Vulnerability Search Examples · Example 6 of 6 in Combinations

Ransomware CVEs Added to KEV in 2026

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs added to the CISA KEV catalog in 2026 that are known to be used in ransomware campaigns.

Field: enrichment.cisa_kev.date_added enrichment.cisa_kev.known_ransomware_campaign_use
Operator: gte eq

A catalog date and the ransomware flag of the same KEV entry.

In the response, look at results[].enrichment.cisa_kev.date_added and results[].enrichment.cisa_kev.known_ransomware_campaign_use.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.date_added",
        "type": "gte",
        "value": "2026-01-01"
      },
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "enrichment.cisa_kev.date_added",
                "type": "gte",
                "value": "2026-01-01"
            },
            {
                "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
                "type": "eq",
                "value": "Known"
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "enrichment.cisa_kev.date_added",
          type: "gte",
          value: "2026-01-01"
        },
        {
          name: "enrichment.cisa_kev.known_ransomware_campaign_use",
          type: "eq",
          value: "Known"
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.date_added",
        "type": "gte",
        "value": "2026-01-01"
      },
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "enrichment.cisa_kev.date_added",
                    "type": "gte",
                    "value": "2026-01-01"
                  },
                  {
                    "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
                    "type": "eq",
                    "value": "Known"
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "enrichment.cisa_kev.date_added",
            "type": "gte",
            "value": "2026-01-01"
          },
          {
            "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
            "type": "eq",
            "value": "Known"
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.date_added",
        "type": "gte",
        "value": "2026-01-01"
      },
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "enrichment.cisa_kev.date_added",
          "type": "gte",
          "value": "2026-01-01"
        },
        {
          "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
          "type": "eq",
          "value": "Known"
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 27,
  "results": [
    {
      "id": "CVE-2026-20131",
      "source_identifier": "user@cisco.com",
      "published": "2026-03-04T18:16:27Z",
      "last_modified": "2026-06-17T10:17:10Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-03-19",
      "cisa_action_due": "2026-03-22",
      "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "cisa_vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&nbsp;on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced."
        },
        {
          "lang": "es",
          "value": "Una vulnerabilidad en la interfaz de gestión basada en web del software Cisco Secure Firewall Management Center (FMC) podría permitir a un atacante remoto no autenticado ejecutar código Java arbitrario como root en un dispositivo afectado.\nEsta vulnerabilidad se debe a la deserialización insegura de un flujo de bytes Java proporcionado por el usuario. Un atacante podría explotar esta vulnerabilidad enviando un objeto Java serializado diseñado a la interfaz de gestión basada en web de un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario en el dispositivo y elevar privilegios a root.\nNota: Si la interfaz de gestión de FMC no tiene acceso público a internet, la superficie de ataque asociada con esta vulnerabilidad se reduce."
        }
      ],
      "references": [
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh",
          "source": "user@cisco.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Technical Description"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@cisco.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@cisco.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*",
                  "match_criteria_id": "E0780AD6-4F38-4400-AA63-E41879F74B68",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*",
                  "match_criteria_id": "86BA5BA6-1F79-4C89-A3F4-A56E2B664AED",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*",
                  "match_criteria_id": "52C7994F-AA17-467B-919E-A49F0CC9DB47",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*",
                  "match_criteria_id": "9F007F6B-1EAA-468C-8159-78B020DF1E58",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*",
                  "match_criteria_id": "C9053FDE-A6BE-4535-AE36-A323F8B7ACA4",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*",
                  "match_criteria_id": "6E255975-F952-43AB-A577-B8D331DDB3AB",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*",
                  "match_criteria_id": "DFA94312-376E-4785-888F-3C07612E1DF7",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "29E73FBF-2579-4660-AFFA-7F9607004226",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "87FAAFFB-0589-441B-8289-8B8A6E18F705",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "73B92119-793D-4A43-A056-24DB6826E759",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.13",
            "affected_versions_last": "6.4.0.13"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.14",
            "affected_versions_last": "6.4.0.14"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.15",
            "affected_versions_last": "6.4.0.15"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.16",
            "affected_versions_last": "6.4.0.16"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.17",
            "affected_versions_last": "6.4.0.17"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.18",
            "affected_versions_last": "6.4.0.18"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.0",
            "affected_versions_last": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.0.1",
            "affected_versions_last": "7.0.0.1"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.1",
            "affected_versions_last": "7.0.1"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.1.1",
            "affected_versions_last": "7.0.1.1"
          }
        ],
        "cwe": [
          {
            "id": 502,
            "owasptop10_2021": "A08 Software and Data Integrity Failures",
            "name": "Deserialization of Untrusted Data",
            "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.",
            "capec_id": [
              586
            ],
            "scope": [
              "Availability",
              "Integrity",
              "Other"
            ],
            "impact": [
              "DoS: Resource Consumption (CPU)",
              "Modify Application Data",
              "Unexpected State",
              "Varies by Context"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.33379,
          "percentile": 0.98303,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "Cisco",
          "product": "Secure Firewall Management Center (FMC)",
          "vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
          "date_added": "2026-03-19",
          "short_description": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.",
          "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
          "due_date": "2026-03-22",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@cisco.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-15409",
      "source_identifier": "user@sonicwall.com",
      "published": "2026-07-14T20:16:56Z",
      "last_modified": "2026-07-16T05:16:18Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-07-14",
      "cisa_action_due": "2026-07-17",
      "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "cisa_vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
        }
      ],
      "references": [
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008",
          "source": "user@sonicwall.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@sonicwall.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-918"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "7F861049-5B88-4E18-A0E7-D1E2BC7A4342",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "E4A6CA48-E2D9-4F18-8FC8-B1EE7F51789C",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "EBCE7761-8416-4942-B0BD-426EFC73B57C",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "CE23BD37-4112-407F-9E34-04CB5A4DA996",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "95E3313E-0647-40ED-9848-5AC01188A84F",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "75F6B9CE-73E4-42BE-9CE1-FD79255CDD0B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "7B24D300-1154-49A1-A1F3-FB0CC717166A",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        },
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "55CD7766-9F2D-450D-A878-AA1522E8FF68",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "EAF12D10-FA8F-471E-B008-68E0E29089C6",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "79920402-165D-4D81-BFD2-9F679A48671A",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "6842E4D7-BEDA-41FB-AEC3-CEB3692374C2",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "6AF4557F-ABAF-4795-915A-695383F64EEB",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "9459507A-A2C8-400D-8669-E8ADBDE61DE0",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "E9B414C5-C376-4216-A267-ABC0930905CE",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        },
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "571C9CA1-F660-4479-9E91-B3B1714A2090",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "58706C99-B77F-4AE5-BD45-EBA65DEE2485",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "9E698DFA-1684-43E3-9964-0E207A7A2CC1",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "F2F44543-2404-4CDF-9D2F-1B851660F5D5",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "1E14F40F-4AA1-42B4-998E-AC965FBBE519",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "43197E99-0500-4971-8A66-4E70F8138289",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "653B5F4D-7417-4A85-B385-46157A1540A6",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03245",
            "affected_versions_last": "12.4.3-03245"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03387",
            "affected_versions_last": "12.4.3-03387"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03434",
            "affected_versions_last": "12.4.3-03434"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02283",
            "affected_versions_last": "12.5.0-02283"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02624",
            "affected_versions_last": "12.5.0-02624"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02800",
            "affected_versions_last": "12.5.0-02800"
          },
          {
            "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210",
            "product_type": "h",
            "vulnerable": false,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": null,
            "affected_versions_last": null
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03245",
            "affected_versions_last": "12.4.3-03245"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03387",
            "affected_versions_last": "12.4.3-03387"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03434",
            "affected_versions_last": "12.4.3-03434"
          }
        ],
        "cwe": [
          {
            "id": 918,
            "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)",
            "name": "Server-Side Request Forgery (SSRF)",
            "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.",
            "capec_id": [
              664
            ],
            "scope": [
              "Access Control",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Bypass Protection Mechanism",
              "Execute Unauthorized Code or Commands",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.84535,
          "percentile": 0.99691,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "SonicWall",
          "product": "SMA1000 Appliances",
          "vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
          "date_added": "2026-07-14",
          "short_description": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.",
          "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
          "due_date": "2026-07-17",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2025-52691",
      "source_identifier": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
      "published": "2025-12-29T03:15:42Z",
      "last_modified": "2026-06-17T09:36:54Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-01-26",
      "cisa_action_due": "2026-02-16",
      "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "cisa_vulnerability_name": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution."
        }
      ],
      "references": [
        {
          "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/",
          "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
          "tags": [
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Exploit",
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-434"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*",
                  "match_criteria_id": "A9F4301A-C277-47F6-841D-386EDD24EE67",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "100.0.9413"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*",
            "vendor": "smartertools",
            "product": "smartermail",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "100.0.9413",
            "affected_versions_first": "1.0.0",
            "affected_versions_last": "100.0.9406"
          }
        ],
        "cwe": [
          {
            "id": 434,
            "owasptop10_2021": "A04 Insecure Design",
            "name": "Unrestricted Upload of File with Dangerous Type",
            "description": "The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.",
            "capec_id": [
              1
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Execute Unauthorized Code or Commands"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.85655,
          "percentile": 0.99714,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "SmarterTools",
          "product": "SmarterMail",
          "vulnerability_name": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
          "date_added": "2026-01-26",
          "short_description": "SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.",
          "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
          "due_date": "2026-02-16",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`enrichment.cisa_kev.date_added`
`filters.must[0].type`body	`gte`
`filters.must[0].value`body	`2026-01-01`
`filters.must[1].name`body	`enrichment.cisa_kev.known_ransomware_campaign_use`
`filters.must[1].type`body	`eq`
`filters.must[1].value`body	`Known`

Reference updated September 26, 2026

Request

Related Examples