Vulnerability Search Examples · Example 4 of 16 in Filters › CVSS v3.0

CVSS v3.0: Remote Without Privileges or Interaction

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs whose CVSS v3.0 vector starts with network access, low complexity, no privileges and no user interaction.

Field: metrics.cvss_metric_v30.cvss_data.vector_string
Operator: startswith

metrics.cvss_metric_v30.cvss_data.vector_string is the CVSS vector: every metric of the score in one string, in the CVSS v3.0 metric (metrics.cvss_metric_v30, one entry per scoring source).

startswith matches values that begin with CVSS:3.0/AV:N/AC:L/PR:N/UI:N.

In the response, look at results[].metrics.cvss_metric_v30[].cvss_data.vector_string.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
        "type": "startswith",
        "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
                "type": "startswith",
                "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "metrics.cvss_metric_v30.cvss_data.vector_string",
          type: "startswith",
          value: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
        "type": "startswith",
        "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
                    "type": "startswith",
                    "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
            "type": "startswith",
            "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
        "type": "startswith",
        "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "metrics.cvss_metric_v30.cvss_data.vector_string",
          "type": "startswith",
          "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N"
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 14828,
  "results": [
    {
      "id": "CVE-2026-21636",
      "source_identifier": "support@hackerone.com",
      "published": "2026-01-20T21:16:05Z",
      "last_modified": "2026-06-17T10:18:51Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase."
        },
        {
          "lang": "es",
          "value": "Una falla en el modelo de permisos de Node.js permite que las conexiones de Unix Domain Socket (UDS) eludan las restricciones de red cuando '--permission' está habilitado. Incluso sin '--allow-net', las entradas controladas por el atacante (como URLs u opciones de socketPath) pueden conectarse a sockets locales arbitrarios a través de net, tls o undici/fetch. Esto rompe el límite de seguridad previsto del modelo de permisos y permite el acceso a servicios locales privilegiados, lo que podría llevar a escalada de privilegios, exposición de datos o ejecución de código local.\n\n* El problema afecta a los usuarios del modelo de permisos de Node.js en la versión v25.\n\nEn el momento de esta vulnerabilidad, los permisos de red ('--allow-net') todavía están en fase experimental."
        }
      ],
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "source": "support@hackerone.com",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": [
          {
            "source": "support@hackerone.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.0",
              "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "LOW",
              "integrity_impact": "NONE",
              "availability_impact": "NONE",
              "base_score": 5.8,
              "base_severity": "MEDIUM",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 1.4
          }
        ],
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-284"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                  "match_criteria_id": "970EF154-D905-4FDA-85CB-C3AB08BEFAEC",
                  "version_start_including": "25.0.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "25.3.0"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "vendor": "nodejs",
            "product": "node.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "25.0.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "25.3.0",
            "affected_versions_first": null,
            "affected_versions_last": null
          }
        ],
        "cwe": [
          {
            "id": 284,
            "owasptop10_2021": "A01 Broken Access Control",
            "name": "Improper Access Control",
            "description": "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
            "capec_id": [
              19,
              441,
              478,
              479,
              502,
              503,
              536,
              546,
              550,
              551
            ],
            "scope": [
              "Other"
            ],
            "impact": [
              "Varies by Context"
            ],
            "detection_method": null
          }
        ],
        "epss_score": {
          "epss": 0.00883,
          "percentile": 0.57681,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1",
            "3.0"
          ],
          "source": "user@nist.gov",
          "type": "Primary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-0848",
      "source_identifier": "user@huntr.dev",
      "published": "2026-03-05T21:16:14Z",
      "last_modified": "2026-06-17T10:11:29Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM."
        },
        {
          "lang": "es",
          "value": "Las versiones de NLTK &lt;=3.9.2 son vulnerables a ejecución de código arbitrario debido a una validación de entrada inadecuada en el módulo StanfordSegmenter. El módulo carga dinámicamente archivos .jar de Java externos sin verificación ni sandboxing. Un atacante puede suministrar o reemplazar el archivo JAR, permitiendo la ejecución de bytecode Java arbitrario en el momento de la importación. Esta vulnerabilidad puede ser explotada a través de métodos como el envenenamiento de modelos, ataques MitM o el envenenamiento de dependencias, lo que lleva a ejecución remota de código. El problema surge de la ejecución directa del archivo JAR a través de un subproceso con entrada de classpath no validada, permitiendo que clases maliciosas se ejecuten cuando son cargadas por la JVM."
        }
      ],
      "references": [
        {
          "url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202",
          "source": "user@huntr.dev",
          "tags": [
            "Exploit",
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Exploit",
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": null,
        "cvss_metric_v30": [
          {
            "source": "user@huntr.dev",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.0",
              "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@huntr.dev",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            }
          ]
        },
        {
          "source": "user@nist.gov",
          "type": "Primary",
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "D07FBCBF-3A88-4B1B-AF47-76DF3B7B13B6",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": "3.9.2",
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
            "vendor": "nltk",
            "product": "nltk",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": "3.9.2",
            "version_end_excluding": null,
            "affected_versions_first": "2.0.1",
            "affected_versions_last": "3.9.2"
          }
        ],
        "cwe": [
          {
            "id": 20,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Input Validation",
            "description": "The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.",
            "capec_id": [
              3,
              7,
              8,
              9,
              10,
              13,
              14,
              22,
              23,
              24
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "DoS: Resource Consumption (CPU)",
              "DoS: Resource Consumption (Memory)",
              "Execute Unauthorized Code or Commands",
              "Modify Memory",
              "Read Files or Directories",
              "Read Memory"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Fuzzing",
              "Manual Static Analysis",
              "Manual Static Analysis - Binary or Bytecode",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.00809,
          "percentile": 0.55407,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.0"
          ],
          "source": "user@huntr.dev",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.0",
            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2025-30416",
      "source_identifier": "user@acronis.com",
      "published": "2026-02-20T01:15:59Z",
      "last_modified": "2026-06-17T09:08:41Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800."
        },
        {
          "lang": "es",
          "value": "Divulgación y manipulación de datos sensibles debido a la falta de autorización. Los siguientes productos están afectados: Acronis Cyber Protect 16 (Linux, Windows) anterior a la compilación 39938, Acronis Cyber Protect 15 (Linux, Windows) anterior a la compilación 41800."
        }
      ],
      "references": [
        {
          "url": "https://security-advisory.acronis.com/advisories/SEC-8766",
          "source": "user@acronis.com",
          "tags": [
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": null,
        "cvss_metric_v30": [
          {
            "source": "user@acronis.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.0",
              "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@acronis.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-862"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*",
                  "match_criteria_id": "89899D10-1343-4276-919A-9C1DF2DB8B55",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*",
                  "match_criteria_id": "A77B2499-B3A4-4278-BA0D-59AB59C60352",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*",
                  "match_criteria_id": "BAF6A576-C320-4550-B7F8-4FCAE82FB06A",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:*",
                  "match_criteria_id": "9740A956-D589-4846-8717-B6182EB65F8B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update4:*:*:*:*:*:*",
                  "match_criteria_id": "9AB8B19B-2B40-4F1B-AE24-1C43D362E4BC",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update5:*:*:*:*:*:*",
                  "match_criteria_id": "69506F27-DEF8-4317-9E54-D79CA430AD4B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update6:*:*:*:*:*:*",
                  "match_criteria_id": "7612ED8E-16CE-40CD-8004-94EC27DB286E",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:16:-:*:*:*:*:*:*",
                  "match_criteria_id": "9151E39F-20EA-4A01-9E1A-4A951BEABA5E",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:16:update1:*:*:*:*:*:*",
                  "match_criteria_id": "6F99AD89-6646-4C55-87CD-D20B40D25808",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:acronis:cyber_protect:16:update2:*:*:*:*:*:*",
                  "match_criteria_id": "FEA4EC9E-1766-499B-8B93-6A23F17C4D75",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "155AD4FB-E527-4103-BCEF-801B653DEA37",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update4:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update5:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:15:update6:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "15",
            "affected_versions_last": "15"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:16:-:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "16",
            "affected_versions_last": "16"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:16:update1:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "16",
            "affected_versions_last": "16"
          },
          {
            "criteria": "cpe:2.3:a:acronis:cyber_protect:16:update2:*:*:*:*:*:*",
            "vendor": "acronis",
            "product": "cyber_protect",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "16",
            "affected_versions_last": "16"
          }
        ],
        "cwe": [
          {
            "id": 862,
            "owasptop10_2021": "A01 Broken Access Control",
            "name": "Missing Authorization",
            "description": "The product does not perform an authorization check when an actor attempts to access a resource or perform an action.",
            "capec_id": [
              665
            ],
            "scope": [
              "Access Control",
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Bypass Protection Mechanism",
              "DoS: Crash, Exit, or Restart",
              "DoS: Resource Consumption (CPU)",
              "DoS: Resource Consumption (Memory)",
              "DoS: Resource Consumption (Other)",
              "Gain Privileges or Assume Identity",
              "Modify Application Data",
              "Modify Files or Directories",
              "Read Application Data",
              "Read Files or Directories"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Dynamic Analysis",
              "Automated Static Analysis",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Analysis",
              "Manual Static Analysis - Binary or Bytecode",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.00465,
          "percentile": 0.39522,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.0"
          ],
          "source": "user@acronis.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.0",
            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`metrics.cvss_metric_v30.cvss_data.vector_string`
`filters.must[0].type`body	`startswith`
`filters.must[0].value`body	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N`

Reference updated September 26, 2026

Request

Related Examples