Get a CVE
Fetch a single CVE with optional embedded sub-resources.
GET/api/v1/cves/{cveId}
The composable CVE record. The core record carries identification, scoring, KEV/SSVC/EPSS triage signals, and capability flags; ?include= embeds any combination of the sub-resources documented below in a single response.
Use ?fields= to project the core record down to only the fields you need — useful for high-volume polling. The two parameters are independent: fields shapes the core record, include adds sibling sections.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
cveId | path | string | CVE identifier, case-insensitive (CVE-2025-55182). |
include | query | csv | Sub-resources to embed: cvss, epss, affected, references, exploits, evidence, timeline, analysis. Default: cvss,epss. |
fields | query | csv | Core fields to keep: any of the response fields listed below (cve_id is always present). |
Example request
curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182?include=cvss,epss" \
-H "Authorization: Bearer $RN_TOKEN"Example response
{
"cve_id": "CVE-2025-55182",
"state": "PUBLISHED",
"title": null,
"description": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.",
"severity": "critical",
"cvss_score": 10,
"cvss_score_source": "rn_metrics",
"date_published": "2025-12-03T15:40:56Z",
"date_updated": "2025-12-11T20:15:37Z",
"assigner": "Meta",
"kev": {
"listed": true,
"date_added": "2025-12-05"
},
"ssvc": {
"exploitation": "active",
"automatable": "yes",
"technical_impact": "total",
"decision": "act"
},
"epss": {
"score": 0.99562,
"percentile": 0.99942,
"date": "2026-07-22"
},
"has_patch": true,
"has_workaround": false,
"has_exploit": true,
"has_detection": true,
"detection_layers": [
"file_yara",
"network_ids",
"scanner",
"siem"
],
"primary_cwe_id": null,
"cvss": {
"metrics": [
{
"source_type": "rn",
"source_short_name": "radical-notion",
"cvss_version": "4.0",
"base_score": 10,
"base_severity": "CRITICAL",
"vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red",
"is_primary": true,
"captured_at": "2026-06-21T21:03:43Z"
},
{
"source_type": "cna",
"source_short_name": "Meta",
"cvss_version": "3.1",
"base_score": 10,
"base_severity": "CRITICAL",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"is_primary": false,
"captured_at": "2026-06-21T21:03:43Z"
},
{
"source_type": "ghsa",
"source_short_name": "GitHub",
"cvss_version": "3.1",
"base_score": 10,
"base_severity": "CRITICAL",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"is_primary": false,
"captured_at": "2026-07-19T22:59:40Z"
}
],
"rn_assessment": {
"base_score": 10,
"base_severity": "CRITICAL",
"vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red",
"rescore_timestamp": "2025-12-12T12:00:00Z"
}
},
"epss_detail": {
"current": {
"date": "2026-07-22",
"epss_score": 0.99562,
"percentile": 0.99942,
"model_version": "v2026.06.15"
}
}
}Response schema
| Field | Type | Description |
|---|---|---|
cve_id | string | Canonical CVE identifier (always upper-case). |
state | string | CVE record state: PUBLISHED or RESERVED. |
title | string | null | Display title when one exists (CNA-provided or derived). |
description | string | null | The CNA description from the current CVE 5.x record. |
severity | string | null | Severity band from the highest-priority CVSS source: critical, high, medium, low, none. |
cvss_score | number | null | Base score backing the severity band. |
cvss_score_source | string | null | Which source supplied the headline score (e.g. rn_metrics, cna, nvd). |
date_published | string | null | ISO 8601 publication timestamp (UTC). |
date_updated | string | null | ISO 8601 timestamp of the latest record update (UTC). |
assigner | string | null | Assigning CNA short name (e.g. Meta, GitHub_M). |
kev.listed | boolean | Whether the CVE is in the CISA Known Exploited Vulnerabilities catalog. |
kev.date_added | string | null | Date the CVE was added to the KEV catalog (YYYY-MM-DD). |
ssvc.exploitation | string | null | SSVC exploitation status from CISA ADP: none, poc, or active. |
ssvc.automatable | string | null | SSVC automatable value: yes or no. |
ssvc.technical_impact | string | null | SSVC technical impact: partial or total. |
ssvc.decision | string | null | Derived SSVC decision: track, track*, attend, or act. |
epss.score | number | null | Latest EPSS exploitation probability (0–1). |
epss.percentile | number | null | Percentile of the score across all scored CVEs (0–1). |
epss.date | string | null | Observation date of the latest EPSS score (YYYY-MM-DD). |
has_patch | boolean | A patch or fixed version is known. |
has_workaround | boolean | A vendor workaround is documented. |
has_exploit | boolean | Public exploit code or exploitation evidence exists. |
has_detection | boolean | Detection content (rules, templates, scanners) is available. |
detection_layers | string[] | Detection layers with coverage, e.g. network_ids, file_yara, scanner, siem. |
primary_cwe_id | string | null | Primary weakness classification (CWE id). |
cvss | object | Present with include=cvss — same shape as the /cvss endpoint. |
epss_detail | object | Present with include=epss — same shape as the /epss endpoint. |
affected / references / exploits / evidence / timeline / analysis | object | array | Present with the matching include value — same shapes as the endpoints below. |
Responses
| Status | Meaning |
|---|---|
200 | Success. |
400 | A path or query parameter failed validation. |
401 | Missing or invalid access token. |
403 | The CVE is outside your access tier. |
404 | No record exists for the CVE. |
429 | Rate limit exceeded. |