CVEs for a weakness

Page through the CVEs mapped to a weakness.

GET/api/v1/cwes/{cweId}/cves

CVE summary records mapped to a weakness. By default only CVEs whose primary weakness is this CWE are returned; scope=any widens the match to any weakness mapping. Records share the same summary shape as the CVE list.

Parameters

Name	In	Type	Description
`cweId`	path	string	Weakness id (79, CWE-79, or cwe-79).
`scope`	query	string	primary = only the primary weakness; any = any mapping. Default: `primary`.
`severity`	query	csv	Severity bands to include.
`kev`	query	boolean	Restrict to KEV-listed CVEs.
`sort`	query	string	Sort key: published, updated, cvss, or epss (prefix - for descending). Default: `-published`.
`limit`	query	integer	Page size, 1–100. Default: `25`.
`cursor`	query	string	Opaque cursor from the previous page.

Example request

curl "https://radicalnotion.ai/api/v1/cwes/CWE-502/cves?limit=2" \
  -H "Authorization: Bearer $RN_TOKEN"

Example response

{
  "cwe_id": "CWE-502",
  "scope": "primary",
  "data": [
    {
      "cve_id": "CVE-2026-13190",
      "state": "PUBLISHED",
      "title": "PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX",
      "description": "In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.",
      "severity": "high",
      "cvss_score": 8.1,
      "cvss_score_source": "ProgressSoftware",
      "date_published": "2026-07-22T13:43:12Z",
      "date_updated": "2026-07-22T13:43:12Z",
      "assigner": "ProgressSoftware",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": null,
        "technical_impact": null,
        "decision": null
      },
      "epss": {
        "score": null,
        "percentile": null,
        "date": null
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": "cwe-502"
    },
    {
      "cve_id": "CVE-2026-13185",
      "state": "PUBLISHED",
      "title": "PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX",
      "description": "In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.",
      "severity": "high",
      "cvss_score": 8.1,
      "cvss_score_source": "ProgressSoftware",
      "date_published": "2026-07-22T13:38:17Z",
      "date_updated": "2026-07-22T13:38:17Z",
      "assigner": "ProgressSoftware",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": null,
        "technical_impact": null,
        "decision": null
      },
      "epss": {
        "score": null,
        "percentile": null,
        "date": null
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": "cwe-502"
    }
  ],
  "pagination": {
    "limit": 2,
    "next_cursor": "eyJ2IjoiMjAyNi0wNy0yMlQxMzozODoxN1oiLCJpZCI6IkNWRS0yMDI2LTEzMTg1In0"
  }
}

Response schema

Field	Type	Description
`cwe_id`	string	The weakness the CVEs map to.
`scope`	string	Echo of the requested scope.
`data[]`	object[]	CVE summary records (same shape as the CVE list).
`pagination.next_cursor`	string \| null	Pass as ?cursor= for the next page.

Responses

Status	Meaning
`200`	Success.
`400`	A path or query parameter failed validation.
`401`	Missing or invalid access token.
`429`	Rate limit exceeded.

Parameters

Name	In	Type	Description
`cweId`	path	string	Weakness id (79, CWE-79, or cwe-79).
`scope`	query	string	primary = only the primary weakness; any = any mapping. Default: `primary`.
`severity`	query	csv	Severity bands to include.
`kev`	query	boolean	Restrict to KEV-listed CVEs.
`sort`	query	string	Sort key: published, updated, cvss, or epss (prefix - for descending). Default: `-published`.
`limit`	query	integer	Page size, 1–100. Default: `25`.
`cursor`	query	string	Opaque cursor from the previous page.

Example response

{
  "cwe_id": "CWE-502",
  "scope": "primary",
  "data": [
    {
      "cve_id": "CVE-2026-13190",
      "state": "PUBLISHED",
      "title": "PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX",
      "description": "In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.",
      "severity": "high",
      "cvss_score": 8.1,
      "cvss_score_source": "ProgressSoftware",
      "date_published": "2026-07-22T13:43:12Z",
      "date_updated": "2026-07-22T13:43:12Z",
      "assigner": "ProgressSoftware",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": null,
        "technical_impact": null,
        "decision": null
      },
      "epss": {
        "score": null,
        "percentile": null,
        "date": null
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": "cwe-502"
    },
    {
      "cve_id": "CVE-2026-13185",
      "state": "PUBLISHED",
      "title": "PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX",
      "description": "In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.",
      "severity": "high",
      "cvss_score": 8.1,
      "cvss_score_source": "ProgressSoftware",
      "date_published": "2026-07-22T13:38:17Z",
      "date_updated": "2026-07-22T13:38:17Z",
      "assigner": "ProgressSoftware",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": null,
        "technical_impact": null,
        "decision": null
      },
      "epss": {
        "score": null,
        "percentile": null,
        "date": null
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": "cwe-502"
    }
  ],
  "pagination": {
    "limit": 2,
    "next_cursor": "eyJ2IjoiMjAyNi0wNy0yMlQxMzozODoxN1oiLCJpZCI6IkNWRS0yMDI2LTEzMTg1In0"
  }
}

Field

Type

Description

cwe_id

string

The weakness the CVEs map to.

scope

string

Echo of the requested scope.

data[]

object[]

CVE summary records (same shape as the CVE list).

pagination.next_cursor

string | null

Pass as ?cursor= for the next page.

Status

Meaning

200

Success.

400

A path or query parameter failed validation.

401

Missing or invalid access token.

429

Rate limit exceeded.