# CVSS 4.0: Moderate Response Effort CVEs whose CVSS 4.0 Vulnerability Response Effort is MODERATE. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-vulnerability-response-effort/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose CVSS 4.0 Vulnerability Response Effort is MODERATE. Example 14 of 18 in **Filters › CVSS v4.0** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` · `operator` `eq` `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` is the supplemental metric Vulnerability Response Effort (`LOW`, `MODERATE`, `HIGH` or `NOT_DEFINED`), in the CVSS 4.0 metric (`metrics.cvss_metric_v40`, one entry per scoring source). `eq` matches the exact value `MODERATE`. In the response, look at `results[].metrics.cvss_metric_v40[].cvss_data.vulnerability_response_effort`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `MODERATE` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort", "type": "eq", "value": "MODERATE" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 514, "results": [ { "id": "CVE-2026-4606", "source_identifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "published": "2026-03-23T02:16:05Z", "last_modified": "2026-06-17T10:56:54Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. \n\nDuring installation, ERM creates a Windows service that runs under the LocalSystem account. \n\nWhen the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. \n\nFunctions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. \n\nAny ERM function invoking Windows file open/save dialogs exposes the same risk. \n\nThis vulnerability allows local privilege escalation and may result in full system compromise." }, { "lang": "es", "value": "GV Edge Recording Manager (ERM) v2.3.1 ejecuta incorrectamente los componentes de la aplicación con privilegios de nivel SYSTEM, permitiendo a cualquier usuario local obtener control total del sistema operativo.\n\nDurante la instalación, ERM crea un servicio de Windows que se ejecuta bajo la cuenta LocalSystem.\n\nCuando se inicia la aplicación ERM, se generan procesos relacionados bajo privilegios SYSTEM en lugar del contexto de seguridad del usuario que ha iniciado sesión.\n\nFunciones como 'Importar Datos' abren un cuadro de diálogo de archivos de Windows que opera con permisos SYSTEM, lo que permite la modificación o eliminación de archivos y directorios del sistema protegidos.\n\nCualquier función de ERM que invoque cuadros de diálogo de abrir/guardar archivos de Windows expone el mismo riesgo.\n\nEsta vulnerabilidad permite la escalada de privilegios local y puede resultar en un compromiso total del sistema." } ], "references": [ { "url": "https://https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "CONCENTRATED", "vulnerability_response_effort": "MODERATE", "provider_urgency": "GREEN", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": null, "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-250" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 250, "owasptop10_2021": null, "name": "Execution with Unnecessary Privileges", "description": "The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.", "capec_id": [ 69, 104, 470 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Black Box", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00298, "percentile": 0.2276, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0" ], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "CONCENTRATED", "vulnerability_response_effort": "MODERATE", "provider_urgency": "GREEN", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-42996", "source_identifier": "user@mitre.org", "published": "2026-05-01T07:15:59Z", "last_modified": "2026-06-17T10:48:43Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This occurs in grid2deg in APRSISClient.cpp." } ], "references": [ { "url": "https://amateur-radio-resources.sourceforge.io/PDF/JS8APRS.pdf", "source": "user@mitre.org", "tags": null }, { "url": "https://github.com/JS8Call-improved/JS8Call-improved/commit/a6c7a19b82bbd7c2c0c892576f84d7449e8c7088", "source": "user@mitre.org", "tags": null }, { "url": "https://github.com/JS8Call-improved/JS8Call-improved/security/advisories/GHSA-98hp-pjp7-w62x", "source": "user@mitre.org", "tags": null }, { "url": "https://github.com/js8call/js8call/blob/fd721e8b67eed84cb3c09d018205ab9a53e1a8b1/APRSISClient.cpp#L89-L102", "source": "user@mitre.org", "tags": null }, { "url": "https://github.com/JS8Call-improved/JS8Call-improved/security/advisories/GHSA-98hp-pjp7-w62x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@mitre.org", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:M/U:Green", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "DIFFUSE", "vulnerability_response_effort": "MODERATE", "provider_urgency": "GREEN", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": null, "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@mitre.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-121" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 121, "owasptop10_2021": null, "name": "Stack-based Buffer Overflow", "description": "A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).", "capec_id": null, "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Other" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis", "Fuzzing" ] } ], "epss_score": { "epss": 0.00479, "percentile": 0.40517, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0" ], "source": "user@mitre.org", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:M/U:Green", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "DIFFUSE", "vulnerability_response_effort": "MODERATE", "provider_urgency": "GREEN", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-24822", "source_identifier": "user@tech.gov.sg", "published": "2026-01-27T09:15:52Z", "last_modified": "2026-06-17T10:23:39Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is associated with program files mongoose.C.\n\nThis issue affects wxhelper: through 3.9.10.19-v1." }, { "lang": "es", "value": "Escritura fuera de límites, vulnerabilidad de desbordamiento de búfer basado en montículo en ttttupup wxhelper (módulos src). Esta vulnerabilidad está asociada con los archivos de programa mongoose.C.\n\nEste problema afecta a wxhelper: hasta la 3.9.10.19-v1." } ], "references": [ { "url": "https://github.com/ttttupup/wxhelper/pull/515", "source": "user@tech.gov.sg", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@tech.gov.sg", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "DIFFUSE", "vulnerability_response_effort": "MODERATE", "provider_urgency": "RED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": null, "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@tech.gov.sg", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-122" }, { "lang": "en", "value": "CWE-787" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 122, "owasptop10_2021": null, "name": "Heap-based Buffer Overflow", "description": "A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().", "capec_id": [ 92 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Other" ], "detection_method": [ "Automated Dynamic Analysis", "Fuzzing" ] }, { "id": 787, "owasptop10_2021": null, "name": "Out-of-bounds Write", "description": "The product writes data past the end, or before the beginning, of the intended buffer.", "capec_id": null, "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Memory", "Unexpected State" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00336, "percentile": 0.27118, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0" ], "source": "user@tech.gov.sg", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "DIFFUSE", "vulnerability_response_effort": "MODERATE", "provider_urgency": "RED", "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS 4.0: Concentrated Value Density](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-value-density/) - [CVSS 4.0: Red Provider Urgency](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-provider-urgency/) - [CVSS 4.0: Exploit Maturity Attacked](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-exploit-maturity/) - [CVSS 4.0: Impact on the Vulnerable and Subsequent Systems](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) - [CVSS 4.0: Passive User Interaction](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-user-interaction/) - [CVSS 4.0: Environmental Metrics Left Unset](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/)