For the complete documentation index, see llms.txt. This page is also available as Markdown.

cveIntelligence

Response Center-owned exploitation and official KEV intelligence for one CVE indicator.

Examples

type CveIntelligence {
  exploitationStatus: CveExploitationStatus!
  firstReportedExploitationAt: DateTime
  firstObservedExploitationAt: DateTime
  kev: CisaKevObservation!
  euKev: EuKevObservation
  articleEvidence: [CveArticleEvidence!]!
}

Fields

Field
Description
Supported fields

exploitationStatus CveExploitationStatus!

Confirmed for current CISA or EU KEV membership, reported for supported reporter evidence, observed for VulnCheck sensor telemetry, or unknown.

firstReportedExploitationAt DateTime

The earliest publication date among sources reporting real-world exploitation activity.

firstObservedExploitationAt DateTime

The earliest exploitation observation date explicitly stated by a source.

The current CISA KEV observation retained for the CVE.

status CisaKevStatus! checkedAt DateTime! catalogFetchedAt DateTime catalogVersion String dateReleased String dateAdded String dueDate String requiredAction String knownRansomwareCampaignUse String

Independent official EU KEV assertion; retained alongside CISA when both list the CVE.

status EuKevStatus! checkedAt DateTime! catalogFetchedAt DateTime source String! sourceDisplayName String! cve String euvdId String dateReported String originSource String exploitationTypes [String!]! threatActors [String!]! notes String

articleEvidence [CveArticleEvidence!]!

The analyzed source articles that reference the CVE.

sourceUrl String! sourcePublishedAt DateTime analyzedAt DateTime! analysisVersion String! articleTypes [String!]! classificationConfidence String! claims [CveExploitationClaimEvidence!]!

References

Fields with this object:

Last updated