GET /v1/cves

Programmatic access to TechWatchAlert’s vulnerability database: multi-criteria search and full records (CVSS, EPSS, KEV, PoC, affected products). Public data — no project required.

Search CVEs

GET /api/v1/cves
Authorization: Bearer twa_your_key_here

Query Parameters

Parameter	Type	Description
q	string	Search in ID, description, vendor or product
severity	string	Filter, comma-separated: CRITICAL,HIGH,MEDIUM,LOW
is_kev	boolean	true = only CVEs in CISA’s KEV catalog
has_poc	boolean	true = only CVEs with a known public exploit
vendor	string	Filter by vendor — searched across all affected entries
product	string	Filter by product — searched across all affected entries
match	string	partial (default) or exact for vendor/product
updated_since	string	ISO 8601 date: only CVEs modified since
include	string	affected to attach version ranges to the list
page	integer	Page (default 1)
page_size	integer	Page size, max 100 (default 20)

Searching by product

vendor and product match the primary pair and every affected entry. A CVE affecting Chrome, Edge and Electron is now found under all three — previously only the first one answered.

match=exact removes the noise of partial matching: product=java also returns javascript, product=java_se&match=exact does not. Recommended for automated clients.

Incremental sync

updated_since returns modified CVEs, not just newly published ones: a CVE gets its KEV listing and CVSS score days after publication.

Combined with include=affected, it keeps a local cache current without ever opening each CVE’s detail — version ranges come back in the list itself.

curl -H "Authorization: Bearer $TWA_API_KEY"   "https://app.techwatchalert.com/api/v1/cves?updated_since=2026-08-01T00:00:00Z&include=affected&page_size=100"

Response 200 OK

{
  "items": [
    {
      "cve_id": "CVE-2024-3094",
      "severity": "CRITICAL",
      "cvss_score": 10.0,
      "epss_score": 0.9412,
      "is_kev": true,
      "has_poc": true,
      "vendor": "xz",
      "product": "xz-utils",
      "date_published": "2024-03-29T00:00:00Z"
    }
  ],
  "total": 1,
  "page": 1,
  "page_size": 20
}

Fields — Item

Field	Type	Description
cve_id	string	CVE identifier
severity	string	CRITICAL, HIGH, MEDIUM, LOW, NONE, UNKNOWN
cvss_score	number | null	CVSS score (0–10)
epss_score	number | null	EPSS exploitation probability (0–1)
is_kev	boolean	Listed in CISA’s KEV catalog
has_poc	boolean	Known public exploit / proof of concept
vendor	string | null	Primary vendor
product	string | null	Primary product
date_published	string (ISO 8601) | null	Publication date
affected	array | null	Only present with include=affected — same fields as on the record

Errors

Code	Detail	Cause
422	updated_since doit etre une date ISO 8601	updated_since cannot be parsed
422	string_pattern_mismatch	match is neither partial nor exact
422	less_than_equal	page_size above 100

CVE record

GET /api/v1/cves/{cve_id}
Authorization: Bearer twa_your_key_here

Path Parameters

Parameter	Type	Description
cve_id	string	CVE identifier (e.g. CVE-2024-3094)

Response 200 OK

In addition to the search item fields:

Field	Type	Description
description	string | null	English description
cvss_vector	string | null	CVSS vector
epss_percentile	number | null	EPSS percentile (0–1)
cwe_ids	array | null	Associated CWE identifiers
poc_count	integer	Number of public PoCs recorded
date_updated	string (ISO 8601) | null	Last update
affected	array	Affected products

Each affected entry: vendor, product, version_from, version_to, version_status, cpe.

Errors

Code	Detail	Cause
404	CVE introuvable	cve_id not found

Examples

Critical CVEs with a public PoC, paginated

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  "https://app.techwatchalert.com/api/v1/cves?severity=CRITICAL&has_poc=true&page=1&page_size=50" \
  | jq '.items[] | {cve: .cve_id, cvss: .cvss_score, epss: .epss_score}'

Full record for a CVE

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  https://app.techwatchalert.com/api/v1/cves/CVE-2024-3094 \
  | jq '{cve: .cve_id, kev: .is_kev, affected: [.affected[].product]}'