# Deepinfo Score Vector: Classic 9.8 CVEs whose Deepinfo score has the common CVSS v3.1 vector of a 9.8, remote with no privileges and high impact. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vector-string/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose Deepinfo score has the common CVSS v3.1 vector of a 9.8, remote with no privileges and high impact. Example 5 of 22 in **Filters › Deepinfo Score** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.vdeep_metric.cvss_data.vector_string` · `operator` `eq` `enrichment.vdeep_metric.cvss_data.vector_string` is the CVSS vector: every metric of the score in one string, in the Deepinfo score (`enrichment.vdeep_metric`: the CVSS metric Deepinfo uses for the CVE, from the newest CVSS version it has). `eq` matches the exact value `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. In the response, look at `results[].enrichment.vdeep_metric.cvss_data.vector_string`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.vdeep_metric.cvss_data.vector_string` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.vdeep_metric.cvss_data.vector_string", "type": "eq", "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 22465, "results": [ { "id": "CVE-2026-9862", "source_identifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "published": "2026-06-15T16:16:35Z", "last_modified": "2026-07-28T13:20:39Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Fortra's \nCore Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing." } ], "references": [ { "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-007", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-78" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:fortra:core_privileged_access_manager_server:*:*:*:*:*:*:*:*", "match_criteria_id": "D06D6520-0EA6-4F7B-8668-07A73BBF7373", "version_start_including": "8.1.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "8.1.0.23" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fortra:core_privileged_access_manager_server:*:*:*:*:*:*:*:*", "match_criteria_id": "3D411C82-7070-4F19-B219-7B0B62BA50C5", "version_start_including": "9.0.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "9.0.0.5" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00992, "percentile": 0.60553, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-9810", "source_identifier": "user@wpscan.com", "published": "2026-07-17T07:16:38Z", "last_modified": "2026-07-17T15:44:29Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation." } ], "references": [ { "url": "https://wpscan.com/vulnerability/6378a370-fe2f-48e7-984f-6e6c575dba60/", "source": "user@wpscan.com", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-269" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 269, "owasptop10_2021": "A04 Insecure Design", "name": "Improper Privilege Management", "description": "The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.", "capec_id": [ 58, 122, 233 ], "scope": [ "Access Control" ], "impact": [ "Gain Privileges or Assume Identity" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00498, "percentile": 0.41596, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-9726", "source_identifier": "user@drupal.org", "published": "2026-07-10T21:17:00Z", "last_modified": "2026-08-06T18:28:34Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17." } ], "references": [ { "url": "https://www.drupal.org/sa-contrib-2026-038", "source": "user@drupal.org", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@drupal.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-915" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:alternativecommerce:alternativecommerce:*:*:*:*:*:drupal:*:*", "match_criteria_id": "1ABFC8A2-2996-4E69-B2C2-AE57D24C56E7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.1.17" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:alternativecommerce:alternativecommerce:*:*:*:*:*:drupal:*:*", "vendor": "alternativecommerce", "product": "alternativecommerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.1.17", "affected_versions_first": "2.0.0", "affected_versions_last": "2.1.16" } ], "cwe": [ { "id": 915, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes", "description": "The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.", "capec_id": null, "scope": [ "Integrity", "Other" ], "impact": [ "Alter Execution Logic", "Execute Unauthorized Code or Commands", "Modify Application Data", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00564, "percentile": 0.45386, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Deepinfo Score From CVSS v2](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-version/) - [Deepinfo Score: Physical Attack Vector](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-vector/) - [Deepinfo Score From the NVD](/reference/vulnerability/search/examples/enrichment-vdeep-metric-type/) - [Deepinfo Score: High Attack Complexity](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-complexity/) - [Deepinfo Score: Attack Requirements Present](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-requirements/) - [CVEs With a CVSS v3.0 Score](/reference/vulnerability/search/examples/enrichment-vdeep-metric-available-versions/)