Evidence
Exploitation, detection, and mitigation signals.
GET/api/v1/cves/{cveId}/evidence
The observed-signal layer behind the has_exploit / has_detection / has_patch flags: each individual piece of evidence with its source, confidence, and first/last-seen window.
Exploitation evidence ranks maturity (PoC published < weaponized module < KEV-confirmed active exploitation); detection evidence tracks rule and template coverage; mitigation evidence tracks fix commits and fixed versions per ecosystem.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
cveId | path | string | CVE identifier. |
type | query | string | Only one evidence family: exploitation, detection, or mitigation. |
Example request
curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182/evidence?type=exploitation" \
-H "Authorization: Bearer $RN_TOKEN"Example response(trimmed for brevity)
{
"cve_id": "CVE-2025-55182",
"count": 24,
"evidence": [
{
"type": "exploitation",
"source": "cisa_adp",
"evidence_type": "ssvc_active",
"confidence": "confirmed",
"evidence_url": null,
"maturity_rank": 80,
"fixed_version": null,
"ecosystem": null,
"product": null,
"explanation": null,
"first_seen": "2026-07-22T19:52:45Z",
"last_seen": "2026-07-22T19:52:45Z"
},
{
"type": "exploitation",
"source": "cisa_kev",
"evidence_type": "kev_listed",
"confidence": "confirmed",
"evidence_url": null,
"maturity_rank": 80,
"fixed_version": null,
"ecosystem": null,
"product": null,
"explanation": null,
"first_seen": "2026-07-22T19:52:45Z",
"last_seen": "2026-07-22T19:52:45Z"
},
{
"type": "exploitation",
"source": "exploitdb",
"evidence_type": "poc_public",
"confidence": "high",
"evidence_url": "https://www.exploit-db.com/exploits/52506",
"maturity_rank": 40,
"fixed_version": null,
"ecosystem": null,
"product": null,
"explanation": null,
"first_seen": "2026-07-22T19:52:45Z",
"last_seen": "2026-07-22T19:52:45Z"
},
{
"type": "exploitation",
"source": "github_poc_search",
"evidence_type": "poc_public",
"confidence": "medium",
"evidence_url": "https://github.com/alptexans/RSC-Detect-CVE-2025-55182",
"maturity_rank": 40,
"fixed_version": null,
"ecosystem": null,
"product": null,
"explanation": null,
"first_seen": "2026-07-22T19:52:45Z",
"last_seen": "2026-07-22T19:52:45Z"
}
]
}Response schema
| Field | Type | Description |
|---|---|---|
evidence[].type | string | Evidence family: exploitation, detection, or mitigation. |
evidence[].source | string | Signal source (cisa_kev, metasploit, nuclei, nvd, osv, git_ref, ...). |
evidence[].evidence_type | string | Specific signal: kev_listed, weaponized_exploit, poc_public, ssvc_active, detection_template, fixed_version, fix_commit, ... |
evidence[].confidence | string | null | Source confidence: confirmed, high, medium, low. |
evidence[].maturity_rank | integer | null | Exploitation maturity ordering (higher = more mature); null for other families. |
evidence[].fixed_version / ecosystem / product | string | null | Mitigation specifics, when the evidence is a fixed version. |
evidence[].evidence_url | string | null | Link to the underlying signal. |
evidence[].first_seen / last_seen | string | null | Observation window (ISO 8601). |
Responses
| Status | Meaning |
|---|---|
200 | Success. |
400 | A path or query parameter failed validation. |
401 | Missing or invalid access token. |
403 | The CVE is outside your access tier. |
404 | No record exists for the CVE. |
429 | Rate limit exceeded. |
A CVE with no evidence of the requested type returns count 0.
{
"cve_id": "CVE-2025-55182",
"count": 0,
"evidence": []
}