# Vulnerability Search Examples

Worked Vulnerability Search examples: one for every searchable CVE field with data, plus operators, must / should / must_not, sorting and pagination.

Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/

Last updated: 2026-09-26

---
`POST https://api.deepinfo.com/v1/discovery/vulnerability-search` · endpoint: [Search](/reference/vulnerability/search/)

Worked examples for Vulnerability Search: one for every searchable field that has data, grouped like the CVE record (NVD fields, CVSS v2 to 4.0, configurations, then Deepinfo's enrichment: affected products, CWE, EPSS, CISA KEV and the Deepinfo score), then operators, combinations, sorting and pagination.

Every example is a real request with the response the API returned. The body is `{"filters": {"must": [...], "should": [...], "must_not": [...]}, "sort": [...]}`; a filter is `{"name": <field>, "type": <operator>, "value": <value>}` (see [Search & Filters](/getting-started/search-and-filters/)). The field examples use the operator that fits the field best; the table after the examples lists what each field accepts.

A filter on a field inside a list (references, CVSS metrics, weaknesses, CPE entries, CWEs) matches a CVE when any entry matches, so a result can show other values next to the matching one.

Responses are trimmed for display: `results` shows the first 3 records, long lists inside a record the first 10 items and very long texts the first 4,000 characters, while `result_count` stays the full total; each page says what was shortened. E-mail addresses of CVE sources are shown as `user@<domain>`, except HackerOne's role mailbox `support@hackerone.com`, which is kept as it is. The same masking reaches the mailing-list address inside Fedora archive links (`https://lists.fedoraproject.org/archives/list/user@lists.fedoraproject.org/`, also written with `%40`), so those reference links do not open.

## Supported Operators by Field

Not every field takes every operator: a filter with an operator its field does not support is answered with HTTP 400 ("Field '…' does not support '…' query"). Verified against the live API on 2026-09-24.

Legend: `wc` wildcard · `sw` startswith · `any` contains_any · `all` contains_all · `ex` exists; `eq`, `in`, `lte`, `gte`, `gt` and `lt` are the operators' own names.

| Family | Field | Operators |
|---|---|---|
| Identity and Status | `id` | eq wc sw ex gt lt |
|  | `published` | eq lte gte ex gt lt |
|  | `last_modified` | eq lte gte ex gt lt |
|  | `evaluator_comment` | eq wc sw any all ex |
|  | `evaluator_solution` | eq wc sw any all ex |
|  | `evaluator_impact` | eq wc sw any all ex |
|  | `source_identifier` | eq wc sw ex |
|  | `status` | eq wc sw ex |
| NVD KEV Fields | `cisa_exploit_add` | eq lte gte ex gt lt |
|  | `cisa_action_due` | eq lte gte ex gt lt |
|  | `cisa_required_action` | eq wc sw any all ex |
|  | `cisa_vulnerability_name` | eq wc sw any all ex |
| Descriptions and References | `references.tags` | eq in wc sw ex |
|  | `descriptions.lang` | eq wc sw ex |
|  | `references.url` | eq wc sw ex |
|  | `references.source` | eq wc sw ex |
|  | `descriptions.value` | wc any all ex |
| CVSS v2 | `metrics.cvss_metric_v2.cvss_data.base_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v2.cvss_data.temporal_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v2.cvss_data.environmental_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v2.exploitability_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v2.impact_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v2.source` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.type` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.version` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.vector_string` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.access_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.access_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.authentication` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.confidentiality_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.integrity_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.availability_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.exploitability` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.remediation_level` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.report_confidence` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.collateral_damage_potential` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.target_distribution` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.confidentiality_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.integrity_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.cvss_data.availability_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.base_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v2.ac_insuf_info` | eq ex |
|  | `metrics.cvss_metric_v2.obtain_all_privilege` | eq ex |
|  | `metrics.cvss_metric_v2.obtain_user_privilege` | eq ex |
|  | `metrics.cvss_metric_v2.obtain_other_privilege` | eq ex |
|  | `metrics.cvss_metric_v2.user_interaction_required` | eq ex |
| CVSS v3.0 | `metrics.cvss_metric_v30.cvss_data.base_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v30.cvss_data.temporal_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v30.cvss_data.environmental_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v30.exploitability_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v30.impact_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v30.source` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.type` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.version` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.vector_string` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.scope` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.confidentiality_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.integrity_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.availability_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.base_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.exploit_code_maturity` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.remediation_level` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.report_confidence` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.temporal_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.confidentiality_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.integrity_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.availability_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_scope` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_confidentiality_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_integrity_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.modified_availability_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v30.cvss_data.environmental_severity` | eq wc sw ex |
| CVSS v3.1 | `metrics.cvss_metric_v31.cvss_data.base_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v31.cvss_data.temporal_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v31.cvss_data.environmental_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v31.exploitability_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v31.impact_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v31.source` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.type` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.version` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.vector_string` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.scope` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.confidentiality_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.integrity_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.availability_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.base_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.exploit_code_maturity` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.remediation_level` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.report_confidence` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.temporal_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.confidentiality_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.integrity_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.availability_requirement` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_scope` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_confidentiality_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_integrity_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.modified_availability_impact` | eq wc sw ex |
|  | `metrics.cvss_metric_v31.cvss_data.environmental_severity` | eq wc sw ex |
| CVSS v4.0 | `metrics.cvss_metric_v40.cvss_data.base_score` | eq lte gte ex gt lt |
|  | `metrics.cvss_metric_v40.source` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.type` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.version` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.vector_string` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.base_severity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.attack_requirements` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.vulnerable_system_confidentiality` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.vulnerable_system_integrity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.vulnerable_system_availability` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.subsequent_system_confidentiality` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.subsequent_system_integrity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.subsequent_system_availability` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.exploit_maturity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.confidentiality_requirements` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.integrity_requirements` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.availability_requirements` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_attack_vector` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_attack_complexity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_attack_requirements` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_privileges_required` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_user_interaction` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_confidentiality` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_integrity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_availability` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_confidentiality` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_integrity` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_availability` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.safety` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.automatable` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.recovery` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.value_density` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` | eq wc sw ex |
|  | `metrics.cvss_metric_v40.cvss_data.provider_urgency` | eq wc sw ex |
| Weaknesses | `weaknesses.source` | eq wc sw ex |
|  | `weaknesses.type` | eq wc sw ex |
|  | `weaknesses.description.lang` | eq wc sw ex |
|  | `weaknesses.description.value` | eq wc sw ex |
| Configurations | `configurations.operator` | eq wc sw ex |
|  | `configurations.nodes.operator` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.criteria` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.match_criteria_id` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.version_start_including` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.version_start_excluding` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.version_end_including` | eq wc sw ex |
|  | `configurations.nodes.cpe_match.version_end_excluding` | eq wc sw ex |
|  | `configurations.negate` | eq ex |
|  | `configurations.nodes.negate` | eq ex |
|  | `configurations.nodes.cpe_match.vulnerable` | eq ex |
| Vendor Comments | `vendor_comments.organization` | eq wc sw any all ex |
|  | `vendor_comments.comment` | eq wc sw any all ex |
|  | `vendor_comments.last_modified` | eq lte gte ex gt lt |
| Affected Products (CPE) | `enrichment.cpe.affected_versions` | eq in wc sw ex |
|  | `enrichment.cpe.criteria` | eq wc sw ex |
|  | `enrichment.cpe.vendor` | eq wc sw ex |
|  | `enrichment.cpe.product` | eq wc sw ex |
|  | `enrichment.cpe.product_type` | eq wc sw ex |
|  | `enrichment.cpe.version_start_including` | eq wc sw ex |
|  | `enrichment.cpe.version_start_excluding` | eq wc sw ex |
|  | `enrichment.cpe.version_end_including` | eq wc sw ex |
|  | `enrichment.cpe.version_end_excluding` | eq wc sw ex |
|  | `enrichment.cpe.affected_versions_first` | eq wc sw ex |
|  | `enrichment.cpe.affected_versions_last` | eq wc sw ex |
|  | `enrichment.cpe.cpe_names.cpe_name` | eq wc sw ex |
|  | `enrichment.cpe.vulnerable` | eq ex |
|  | `enrichment.cpe.cpe_names.deprecated` | eq ex |
| CWE | `enrichment.cwe.capec_id` | eq in lte gte ex gt lt |
|  | `enrichment.cwe.id` | eq lte gte ex gt lt |
|  | `enrichment.cwe.name` | eq wc sw any all ex |
|  | `enrichment.cwe.scope` | eq in wc sw ex |
|  | `enrichment.cwe.impact` | eq in wc sw ex |
|  | `enrichment.cwe.detection_method` | eq in wc sw ex |
|  | `enrichment.cwe.owasptop10_2021` | eq wc sw ex |
|  | `enrichment.cwe.description` | wc any all ex |
| EPSS | `enrichment.epss_score.epss` | eq lte gte ex gt lt |
|  | `enrichment.epss_score.percentile` | eq lte gte ex gt lt |
|  | `enrichment.epss_score.date` | eq lte gte ex gt lt |
| CISA KEV Catalog | `enrichment.cisa_kev.vulnerability_name` | eq wc sw any all ex |
|  | `enrichment.cisa_kev.short_description` | eq wc sw any all ex |
|  | `enrichment.cisa_kev.required_action` | eq wc sw any all ex |
|  | `enrichment.cisa_kev.notes` | eq wc sw any all ex |
|  | `enrichment.cisa_kev.date_added` | eq lte gte ex gt lt |
|  | `enrichment.cisa_kev.due_date` | eq lte gte ex gt lt |
|  | `enrichment.cisa_kev.vendor_project` | eq wc sw ex |
|  | `enrichment.cisa_kev.product` | eq wc sw ex |
|  | `enrichment.cisa_kev.known_ransomware_campaign_use` | eq wc sw ex |
| Deepinfo Score | `enrichment.vdeep_metric.cvss_data.base_score` | eq lte gte ex gt lt |
|  | `enrichment.vdeep_metric.available_versions` | eq in wc sw ex |
|  | `enrichment.vdeep_metric.source` | eq wc sw ex |
|  | `enrichment.vdeep_metric.type` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.version` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.vector_string` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.attack_vector` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.attack_complexity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.attack_requirements` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.privileges_required` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.user_interaction` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.subsequent_system_integrity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.exploit_maturity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.confidentiality_requirements` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.integrity_requirements` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.availability_requirements` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_attack_vector` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_attack_complexity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_attack_requirements` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_privileges_required` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_user_interaction` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.safety` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.automatable` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.recovery` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.value_density` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.provider_urgency` | eq wc sw ex |
|  | `enrichment.vdeep_metric.cvss_data.base_severity` | eq wc sw ex |

## Fields Without an Example

As of September 24, 2026, these fields have no worked example. The fields below are searchable, but no CVE record has a value in them.

| Field | Why |
|---|---|
| `metrics.cvss_metric_v2.cvss_data.exploitability` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.remediation_level` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.report_confidence` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.temporal_score` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.collateral_damage_potential` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.target_distribution` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.confidentiality_requirement` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.integrity_requirement` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.availability_requirement` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v2.cvss_data.environmental_score` | No CVE has a value: an `exists` filter on the CVSS v2 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.exploit_code_maturity` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.remediation_level` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.report_confidence` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.temporal_score` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.temporal_severity` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.confidentiality_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.integrity_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.availability_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_attack_vector` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_attack_complexity` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_privileges_required` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_user_interaction` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_scope` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_confidentiality_impact` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_integrity_impact` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.modified_availability_impact` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.environmental_score` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v30.cvss_data.environmental_severity` | No CVE has a value: an `exists` filter on the CVSS v3.0 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.exploit_code_maturity` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.remediation_level` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.report_confidence` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.temporal_score` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.temporal_severity` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.confidentiality_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.integrity_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.availability_requirement` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_attack_vector` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_attack_complexity` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_privileges_required` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_user_interaction` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_scope` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_confidentiality_impact` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_integrity_impact` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.modified_availability_impact` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.environmental_score` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `metrics.cvss_metric_v31.cvss_data.environmental_severity` | No CVE has a value: an `exists` filter on the CVSS v3.1 temporal and environmental fields returned 0 results (2026-09-24). |
| `configurations.negate` | No CVE has a value: an `exists` filter returned 0 results (2026-09-24). |

## Parameters Without an Example

As of September 24, 2026, these parameters have no worked example. The export parameters are not shown: these examples make read-only calls only.

| Parameter | Why |
|---|---|
| `export` | Turns the search into an export; the examples do not create exports. |
| `export_format` | Only used with `export`. |
| `export_scope` | Only used with `export`. |

Each example links to its own page with the request and the response.

## Defaults

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Every CVE](/reference/vulnerability/search/examples/every-cve/) |  |  |  |

## Filters › Identity and Status

| Example | Field | Operator | Sort |
|---|---|---|---|
| [One CVE by Id](/reference/vulnerability/search/examples/id/) | `id` | `eq` |  |
| [CVEs Published by the Apache Software Foundation](/reference/vulnerability/search/examples/source-identifier/) | `source_identifier` | `wildcard` |  |
| [CVEs Published in December 2021](/reference/vulnerability/search/examples/published/) | `published` | `gte`<br>`lte` |  |
| [CVEs Modified Since 20 September 2026](/reference/vulnerability/search/examples/last-modified/) | `last_modified` | `gte` |  |
| [CVEs Awaiting NVD Analysis](/reference/vulnerability/search/examples/status/) | `status` | `eq` |  |
| [NVD Comments That Quote Oracle](/reference/vulnerability/search/examples/evaluator-comment/) | `evaluator_comment` | `startswith` |  |
| [CVEs With an NVD Solution Note](/reference/vulnerability/search/examples/evaluator-solution/) | `evaluator_solution` | `exists` |  |
| [NVD Impact Notes on CVSS v2 Scoring](/reference/vulnerability/search/examples/evaluator-impact/) | `evaluator_impact` | `startswith` |  |

## Filters › NVD KEV Fields

The CISA KEV fields of the NVD record itself. The same catalog entry, with more fields, is under `enrichment.cisa_kev` (see CISA KEV Catalog).

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Added to CISA KEV Since 1 September 2026](/reference/vulnerability/search/examples/cisa-exploit-add/) | `cisa_exploit_add` | `gte` |  |
| [KEV Remediation Due in November 2021](/reference/vulnerability/search/examples/cisa-action-due/) | `cisa_action_due` | `gte`<br>`lte` |  |
| [KEV Entries That Require Vendor Updates](/reference/vulnerability/search/examples/cisa-required-action/) | `cisa_required_action` | `eq` |  |
| [KEV Names With Remote Code Execution](/reference/vulnerability/search/examples/cisa-vulnerability-name/) | `cisa_vulnerability_name` | `wildcard` |  |

## Filters › Descriptions and References

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVEs With a Spanish Description](/reference/vulnerability/search/examples/descriptions-lang/) | `descriptions.lang` | `eq` |  |
| [Descriptions That Mention JNDI](/reference/vulnerability/search/examples/descriptions-value/) | `descriptions.value` | `contains_any` |  |
| [CVEs With a Palo Alto Networks Advisory](/reference/vulnerability/search/examples/references-url/) | `references.url` | `startswith` |  |
| [References Added by Red Hat](/reference/vulnerability/search/examples/references-source/) | `references.source` | `wildcard` |  |
| [CVEs With an Exploit Reference](/reference/vulnerability/search/examples/references-tags/) | `references.tags` | `eq` |  |

## Filters › CVSS v2

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVSS v2: Scored by the NVD](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-source/) | `metrics.cvss_metric_v2.source` | `wildcard` |  |
| [CVSS v2: Secondary Scores](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-type/) | `metrics.cvss_metric_v2.type` | `eq` |  |
| [CVSS v2: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-version/) | `metrics.cvss_metric_v2.cvss_data.version` | `eq` |  |
| [CVSS v2: Remote, No Authentication, Complete Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-vector-string/) | `metrics.cvss_metric_v2.cvss_data.vector_string` | `eq` |  |
| [CVSS v2: Local Access Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-vector/) | `metrics.cvss_metric_v2.cvss_data.access_vector` | `eq` |  |
| [CVSS v2: Medium Access Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-complexity/) | `metrics.cvss_metric_v2.cvss_data.access_complexity` | `eq` |  |
| [CVSS v2: Single Authentication](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-authentication/) | `metrics.cvss_metric_v2.cvss_data.authentication` | `eq` |  |
| [CVSS v2: Complete Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-confidentiality-impact/) | `metrics.cvss_metric_v2.cvss_data.confidentiality_impact` | `eq` |  |
| [CVSS v2: Partial Integrity Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-integrity-impact/) | `metrics.cvss_metric_v2.cvss_data.integrity_impact` | `eq` |  |
| [CVSS v2: No Availability Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-availability-impact/) | `metrics.cvss_metric_v2.cvss_data.availability_impact` | `eq` |  |
| [CVSS v2: Base Score of 10](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-base-score/) | `metrics.cvss_metric_v2.cvss_data.base_score` | `eq` |  |
| [CVSS v2: Medium Severity](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-base-severity/) | `metrics.cvss_metric_v2.base_severity` | `eq` |  |
| [CVSS v2: Low Exploitability Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-exploitability-score/) | `metrics.cvss_metric_v2.exploitability_score` | `lte` |  |
| [CVSS v2: Low Impact Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-impact-score/) | `metrics.cvss_metric_v2.impact_score` | `lte` |  |
| [CVSS v2: Insufficient Information](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-ac-insuf-info/) | `metrics.cvss_metric_v2.ac_insuf_info` | `eq` |  |
| [CVSS v2: Attack Gains All Privileges](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-all-privilege/) | `metrics.cvss_metric_v2.obtain_all_privilege` | `eq` |  |
| [CVSS v2: Attack Gains User Privileges](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-user-privilege/) | `metrics.cvss_metric_v2.obtain_user_privilege` | `eq` |  |
| [CVSS v2: Attack Gains Other Privileges](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-other-privilege/) | `metrics.cvss_metric_v2.obtain_other_privilege` | `eq` | `published` |
| [CVSS v2: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-user-interaction-required/) | `metrics.cvss_metric_v2.user_interaction_required` | `eq` |  |

## Filters › CVSS v3.0

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVSS v3.0: Scored by HackerOne](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-source/) | `metrics.cvss_metric_v30.source` | `wildcard` |  |
| [CVSS v3.0: Primary Scores](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-type/) | `metrics.cvss_metric_v30.type` | `eq` |  |
| [CVSS v3.0: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-version/) | `metrics.cvss_metric_v30.cvss_data.version` | `eq` |  |
| [CVSS v3.0: Remote Without Privileges or Interaction](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-vector-string/) | `metrics.cvss_metric_v30.cvss_data.vector_string` | `startswith` |  |
| [CVSS v3.0: Local Attack Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-vector/) | `metrics.cvss_metric_v30.cvss_data.attack_vector` | `eq` |  |
| [CVSS v3.0: High Attack Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-complexity/) | `metrics.cvss_metric_v30.cvss_data.attack_complexity` | `eq` |  |
| [CVSS v3.0: High Privileges Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-privileges-required/) | `metrics.cvss_metric_v30.cvss_data.privileges_required` | `eq` |  |
| [CVSS v3.0: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-user-interaction/) | `metrics.cvss_metric_v30.cvss_data.user_interaction` | `eq` |  |
| [CVSS v3.0: Changed Scope](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-scope/) | `metrics.cvss_metric_v30.cvss_data.scope` | `eq` |  |
| [CVSS v3.0: Low Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-confidentiality-impact/) | `metrics.cvss_metric_v30.cvss_data.confidentiality_impact` | `eq` |  |
| [CVSS v3.0: No Integrity Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-integrity-impact/) | `metrics.cvss_metric_v30.cvss_data.integrity_impact` | `eq` |  |
| [CVSS v3.0: High Availability Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-availability-impact/) | `metrics.cvss_metric_v30.cvss_data.availability_impact` | `eq` |  |
| [CVSS v3.0: Base Score 9 and Up](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-base-score/) | `metrics.cvss_metric_v30.cvss_data.base_score` | `gte` |  |
| [CVSS v3.0: Medium Severity](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-base-severity/) | `metrics.cvss_metric_v30.cvss_data.base_severity` | `eq` |  |
| [CVSS v3.0: Highest Exploitability Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-exploitability-score/) | `metrics.cvss_metric_v30.exploitability_score` | `eq` |  |
| [CVSS v3.0: Low Impact Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-impact-score/) | `metrics.cvss_metric_v30.impact_score` | `lte` |  |

## Filters › CVSS v3.1

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVSS v3.1: Scored by Microsoft](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-source/) | `metrics.cvss_metric_v31.source` | `wildcard` |  |
| [CVSS v3.1: Primary Scores](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-type/) | `metrics.cvss_metric_v31.type` | `eq` |  |
| [CVSS v3.1: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-version/) | `metrics.cvss_metric_v31.cvss_data.version` | `eq` |  |
| [CVSS v3.1: The Log4Shell Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-vector-string/) | `metrics.cvss_metric_v31.cvss_data.vector_string` | `eq` |  |
| [CVSS v3.1: Local Attack Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-vector/) | `metrics.cvss_metric_v31.cvss_data.attack_vector` | `eq` |  |
| [CVSS v3.1: High Attack Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-complexity/) | `metrics.cvss_metric_v31.cvss_data.attack_complexity` | `eq` |  |
| [CVSS v3.1: Low Privileges Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-privileges-required/) | `metrics.cvss_metric_v31.cvss_data.privileges_required` | `eq` |  |
| [CVSS v3.1: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-user-interaction/) | `metrics.cvss_metric_v31.cvss_data.user_interaction` | `eq` |  |
| [CVSS v3.1: Unchanged Scope](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-scope/) | `metrics.cvss_metric_v31.cvss_data.scope` | `eq` |  |
| [CVSS v3.1: High Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-confidentiality-impact/) | `metrics.cvss_metric_v31.cvss_data.confidentiality_impact` | `eq` |  |
| [CVSS v3.1: Low Integrity Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-integrity-impact/) | `metrics.cvss_metric_v31.cvss_data.integrity_impact` | `eq` |  |
| [CVSS v3.1: No Availability Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-availability-impact/) | `metrics.cvss_metric_v31.cvss_data.availability_impact` | `eq` |  |
| [CVSS v3.1: Base Score 9.8 and Up](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-base-score/) | `metrics.cvss_metric_v31.cvss_data.base_score` | `gte` |  |
| [CVSS v3.1: Critical Severity](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-base-severity/) | `metrics.cvss_metric_v31.cvss_data.base_severity` | `eq` |  |
| [CVSS v3.1: Hard to Exploit](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-exploitability-score/) | `metrics.cvss_metric_v31.exploitability_score` | `lte` |  |
| [CVSS v3.1: Impact Score 5.9 and Up](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-impact-score/) | `metrics.cvss_metric_v31.impact_score` | `gte` |  |

## Filters › CVSS v4.0

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVSS 4.0: Scored by VulnCheck](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-source/) | `metrics.cvss_metric_v40.source` | `wildcard` |  |
| [CVSS 4.0: Secondary Scores](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-type/) | `metrics.cvss_metric_v40.type` | `eq` |  |
| [CVSS 4.0: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-version/) | `metrics.cvss_metric_v40.cvss_data.version` | `eq` |  |
| [CVSS 4.0: Remote With High Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-vector-string/) | `metrics.cvss_metric_v40.cvss_data.vector_string` | `startswith` |  |
| [CVSS 4.0: Base Score 9.0 to 9.9](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-base-score/) | `metrics.cvss_metric_v40.cvss_data.base_score` | `gte`<br>`lte` |  |
| [CVSS 4.0: Medium Severity](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-base-severity/) | `metrics.cvss_metric_v40.cvss_data.base_severity` | `eq` |  |
| [CVSS 4.0: Local Attack Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-vector/) | `metrics.cvss_metric_v40.cvss_data.attack_vector` | `eq` |  |
| [CVSS 4.0: High Attack Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-complexity/) | `metrics.cvss_metric_v40.cvss_data.attack_complexity` | `eq` |  |
| [CVSS 4.0: Attack Requirements Present](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-requirements/) | `metrics.cvss_metric_v40.cvss_data.attack_requirements` | `eq` |  |
| [CVSS 4.0: High Privileges Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-privileges-required/) | `metrics.cvss_metric_v40.cvss_data.privileges_required` | `eq` |  |
| [CVSS 4.0: Passive User Interaction](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-user-interaction/) | `metrics.cvss_metric_v40.cvss_data.user_interaction` | `eq` |  |
| [CVSS 4.0: Exploit Maturity Attacked](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-exploit-maturity/) | `metrics.cvss_metric_v40.cvss_data.exploit_maturity` | `eq` |  |
| [CVSS 4.0: Concentrated Value Density](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-value-density/) | `metrics.cvss_metric_v40.cvss_data.value_density` | `eq` |  |
| [CVSS 4.0: Moderate Response Effort](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-vulnerability-response-effort/) | `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` | `eq` |  |
| [CVSS 4.0: Red Provider Urgency](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-provider-urgency/) | `metrics.cvss_metric_v40.cvss_data.provider_urgency` | `eq` |  |
| [CVSS 4.0: Impact on the Vulnerable and Subsequent Systems](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) | `metrics.cvss_metric_v40.cvss_data.vulnerable_system_confidentiality`<br>`metrics.cvss_metric_v40.cvss_data.vulnerable_system_integrity`<br>`metrics.cvss_metric_v40.cvss_data.vulnerable_system_availability`<br>`metrics.cvss_metric_v40.cvss_data.subsequent_system_confidentiality`<br>`metrics.cvss_metric_v40.cvss_data.subsequent_system_integrity`<br>`metrics.cvss_metric_v40.cvss_data.subsequent_system_availability` | `eq` |  |
| [CVSS 4.0: Environmental Metrics Left Unset](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) | `metrics.cvss_metric_v40.cvss_data.modified_attack_vector`<br>`metrics.cvss_metric_v40.cvss_data.modified_attack_complexity`<br>`metrics.cvss_metric_v40.cvss_data.modified_attack_requirements`<br>`metrics.cvss_metric_v40.cvss_data.modified_privileges_required`<br>`metrics.cvss_metric_v40.cvss_data.modified_user_interaction` | `eq` |  |
| [CVSS 4.0: Security Requirements and Supplemental Metrics](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) | `metrics.cvss_metric_v40.cvss_data.confidentiality_requirements`<br>`metrics.cvss_metric_v40.cvss_data.integrity_requirements`<br>`metrics.cvss_metric_v40.cvss_data.availability_requirements`<br>`metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_confidentiality`<br>`metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_integrity`<br>`metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_availability`<br>`metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_confidentiality`<br>`metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_integrity`<br>`metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_availability`<br>`metrics.cvss_metric_v40.cvss_data.safety`<br>`metrics.cvss_metric_v40.cvss_data.automatable`<br>`metrics.cvss_metric_v40.cvss_data.recovery` | `eq` |  |

## Filters › Weaknesses

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Weaknesses Assigned by a Source With a UUID](/reference/vulnerability/search/examples/weaknesses-source/) | `weaknesses.source` | `eq` |  |
| [Secondary Weakness Entries](/reference/vulnerability/search/examples/weaknesses-type/) | `weaknesses.type` | `eq` |  |
| [Weakness Entries in English](/reference/vulnerability/search/examples/weaknesses-description-lang/) | `weaknesses.description.lang` | `eq` |  |
| [Weakness CWE-502 (Deserialization)](/reference/vulnerability/search/examples/weaknesses-description-value/) | `weaknesses.description.value` | `eq` |  |

## Filters › Configurations

The NVD's configurations: which products (CPE names) and version ranges a CVE applies to.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Configurations That Need Two Products](/reference/vulnerability/search/examples/configurations-operator/) | `configurations.operator` | `eq` |  |
| [Nodes Joined With AND](/reference/vulnerability/search/examples/configurations-nodes-operator/) | `configurations.nodes.operator` | `eq` |  |
| [Configuration Nodes That Are Not Negated](/reference/vulnerability/search/examples/configurations-nodes-negate/) | `configurations.nodes.negate` | `eq` |  |
| [Configurations Listing a Platform](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-vulnerable/) | `configurations.nodes.cpe_match.vulnerable` | `eq` |  |
| [Configurations Matching MOVEit Transfer](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-criteria/) | `configurations.nodes.cpe_match.criteria` | `eq` |  |
| [One CPE Match Criterion by Id](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-match-criteria-id/) | `configurations.nodes.cpe_match.match_criteria_id` | `eq` |  |
| [Configurations Starting at Version 2.13.0](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-start-including/) | `configurations.nodes.cpe_match.version_start_including` | `eq` |  |
| [Configurations Starting After Version 1.8.5](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-start-excluding/) | `configurations.nodes.cpe_match.version_start_excluding` | `eq` |  |
| [Configurations Ending at Version 7.4.3](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-end-including/) | `configurations.nodes.cpe_match.version_end_including` | `eq` |  |
| [Configurations Fixed in Version 2.5.12](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-end-excluding/) | `configurations.nodes.cpe_match.version_end_excluding` | `eq` |  |

## Filters › Vendor Comments

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVEs With a Red Hat Comment](/reference/vulnerability/search/examples/vendor-comments-organization/) | `vendor_comments.organization` | `eq` |  |
| [CVEs With Vendor Comment Text](/reference/vulnerability/search/examples/vendor-comments-comment/) | `vendor_comments.comment` | `exists` |  |
| [Vendor Comments Since 2012](/reference/vulnerability/search/examples/vendor-comments-last-modified/) | `vendor_comments.last_modified` | `gte` |  |

## Filters › Affected Products (CPE)

`enrichment.cpe`: Deepinfo's list of the affected products, one entry per CPE match, with the CPE name split into vendor and product and the version range resolved to known releases.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Affected Product: XZ Utils 5.6.0](/reference/vulnerability/search/examples/enrichment-cpe-criteria/) | `enrichment.cpe.criteria` | `eq` |  |
| [Affected Vendor: GitLab](/reference/vulnerability/search/examples/enrichment-cpe-vendor/) | `enrichment.cpe.vendor` | `eq` |  |
| [Affected Product: XZ (product=xz)](/reference/vulnerability/search/examples/enrichment-cpe-product/) | `enrichment.cpe.product` | `eq` |  |
| [Affected Hardware](/reference/vulnerability/search/examples/enrichment-cpe-product-type/) | `enrichment.cpe.product_type` | `eq` |  |
| [Affected Products That Are Platforms](/reference/vulnerability/search/examples/enrichment-cpe-vulnerable/) | `enrichment.cpe.vulnerable` | `eq` |  |
| [Affected Range Starting at 12.5.0](/reference/vulnerability/search/examples/enrichment-cpe-version-start-including/) | `enrichment.cpe.version_start_including` | `eq` |  |
| [Affected Range Starting After 6.3](/reference/vulnerability/search/examples/enrichment-cpe-version-start-excluding/) | `enrichment.cpe.version_start_excluding` | `eq` |  |
| [Affected Range Ending at 2.4.2](/reference/vulnerability/search/examples/enrichment-cpe-version-end-including/) | `enrichment.cpe.version_end_including` | `eq` |  |
| [Affected Range Fixed in 19.1.8](/reference/vulnerability/search/examples/enrichment-cpe-version-end-excluding/) | `enrichment.cpe.version_end_excluding` | `eq` |  |
| [First Affected Release 2023.4](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-first/) | `enrichment.cpe.affected_versions_first` | `eq` |  |
| [Last Affected Release 2026.2](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-last/) | `enrichment.cpe.affected_versions_last` | `eq` |  |
| [One Release Inside the Affected Range](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions/) | `enrichment.cpe.affected_versions` | `eq` |  |
| [One Concrete CPE Name](/reference/vulnerability/search/examples/enrichment-cpe-cpe-names-cpe-name/) | `enrichment.cpe.cpe_names.cpe_name` | `eq` |  |
| [Affected CPE Names That Are Deprecated](/reference/vulnerability/search/examples/enrichment-cpe-cpe-names-deprecated/) | `enrichment.cpe.cpe_names.deprecated` | `eq` |  |

## Filters › CWE

`enrichment.cwe`: the CWE catalog's entry for every weakness of the CVE.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CWE-89: SQL Injection](/reference/vulnerability/search/examples/enrichment-cwe-id/) | `enrichment.cwe.id` | `eq` |  |
| [OWASP Top 10: Server-Side Request Forgery](/reference/vulnerability/search/examples/enrichment-cwe-owasptop10-2021/) | `enrichment.cwe.owasptop10_2021` | `eq` |  |
| [CWE Name: Deserialization of Untrusted Data](/reference/vulnerability/search/examples/enrichment-cwe-name/) | `enrichment.cwe.name` | `eq` |  |
| [CWE Descriptions That Mention a Shortcut](/reference/vulnerability/search/examples/enrichment-cwe-description/) | `enrichment.cwe.description` | `contains_all` |  |
| [CAPEC 66 or 7 (SQL Injection Patterns)](/reference/vulnerability/search/examples/enrichment-cwe-capec-id/) | `enrichment.cwe.capec_id` | `in` |  |
| [CWE Scope: Non-Repudiation](/reference/vulnerability/search/examples/enrichment-cwe-scope/) | `enrichment.cwe.scope` | `eq` |  |
| [CWE Impact: Hide Activities](/reference/vulnerability/search/examples/enrichment-cwe-impact/) | `enrichment.cwe.impact` | `eq` |  |
| [CWE Detectable by Fuzzing](/reference/vulnerability/search/examples/enrichment-cwe-detection-method/) | `enrichment.cwe.detection_method` | `eq` |  |

## Filters › EPSS

`enrichment.epss_score`: the latest EPSS (Exploit Prediction Scoring System) score. The daily history is in EPSS History.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [EPSS 0.9 and Up](/reference/vulnerability/search/examples/enrichment-epss-score-epss/) | `enrichment.epss_score.epss` | `gte` |  |
| [Top 0.1% by EPSS](/reference/vulnerability/search/examples/enrichment-epss-score-percentile/) | `enrichment.epss_score.percentile` | `gte` |  |
| [EPSS Scores Dated 22 September 2026 or Earlier](/reference/vulnerability/search/examples/enrichment-epss-score-date/) | `enrichment.epss_score.date` | `lte` |  |

## Filters › CISA KEV Catalog

`enrichment.cisa_kev`: the CISA Known Exploited Vulnerabilities catalog entry of the CVE; `null` for a CVE that is not in the catalog.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [KEV Vendor: Microsoft](/reference/vulnerability/search/examples/enrichment-cisa-kev-vendor-project/) | `enrichment.cisa_kev.vendor_project` | `eq` |  |
| [KEV Product: Exchange Server](/reference/vulnerability/search/examples/enrichment-cisa-kev-product/) | `enrichment.cisa_kev.product` | `eq` |  |
| [KEV Names That Mention Log4j2](/reference/vulnerability/search/examples/enrichment-cisa-kev-vulnerability-name/) | `enrichment.cisa_kev.vulnerability_name` | `contains_any` |  |
| [Added to CISA KEV in December 2021](/reference/vulnerability/search/examples/enrichment-cisa-kev-date-added/) | `enrichment.cisa_kev.date_added` | `gte`<br>`lte` |  |
| [KEV Descriptions That Mention JNDI](/reference/vulnerability/search/examples/enrichment-cisa-kev-short-description/) | `enrichment.cisa_kev.short_description` | `wildcard` |  |
| [KEV Entries That Require Mitigations](/reference/vulnerability/search/examples/enrichment-cisa-kev-required-action/) | `enrichment.cisa_kev.required_action` | `startswith` |  |
| [KEV Remediation Due From 24 September 2026](/reference/vulnerability/search/examples/enrichment-cisa-kev-due-date/) | `enrichment.cisa_kev.due_date` | `gte` |  |
| [KEV CVEs Used by Ransomware](/reference/vulnerability/search/examples/enrichment-cisa-kev-known-ransomware-campaign-use/) | `enrichment.cisa_kev.known_ransomware_campaign_use` | `eq` |  |
| [KEV Notes That Cite a CISA Directive](/reference/vulnerability/search/examples/enrichment-cisa-kev-notes/) | `enrichment.cisa_kev.notes` | `wildcard` |  |

## Filters › Deepinfo Score

`enrichment.vdeep_metric`: the CVSS metric Deepinfo uses for the CVE (the newest CVSS version it has), in one shape for every version, so a single filter covers CVSS v2 to 4.0.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [CVEs With a CVSS v3.0 Score](/reference/vulnerability/search/examples/enrichment-vdeep-metric-available-versions/) | `enrichment.vdeep_metric.available_versions` | `eq` |  |
| [Deepinfo Score From GitHub](/reference/vulnerability/search/examples/enrichment-vdeep-metric-source/) | `enrichment.vdeep_metric.source` | `wildcard` |  |
| [Deepinfo Score From the NVD](/reference/vulnerability/search/examples/enrichment-vdeep-metric-type/) | `enrichment.vdeep_metric.type` | `eq` |  |
| [Deepinfo Score From CVSS v2](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-version/) | `enrichment.vdeep_metric.cvss_data.version` | `eq` |  |
| [Deepinfo Score Vector: Classic 9.8](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vector-string/) | `enrichment.vdeep_metric.cvss_data.vector_string` | `eq` |  |
| [Deepinfo Score: Physical Attack Vector](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-vector/) | `enrichment.vdeep_metric.cvss_data.attack_vector` | `eq` |  |
| [Deepinfo Score: High Attack Complexity](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-complexity/) | `enrichment.vdeep_metric.cvss_data.attack_complexity` | `eq` |  |
| [Deepinfo Score: Attack Requirements Present](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-requirements/) | `enrichment.vdeep_metric.cvss_data.attack_requirements` | `eq` |  |
| [Deepinfo Score: High Privileges Required](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-privileges-required/) | `enrichment.vdeep_metric.cvss_data.privileges_required` | `eq` |  |
| [Deepinfo Score: User Interaction Required](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-user-interaction/) | `enrichment.vdeep_metric.cvss_data.user_interaction` | `eq` |  |
| [Deepinfo Score: Complete Confidentiality Impact](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-confidentiality/) | `enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | `eq` |  |
| [Deepinfo Score: Low Integrity Impact](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-integrity/) | `enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | `eq` |  |
| [Deepinfo Score: Low Availability Impact](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-availability/) | `enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | `eq` |  |
| [Deepinfo Score: Exploit Maturity Attacked](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-exploit-maturity/) | `enrichment.vdeep_metric.cvss_data.exploit_maturity` | `eq` |  |
| [Deepinfo Score: Diffuse Value Density](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-value-density/) | `enrichment.vdeep_metric.cvss_data.value_density` | `eq` |  |
| [Deepinfo Score: Low Response Effort](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerability-response-effort/) | `enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | `eq` |  |
| [Deepinfo Score: Amber Provider Urgency](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-provider-urgency/) | `enrichment.vdeep_metric.cvss_data.provider_urgency` | `eq` |  |
| [Deepinfo Score 7.0 to 8.9 (High)](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-base-score/) | `enrichment.vdeep_metric.cvss_data.base_score` | `gte`<br>`lte` |  |
| [Deepinfo Score: Low Severity](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-base-severity/) | `enrichment.vdeep_metric.cvss_data.base_severity` | `eq` |  |
| [Deepinfo Score: No Impact on Subsequent Systems](/reference/vulnerability/search/examples/enrichment-vdeep-metric-subsequent-system/) | `enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality`<br>`enrichment.vdeep_metric.cvss_data.subsequent_system_integrity`<br>`enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | `eq` |  |
| [Deepinfo Score: Environmental Metrics Left Unset](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) | `enrichment.vdeep_metric.cvss_data.modified_attack_vector`<br>`enrichment.vdeep_metric.cvss_data.modified_attack_complexity`<br>`enrichment.vdeep_metric.cvss_data.modified_attack_requirements`<br>`enrichment.vdeep_metric.cvss_data.modified_privileges_required`<br>`enrichment.vdeep_metric.cvss_data.modified_user_interaction` | `eq` |  |
| [Deepinfo Score: Security Requirements and Supplemental Metrics](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) | `enrichment.vdeep_metric.cvss_data.confidentiality_requirements`<br>`enrichment.vdeep_metric.cvss_data.integrity_requirements`<br>`enrichment.vdeep_metric.cvss_data.availability_requirements`<br>`enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality`<br>`enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity`<br>`enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability`<br>`enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality`<br>`enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity`<br>`enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability`<br>`enrichment.vdeep_metric.cvss_data.safety`<br>`enrichment.vdeep_metric.cvss_data.automatable`<br>`enrichment.vdeep_metric.cvss_data.recovery` | `eq` |  |

## Operators

One example for each operator, on a field where it is the natural choice. `eq`, `gte`, `lte` and `exists` appear throughout the field examples.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Wildcard: A Range of CVE Ids](/reference/vulnerability/search/examples/operator-wildcard/) | `id` | `wildcard` |  |
| [Starts With: CVEs of One Year](/reference/vulnerability/search/examples/operator-startswith/) | `id` | `startswith` |  |
| [In: Any of Several Reference Tags](/reference/vulnerability/search/examples/operator-in/) | `references.tags` | `in` |  |
| [Contains Any: Descriptions With One of Several Words](/reference/vulnerability/search/examples/operator-contains-any/) | `descriptions.value` | `contains_any` |  |
| [Contains All: Descriptions With a Word](/reference/vulnerability/search/examples/operator-contains-all/) | `descriptions.value` | `contains_all` |  |
| [Greater Than: Scores Above 9.8](/reference/vulnerability/search/examples/operator-gt/) | `enrichment.vdeep_metric.cvss_data.base_score` | `gt` |  |
| [Less Than: CVEs Published Before 2000](/reference/vulnerability/search/examples/operator-lt/) | `published` | `lt` |  |
| [Exists: Every CVE in the CISA KEV Catalog](/reference/vulnerability/search/examples/operator-exists/) | `enrichment.cisa_kev.date_added` | `exists` |  |

## Combinations

Filters combined the way they are used in practice: `must` filters all have to match, at least one `should` filter has to match, and no `must_not` filter may match.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Exploited, Critical and Likely to Be Exploited Again](/reference/vulnerability/search/examples/kev-critical-high-epss/) | `enrichment.cisa_kev.date_added`<br>`enrichment.vdeep_metric.cvss_data.base_severity`<br>`enrichment.epss_score.epss` | `exists`<br>`eq`<br>`gte` |  |
| [MOVEit Transfer CVEs Other Than the 2023 Mass Exploitation](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/) | `enrichment.cpe.vendor`<br>`enrichment.cpe.product`<br>`id` | `eq` |  |
| [Microsoft CVEs of 2024 With a High EPSS](/reference/vulnerability/search/examples/microsoft-2024-high-epss/) | `enrichment.cpe.vendor`<br>`published`<br>`enrichment.epss_score.epss` | `eq`<br>`gte`<br>`lte` |  |
| [Remote, Unauthenticated and No User Interaction](/reference/vulnerability/search/examples/remote-unauthenticated-no-interaction/) | `metrics.cvss_metric_v31.cvss_data.attack_vector`<br>`metrics.cvss_metric_v31.cvss_data.privileges_required`<br>`metrics.cvss_metric_v31.cvss_data.user_interaction`<br>`metrics.cvss_metric_v31.cvss_data.base_score` | `eq`<br>`gte` |  |
| [SQL Injection or OS Command Injection Since September 2026](/reference/vulnerability/search/examples/sqli-or-command-injection-recent/) | `published`<br>`enrichment.cwe.id` | `gte`<br>`eq` |  |
| [Ransomware CVEs Added to KEV in 2026](/reference/vulnerability/search/examples/ransomware-kev-2026/) | `enrichment.cisa_kev.date_added`<br>`enrichment.cisa_kev.known_ransomware_campaign_use` | `gte`<br>`eq` |  |

## Sorting

`sort` is a list of `{field, order}`; `order` is `asc` or `desc`. One example for each sortable field, each with a filter that makes the order easy to see.

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Sort by Id: Newest Log4j CVEs First](/reference/vulnerability/search/examples/sort-id/) | `enrichment.cpe.product` | `eq` | `id` |
| [Sort by Vendor](/reference/vulnerability/search/examples/sort-enrichment-cpe-vendor/) | `enrichment.cwe.id`<br>`published` | `eq`<br>`gte` | `enrichment.cpe.vendor` |
| [Sort by Product](/reference/vulnerability/search/examples/sort-enrichment-cpe-product/) | `enrichment.cisa_kev.vendor_project` | `eq` | `enrichment.cpe.product` |
| [Sort by Published Date: Newest KEV CVEs First](/reference/vulnerability/search/examples/sort-published/) | `enrichment.cisa_kev.date_added` | `exists` | `published` |
| [Sort by Last Modified: Recently Changed Analysed CVEs](/reference/vulnerability/search/examples/sort-last-modified/) | `status` | `eq` | `last_modified` |
| [Sort by Deepinfo Score: Lowest First](/reference/vulnerability/search/examples/sort-base-score/) | `enrichment.cpe.vendor`<br>`enrichment.cpe.product` | `eq` | `enrichment.vdeep_metric.cvss_data.base_score` |
| [Sort by Deepinfo Severity](/reference/vulnerability/search/examples/sort-base-severity/) | `enrichment.cpe.vendor`<br>`enrichment.cpe.product` | `eq` | `enrichment.vdeep_metric.cvss_data.base_severity` |
| [Sort by EPSS: Most Likely to Be Exploited First](/reference/vulnerability/search/examples/sort-epss/) | `published` | `gte` | `enrichment.epss_score.epss` |
| [Sort by KEV Date: Latest Additions First](/reference/vulnerability/search/examples/sort-cisa-kev-date-added/) | `enrichment.cisa_kev.date_added` | `exists` | `enrichment.cisa_kev.date_added` |

## Pagination

`page` and `page_size` are query parameters. `result_count` is always the full total; results page up to 10,000 (page 400 at 25 per page).

| Example | Field | Operator | Sort |
|---|---|---|---|
| [Second Page of Results](/reference/vulnerability/search/examples/page-2/) | `enrichment.cisa_kev.date_added` | `exists` |  |
| [Larger Pages (100 Results)](/reference/vulnerability/search/examples/page-size-100/) | `enrichment.cisa_kev.date_added` | `exists` |  |
| [Last Reachable Page (10,000 Results)](/reference/vulnerability/search/examples/page-400/) | `published` | `gte` |  |