-12-10",
    "due_date": "2021-12-24",
    "known_ransomware_campaign_use": "Known"
  },
  "epss": {
    "score": 0.99999,
    "percentile": 1
  },
  "osv": {
    "packages": [
      {
        "ecosystem": "Maven",
        "name": "org.apache.logging.log4j:log4j-core",
        "fixed_versions": [
          "2.15.0",
          "2.3.1",
          "2.12.2"
        ]
      }
    ]
  },
  "enrichment_gap": false
}

Shortened. Field names are the API's own; the values come from the public sources, read on 18 Oct 2026.

Endpoints

Every route is also an MCP tool with the same input and output, at https://api.elysianintelligence.com/cve/mcp.

REST route	MCP tool	What it does
`GET /v1/cve/{id}`	`get_cve`	The merged record for one CVE.
`GET /v1/cves?kev=&min_epss=&since=&vendor=`	`search_cves`	Search CVEs by KEV, EPSS, update date and vendor.
`GET /v1/feed?since=`	`cve_feed`	Change events: new CVEs, KEV additions, EPSS jumps, new exploits.
`POST /v1/match`	`match_packages`	Up to 100 purls or CPE 2.3 names, matched to CVEs.

Sources, licences and refresh

Source	Licence	Updates
CVE List v5 (CNA container)	CVE Terms of Use: keep MITRE's copyright designation and the licence (see Required notices)	Hourly releases; we read them hourly
CISA Vulnrichment (CISA-ADP)	CC0 1.0 and the CVE Terms of Use	With the CVE List; hourly
CISA Known Exploited Vulnerabilities	US government work, public domain	Several times a week; we check hourly
FIRST EPSS	MIT License (FIRST.Org), with attribution to "EPSS, FIRST.org"	Daily; we read it at 14:20 UTC
nuclei-templates	MIT	Daily; we read it at 05:10 UTC
Metasploit Framework module metadata	BSD-3-Clause	Daily; we read it at 05:10 UTC
Exploit-DB index (ID, title and CVE, with a link)	Facts and links only; no exploit code is stored	Daily; we read it at 05:10 UTC
OSV	CC-BY 4.0; records from other databases keep their own licences	Live, cached 24 hours
NIST National Vulnerability Database	US government work, public domain	Live, cached 24 hours

Required notices

Section 5.4 of the API Terms of Service asks you to include these notices wherever you show or pass on CVE data.

NVD

This product uses the NVD API but is not endorsed or certified by the NVD.

Do not attribute to NVD any data that we or you have modified.

CVE records

Copyright © 1999-2026, The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Source: CVE Program Terms of Use. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. The CISA enrichment in the CISA-ADP container is dedicated to the public domain under CC0 1.0.

EPSS

Attribute the scores to "EPSS, FIRST.org". The MIT License notice of EPSS:

MIT License

Copyright (c) 2022 FIRST.Org, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Source: FIRST's EPSS repository.

Open-source advisory data

Package and fixed-version data comes from OSV and the databases it collects, under licences such as CC BY 4.0, CC BY-SA 4.0, CC0, MIT, Apache 2.0 and BSD. Each record names its sources in sources. Follow the licence of each one.

Every CVE record also carries the notices of its own sources, in full, in its notices field, so you can pass them on with the data.