Vulnerability Search Examples · Example 5 of 6 in Combinations

SQL Injection or OS Command Injection Since September 2026

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs published since 1 September 2026 that map to CWE-89 or CWE-78.

Field: published enrichment.cwe.id
Operator: gte eq
Logic: must should

Two should filters: at least one of them has to match. The must filter applies to every result.

In the response, look at results[].enrichment.cwe[].id and results[].published.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "published",
        "type": "gte",
        "value": "2026-09-01T00:00:00Z"
      }
    ],
    "should": [
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 89
      },
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 78
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "published",
                "type": "gte",
                "value": "2026-09-01T00:00:00Z"
            }
        ],
        "should": [
            {
                "name": "enrichment.cwe.id",
                "type": "eq",
                "value": 89
            },
            {
                "name": "enrichment.cwe.id",
                "type": "eq",
                "value": 78
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "published",
          type: "gte",
          value: "2026-09-01T00:00:00Z"
        }
      ],
      should: [
        {
          name: "enrichment.cwe.id",
          type: "eq",
          value: 89
        },
        {
          name: "enrichment.cwe.id",
          type: "eq",
          value: 78
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "published",
        "type": "gte",
        "value": "2026-09-01T00:00:00Z"
      }
    ],
    "should": [
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 89
      },
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 78
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "published",
                    "type": "gte",
                    "value": "2026-09-01T00:00:00Z"
                  }
                ],
                "should": [
                  {
                    "name": "enrichment.cwe.id",
                    "type": "eq",
                    "value": 89
                  },
                  {
                    "name": "enrichment.cwe.id",
                    "type": "eq",
                    "value": 78
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "published",
            "type": "gte",
            "value": "2026-09-01T00:00:00Z"
          }
        ],
        "should": [
          {
            "name": "enrichment.cwe.id",
            "type": "eq",
            "value": 89
          },
          {
            "name": "enrichment.cwe.id",
            "type": "eq",
            "value": 78
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "published",
        "type": "gte",
        "value": "2026-09-01T00:00:00Z"
      }
    ],
    "should": [
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 89
      },
      {
        "name": "enrichment.cwe.id",
        "type": "eq",
        "value": 78
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "published",
          "type": "gte",
          "value": "2026-09-01T00:00:00Z"
        }
      ],
      "should": [
        {
          "name": "enrichment.cwe.id",
          "type": "eq",
          "value": 89
        },
        {
          "name": "enrichment.cwe.id",
          "type": "eq",
          "value": 78
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 649,
  "results": [
    {
      "id": "CVE-2026-86152",
      "source_identifier": "user@vuldb.com",
      "published": "2026-09-06T02:17:19Z",
      "last_modified": "2026-09-10T19:17:36Z",
      "status": "Deferred",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely."
        }
      ],
      "references": [
        {
          "url": "https://vuldb.com/cve/CVE-2026-86152",
          "source": "user@vuldb.com",
          "tags": null
        },
        {
          "url": "https://vuldb.com/submit/895353",
          "source": "user@vuldb.com",
          "tags": null
        },
        {
          "url": "https://vuldb.com/vuln/399275",
          "source": "user@vuldb.com",
          "tags": null
        },
        {
          "url": "https://vuldb.com/vuln/399275/cti",
          "source": "user@vuldb.com",
          "tags": null
        },
        {
          "url": "https://www.tenda.com.cn/",
          "source": "user@vuldb.com",
          "tags": null
        }
      ],
      "metrics": {
        "cvss_metric_v40": [
          {
            "source": "user@vuldb.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "4.0",
              "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "attack_requirements": "NONE",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "vulnerable_system_confidentiality": null,
              "vulnerable_system_integrity": null,
              "vulnerable_system_availability": null,
              "subsequent_system_confidentiality": null,
              "subsequent_system_integrity": null,
              "subsequent_system_availability": null,
              "exploit_maturity": "NOT_DEFINED",
              "confidentiality_requirements": null,
              "integrity_requirements": null,
              "availability_requirements": null,
              "modified_attack_vector": "NOT_DEFINED",
              "modified_attack_complexity": "NOT_DEFINED",
              "modified_attack_requirements": "NOT_DEFINED",
              "modified_privileges_required": "NOT_DEFINED",
              "modified_user_interaction": "NOT_DEFINED",
              "modified_vulnerable_system_confidentiality": null,
              "modified_vulnerable_system_integrity": null,
              "modified_vulnerable_system_availability": null,
              "modified_subsequent_system_confidentiality": null,
              "modified_subsequent_system_integrity": null,
              "modified_subsequent_system_availability": null,
              "safety": null,
              "automatable": null,
              "recovery": null,
              "value_density": "NOT_DEFINED",
              "vulnerability_response_effort": "NOT_DEFINED",
              "provider_urgency": "NOT_DEFINED",
              "base_score": 10.0,
              "base_severity": "CRITICAL"
            }
          }
        ],
        "cvss_metric_v31": [
          {
            "source": "user@vuldb.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": [
          {
            "source": "user@vuldb.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "2.0",
              "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
              "access_vector": "NETWORK",
              "access_complexity": "LOW",
              "authentication": "NONE",
              "confidentiality_impact": "COMPLETE",
              "integrity_impact": "COMPLETE",
              "availability_impact": "COMPLETE",
              "base_score": 10.0,
              "exploitability": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "collateral_damage_potential": null,
              "target_distribution": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "environmental_score": null
            },
            "base_severity": "HIGH",
            "exploitability_score": 10.0,
            "impact_score": 10.0,
            "ac_insuf_info": false,
            "obtain_all_privilege": false,
            "obtain_user_privilege": false,
            "obtain_other_privilege": false,
            "user_interaction_required": false
          }
        ]
      },
      "weaknesses": [
        {
          "source": "user@vuldb.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-77"
            },
            {
              "lang": "en",
              "value": "CWE-78"
            }
          ]
        }
      ],
      "configurations": null,
      "vendor_comments": null,
      "enrichment": {
        "cpe": null,
        "cwe": [
          {
            "id": 77,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
            "description": "The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.",
            "capec_id": [
              15,
              40,
              43,
              75,
              76,
              136,
              183,
              248
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Execute Unauthorized Code or Commands"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          },
          {
            "id": 78,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
            "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.",
            "capec_id": [
              6,
              15,
              43,
              88,
              108
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity",
              "Non-Repudiation"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Execute Unauthorized Code or Commands",
              "Hide Activities",
              "Modify Application Data",
              "Modify Files or Directories",
              "Read Application Data",
              "Read Files or Directories"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Dynamic Analysis",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Static Analysis",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.01859,
          "percentile": 0.77971,
          "date": "2026-09-21"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "4.0",
            "3.1",
            "2.0"
          ],
          "source": "user@vuldb.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "4.0",
            "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": "NONE",
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": null,
            "vulnerable_system_integrity": null,
            "vulnerable_system_availability": null,
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": "NOT_DEFINED",
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": "NOT_DEFINED",
            "modified_attack_complexity": "NOT_DEFINED",
            "modified_attack_requirements": "NOT_DEFINED",
            "modified_privileges_required": "NOT_DEFINED",
            "modified_user_interaction": "NOT_DEFINED",
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": "NOT_DEFINED",
            "vulnerability_response_effort": "NOT_DEFINED",
            "provider_urgency": "NOT_DEFINED",
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-82004",
      "source_identifier": "user@adobe.com",
      "published": "2026-09-08T19:19:59Z",
      "last_modified": "2026-09-11T21:17:23Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."
        }
      ],
      "references": [
        {
          "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html",
          "source": "user@adobe.com",
          "tags": [
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@adobe.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@adobe.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-78"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
                  "match_criteria_id": "C9E59FAC-3BEF-4286-A299-6AB05272ED74",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "7.4.4"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
                  "match_criteria_id": "560799AF-A848-47B5-B37C-7B35C8D1B48B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
                  "match_criteria_id": "FA9301A1-69C2-470A-9520-E865A32B38BF",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
            "vendor": "adobe",
            "product": "campaign",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "7.4.4",
            "affected_versions_first": "7.2.1",
            "affected_versions_last": "7.4.3"
          },
          {
            "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
            "vendor": "adobe",
            "product": "campaign",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.4.4",
            "affected_versions_last": "7.4.4"
          },
          {
            "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
            "vendor": "adobe",
            "product": "campaign",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.4.4",
            "affected_versions_last": "7.4.4"
          }
        ],
        "cwe": [
          {
            "id": 78,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
            "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.",
            "capec_id": [
              6,
              15,
              43,
              88,
              108
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity",
              "Non-Repudiation"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Execute Unauthorized Code or Commands",
              "Hide Activities",
              "Modify Application Data",
              "Modify Files or Directories",
              "Read Application Data",
              "Read Files or Directories"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Dynamic Analysis",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Static Analysis",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.01437,
          "percentile": 0.71983,
          "date": "2026-09-22"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@adobe.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-77521",
      "source_identifier": "user@github.com",
      "published": "2026-09-21T21:17:10Z",
      "last_modified": "2026-09-22T14:17:15Z",
      "status": "Deferred",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts."
        }
      ],
      "references": [
        {
          "url": "https://github.com/1Panel-dev/MaxKB/commit/594f50f2ea80a502d1c955371ba0438b277c30ea",
          "source": "user@github.com",
          "tags": null
        },
        {
          "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.5-lts",
          "source": "user@github.com",
          "tags": null
        },
        {
          "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx",
          "source": "user@github.com",
          "tags": null
        },
        {
          "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": null
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@github.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@github.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-78"
            },
            {
              "lang": "en",
              "value": "CWE-250"
            },
            {
              "lang": "en",
              "value": "CWE-749"
            }
          ]
        }
      ],
      "configurations": null,
      "vendor_comments": null,
      "enrichment": {
        "cpe": null,
        "cwe": [
          {
            "id": 250,
            "owasptop10_2021": null,
            "name": "Execution with Unnecessary Privileges",
            "description": "The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.",
            "capec_id": [
              69,
              104,
              470
            ],
            "scope": [
              "Access Control",
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Execute Unauthorized Code or Commands",
              "Gain Privileges or Assume Identity",
              "Read Application Data"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Black Box",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Analysis",
              "Manual Static Analysis - Binary or Bytecode",
              "Manual Static Analysis - Source Code"
            ]
          },
          {
            "id": 749,
            "owasptop10_2021": null,
            "name": "Exposed Dangerous Method or Function",
            "description": "The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.",
            "capec_id": [
              500
            ],
            "scope": [
              "Access Control",
              "Availability",
              "Confidentiality",
              "Integrity",
              "Other"
            ],
            "impact": [
              "Execute Unauthorized Code or Commands",
              "Gain Privileges or Assume Identity",
              "Modify Application Data",
              "Other",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          },
          {
            "id": 78,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
            "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.",
            "capec_id": [
              6,
              15,
              43,
              88,
              108
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity",
              "Non-Repudiation"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Execute Unauthorized Code or Commands",
              "Hide Activities",
              "Modify Application Data",
              "Modify Files or Directories",
              "Read Application Data",
              "Read Files or Directories"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Dynamic Analysis",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Static Analysis",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.01049,
          "percentile": 0.62809,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@github.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`published`
`filters.must[0].type`body	`gte`
`filters.must[0].value`body	`2026-09-01T00:00:00Z`
`filters.should[0].name`body	`enrichment.cwe.id`
`filters.should[0].type`body	`eq`
`filters.should[0].value`body	`89`
`filters.should[1].name`body	`enrichment.cwe.id`
`filters.should[1].type`body	`eq`
`filters.should[1].value`body	`78`

Reference updated September 26, 2026

Request

Related Examples