GET /v1/cves

Programmatic access to TechWatchAlert’s vulnerability database: multi-criteria search and full records (CVSS, EPSS, KEV, PoC, affected products). Public data — no project required.

Search CVEs

GET /api/v1/cves
Authorization: Bearer twa_your_key_here

Query Parameters

Parameter	Type	Description
q	string	Search in ID, description, vendor or product
severity	string	Filter, comma-separated: CRITICAL,HIGH,MEDIUM,LOW
is_kev	boolean	true = only CVEs in CISA’s KEV catalog
has_poc	boolean	true = only CVEs with a known public exploit
has_workaround	boolean	true = only CVEs with a known workaround or mitigation (interim measures); false = without
vendor	string	Filter by vendor — searched across all affected entries
product	string	Filter by product — searched across all affected entries
match	string	partial (default) or exact for vendor/product. exact ignores case and separators
updated_since	string	ISO 8601 date: only CVEs modified since
include	string	affected to attach version ranges to the list
page	integer	Page (default 1)
page_size	integer	Page size, max 100 (default 20)

Searching by product

vendor and product match the primary pair and every affected entry. A CVE affecting Chrome, Edge and Electron is now found under all three — previously only the first one answered.

match=exact removes the noise of partial matching: product=java also returns javascript, product=java_se&match=exact does not. Recommended for automated clients.

exact ignores case and separators. The same product reaches this database from several sources, each with its own convention: it holds both 7-Zip and 7-zip, Visual Studio Code and visual_studio_code. Asking for one exact spelling would mean guessing it, since it is documented nowhere and varies from product to product.

Comparison therefore happens in lower case, with _ and spaces folded to a hyphen. Those three characters separate words; they never distinguish two pieces of software — chrome and chromium remain two products.

One product, several spellings

exact reconciles spelling, not vocabulary. notepad-plus-plus and notepad++ remain two distinct products with different CVEs, because upstream sources name them that way — punctuation is not a separator.

An inventory client should query both forms and merge, or go through vendor, which groups the spellings of a single publisher:

# 19 CVEs under one spelling, 4 under the other, 26 through the vendor
curl -H "Authorization: Bearer $TWA_API_KEY"   "https://app.techwatchalert.com/api/v1/cves?vendor=notepad-plus-plus&match=exact"

Incremental sync

updated_since returns modified CVEs, not just newly published ones: a CVE gets its KEV listing and CVSS score days after publication.

Combined with include=affected, it keeps a local cache current without ever opening each CVE’s detail — version ranges come back in the list itself.

curl -H "Authorization: Bearer $TWA_API_KEY"   "https://app.techwatchalert.com/api/v1/cves?updated_since=2026-08-01T00:00:00Z&include=affected&page_size=100"

Response 200 OK

{
  "items": [
    {
      "cve_id": "CVE-2024-3094",
      "severity": "CRITICAL",
      "cvss_score": 10.0,
      "epss_score": 0.9412,
      "is_kev": true,
      "has_poc": true,
      "maturite_exploit": "exploitee",
      "contournement_disponible": false,
      "vendor": "xz",
      "product": "xz-utils",
      "date_published": "2024-03-29T00:00:00Z"
    }
  ],
  "total": 1,
  "page": 1,
  "page_size": 20
}

Fields — Item

Field	Type	Description
cve_id	string	CVE identifier
severity	string	CRITICAL, HIGH, MEDIUM, LOW, NONE, UNKNOWN
cvss_score	number | null	CVSS score (0–10)
epss_score	number | null	EPSS exploitation probability (0–1)
is_kev	boolean	Listed in CISA’s KEV catalog
has_poc	boolean	Known public exploit / proof of concept (GitHub, Exploit-DB, Metasploit or Nuclei)
maturite_exploit	string | null	Exploit maturity, see below
contournement_disponible	boolean	A workaround or mitigation from the vendor or a CERT is known; details in the record’s mesures_provisoires
vendor	string | null	Primary vendor
product	string | null	Primary product
date_published	string (ISO 8601) | null	Publication date
affected	array | null	Only present with include=affected — same fields as on the record

Exploit maturity

maturite_exploit sums up, from most to least severe, what is known about exploitation:

Value	Meaning
exploitee	Confirmed exploitation: CISA KEV catalog, VulnCheck KEV, ENISA EUVD or CERT-FR
outillee	Weaponized exploit: a Metasploit module or a Nuclei detection template exists; anyone can attack without writing code
poc	Public proof of concept only: GitHub repository (listed by nomi-sec/PoC-in-GitHub) or Exploit-DB exploit
null	Nothing known

Sources are read again every day. Only each exploit’s identifier, title, address, date and type are kept, never its authors.

Errors

Code	Detail	Cause
422	updated_since doit etre une date ISO 8601	updated_since cannot be parsed
422	string_pattern_mismatch	match is neither partial nor exact
422	less_than_equal	page_size above 100

CVE record

GET /api/v1/cves/{cve_id}
Authorization: Bearer twa_your_key_here

Path Parameters

Parameter	Type	Description
cve_id	string	CVE identifier (e.g. CVE-2024-3094)

Response 200 OK

In addition to the search item fields:

Field	Type	Description
description	string | null	English description
cvss_vector	string | null	CVSS vector
epss_percentile	number | null	EPSS percentile (0–1)
cwe_ids	array | null	Associated CWE identifiers
poc_count	integer	Number of public PoCs and exploits recorded, all sources
date_updated	string (ISO 8601) | null	Last update
affected	array	Affected products
mesures_provisoires	array	Workarounds, mitigations and announced lack of a fix, see below

Each affected entry: vendor, product, version_from, version_to, version_status, cpe.

Interim measures

What the vendor or a CERT offers until (or instead of) a fix, one entry per advisory and category:

Field	Type	Description
categorie	string	workaround, mitigation, none_available (no fix available), no_fix_planned (no fix planned)
source	string	certfr, csaf-cisa, csaf-ncsc-nl, csaf-siemens
reference	string	Advisory identifier (CERTFR-2026-ALE-005, ICSA-26-274-02, SSA-330084)
texte	string | null	Short text of the measure; null when the source’s licence only allows the category and the link
url	string | null	Original advisory
date	string (ISO 8601) | null	Advisory update date
produits	array	Affected products, when the advisory names them
republication	string | null	Original vendor of an advisory republished by CISA (ABB, Hitachi Energy…)
lien_seulement	boolean	true: category and link only, the text stays with the vendor
attribution	string	Source credit to reproduce with the data

Licences

Each source has its own terms (Sources and licences page). Reusing texte elsewhere means keeping attribution, url and, for CERT-FR (Licence Ouverte 2.0), date. The link to the original advisory is mandatory for Siemens ProductCERT. Vendor advisories republished by CISA never carry text.

Errors

Code	Detail	Cause
404	CVE introuvable	cve_id not found

Examples

Critical CVEs with a public PoC, paginated

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  "https://app.techwatchalert.com/api/v1/cves?severity=CRITICAL&has_poc=true&page=1&page_size=50" \
  | jq '.items[] | {cve: .cve_id, cvss: .cvss_score, epss: .epss_score}'

Full record for a CVE

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  https://app.techwatchalert.com/api/v1/cves/CVE-2024-3094 \
  | jq '{cve: .cve_id, kev: .is_kev, affected: [.affected[].product]}'

Data sources and licences

The data returned by this endpoint comes from public sources: the CVE® Program (MITRE), the CISA KEV catalog, VulnCheck KEV, ENISA’s EUVD, CERT-FR, FIRST’s EPSS, and proof-of-concept and exploit databases (PoC-in-GitHub, Exploit Database, Metasploit Framework, nuclei-templates). It keeps the licence of its source, and the attribution these licences require also applies to how you use it.

Ubuntu advisories (Ubuntu Security Notices, licensed under CC BY-SA 4.0) are shown in the application but are not returned by the API.

The list of sources, their licences, the attributions to reproduce and the licence notices are on the Sources and licences page.