Vulnerability Detail Examples · Example 3 of 3 in Recent CVEs

A Deferred CVE (CVE-2026-9508)

GEThttps://api.deepinfo.com/v1/discovery/vulnerability-detail

A deferred 2026 CVE with only a CVSS 4.0 score, an English and a Spanish description, and a low EPSS score.

Param: cve
CVE: CVE-2026-9508

Asks for CVE-2026-9508, an exposed-backup flaw in Suprema BioStar 2.

What to Notice

descriptions has an English (en) and a Spanish (es) text.
metrics has only cvss_metric_v40; enrichment.epss_score.epss is 0.00341.
status is Deferred and configurations is empty.

Request

curl

curl 'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-detail"

params = {
    "cve": "CVE-2026-9508"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, params=params, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-9508')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: enrichment.cwe[].capec_id: first 10 items; enrichment.cwe[].detection_method: first 10 items

Response Body

{
  "id": "CVE-2026-9508",
  "source_identifier": "user@incibe.es",
  "published": "2026-05-29T13:16:23Z",
  "last_modified": "2026-07-21T12:10:00Z",
  "status": "Deferred",
  "evaluator_comment": null,
  "evaluator_solution": null,
  "evaluator_impact": null,
  "cisa_exploit_add": null,
  "cisa_action_due": null,
  "cisa_required_action": null,
  "cisa_vulnerability_name": null,
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement."
    },
    {
      "lang": "es",
      "value": "Configuración de permisos incorrecta en un recurso crítico en Suprema BioStar 2 (versiones 2.9.3 a 2.9.11) que permite que los archivos de copia de seguridad queden expuestos públicamente cuando el administrador configura su ruta dentro del directorio raíz web de NGINX. Esta vulnerabilidad permite a un atacante con acceso a la red descargar directamente archivos ZIP de copia de seguridad a través de 'http(s)://[server]/download/…' sin requerir autenticación. Esto expone información altamente sensible que puede conducir a la suplantación del servidor, acceso no autorizado a bases de datos y movimiento lateral."
    }
  ],
  "references": [
    {
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar",
      "source": "user@incibe.es",
      "tags": null
    }
  ],
  "metrics": {
    "cvss_metric_v40": [
      {
        "source": "user@incibe.es",
        "type": "Secondary",
        "cvss_data": {
          "version": "4.0",
          "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "attack_vector": "NETWORK",
          "attack_complexity": "LOW",
          "attack_requirements": "NONE",
          "privileges_required": "NONE",
          "user_interaction": "NONE",
          "vulnerable_system_confidentiality": null,
          "vulnerable_system_integrity": null,
          "vulnerable_system_availability": null,
          "subsequent_system_confidentiality": null,
          "subsequent_system_integrity": null,
          "subsequent_system_availability": null,
          "exploit_maturity": "NOT_DEFINED",
          "confidentiality_requirements": null,
          "integrity_requirements": null,
          "availability_requirements": null,
          "modified_attack_vector": "NOT_DEFINED",
          "modified_attack_complexity": "NOT_DEFINED",
          "modified_attack_requirements": "NOT_DEFINED",
          "modified_privileges_required": "NOT_DEFINED",
          "modified_user_interaction": "NOT_DEFINED",
          "modified_vulnerable_system_confidentiality": null,
          "modified_vulnerable_system_integrity": null,
          "modified_vulnerable_system_availability": null,
          "modified_subsequent_system_confidentiality": null,
          "modified_subsequent_system_integrity": null,
          "modified_subsequent_system_availability": null,
          "safety": null,
          "automatable": null,
          "recovery": null,
          "value_density": "NOT_DEFINED",
          "vulnerability_response_effort": "NOT_DEFINED",
          "provider_urgency": "NOT_DEFINED",
          "base_score": 10.0,
          "base_severity": "CRITICAL"
        }
      }
    ],
    "cvss_metric_v31": null,
    "cvss_metric_v30": null,
    "cvss_metric_v2": null
  },
  "weaknesses": [
    {
      "source": "user@incibe.es",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "configurations": null,
  "vendor_comments": null,
  "enrichment": {
    "cpe": null,
    "cwe": [
      {
        "id": 732,
        "owasptop10_2021": null,
        "name": "Incorrect Permission Assignment for Critical Resource",
        "description": "The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.",
        "capec_id": [
          1,
          17,
          60,
          61,
          62,
          122,
          127,
          180,
          206,
          234
        ],
        "scope": [
          "Access Control",
          "Confidentiality",
          "Integrity",
          "Other"
        ],
        "impact": [
          "Gain Privileges or Assume Identity",
          "Modify Application Data",
          "Other",
          "Read Application Data",
          "Read Files or Directories"
        ],
        "detection_method": [
          "Architecture or Design Review",
          "Automated Dynamic Analysis",
          "Automated Static Analysis",
          "Automated Static Analysis - Binary or Bytecode",
          "Automated Static Analysis - Source Code",
          "Black Box",
          "Dynamic Analysis with Automated Results Interpretation",
          "Dynamic Analysis with Manual Results Interpretation",
          "Fuzzing",
          "Manual Analysis"
        ]
      }
    ],
    "epss_score": {
      "epss": 0.00341,
      "percentile": 0.27608,
      "date": "2026-09-21"
    },
    "cisa_kev": null,
    "vdeep_metric": {
      "available_versions": [
        "4.0"
      ],
      "source": "user@incibe.es",
      "type": "Secondary",
      "cvss_data": {
        "version": "4.0",
        "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
        "attack_vector": "NETWORK",
        "attack_complexity": "LOW",
        "attack_requirements": "NONE",
        "privileges_required": "NONE",
        "user_interaction": "NONE",
        "vulnerable_system_confidentiality": null,
        "vulnerable_system_integrity": null,
        "vulnerable_system_availability": null,
        "subsequent_system_confidentiality": null,
        "subsequent_system_integrity": null,
        "subsequent_system_availability": null,
        "exploit_maturity": "NOT_DEFINED",
        "confidentiality_requirements": null,
        "integrity_requirements": null,
        "availability_requirements": null,
        "modified_attack_vector": "NOT_DEFINED",
        "modified_attack_complexity": "NOT_DEFINED",
        "modified_attack_requirements": "NOT_DEFINED",
        "modified_privileges_required": "NOT_DEFINED",
        "modified_user_interaction": "NOT_DEFINED",
        "modified_vulnerable_system_confidentiality": null,
        "modified_vulnerable_system_integrity": null,
        "modified_vulnerable_system_availability": null,
        "modified_subsequent_system_confidentiality": null,
        "modified_subsequent_system_integrity": null,
        "modified_subsequent_system_availability": null,
        "safety": null,
        "automatable": null,
        "recovery": null,
        "value_density": "NOT_DEFINED",
        "vulnerability_response_effort": "NOT_DEFINED",
        "provider_urgency": "NOT_DEFINED",
        "base_score": 10.0,
        "base_severity": "CRITICAL"
      }
    }
  }
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Detail; the exact request is in the code panel.

Parameter	Value
`cve`query	`CVE-2026-9508`

Reference updated September 24, 2026

Request

Related Examples