Search syntax

One query language, three doors: the search box on the homepage, the term parameter on GET /api/v1/vulnerabilities/search, and the TAXII /search/ the STIX explorer calls. Same parser, same rules, same errors. This page is the complete reference - every qualifier, how they combine, and the queries worth stealing.

On this page: How it resolves · Boolean structure · Free text · Qualifier reference · Worked queries · Errors · Input handling

Structured first, text last. A term carrying a qualifier is answered from an indexed column - product:log4j resolves the product to its component ids and probes the affected table, it never reads a description. Free text is the fallback for the part of the query that named no qualifier, which is why a precise query is also the fast one.

Four consequences worth knowing before you write anything complicated:

• Ordinary results are CVEs and malicious packages. Advisory restatements stay hidden so product and version searches do not repeat the same vulnerability as sparse vendor rows. Enter an advisory id such as RHSA-2026:56097 and it resolves to the CVE or CVEs it covers. Use type:osv_advisory only when you want advisory records themselves.
• A qualifier is a closed set. A name outside it is a 400 that names the problem and suggests the nearest match. It is never accepted and quietly dropped.
• Sibling software qualifiers must describe the same row. product:openssl version:<3.0 means one affected entry that is both, not an OpenSSL CVE that happens to also mention a version somewhere.
• A bare version: is refused. Nobody searches "anything below 2.15" across a million records and means it; scope it with a product, vendor, purl or ecosystem.

Precedence, loosest to tightest: OR < AND < NOT < a single term. So a OR b c reads as a OR (b AND c). When in doubt, use parentheses - they cost nothing.

Repeating a qualifier inside one AND group ORs its values, which is usually what you meant: ecosystem:npm ecosystem:pypi is "either ecosystem", not "both at once", because no package is both.

Anything with no qualifier goes to a term index built over descriptions, summaries, alias ids, vendor and product names, package names, reference text and sources, repository names and actor names. Matching is exact on the token - there is no stemming, so logging and logged are different terms.

Very common words are not in the index. Any free-text term appearing in more than 20,000 records is pruned, among them remote, execution, overflow, sql and xss. Vendor, product and package names are exempt and always indexed, so linux still matches everything it names however common it is. The pruned words were never useful as filters - a word that matches a third of the corpus does not narrow anything - and every one of them has a better structured form:

The common phrases are recognised and expanded for you, quoted or not - "use after free", "remote code execution", "privilege escalation", "denial of service", "authentication bypass", "information disclosure", "type confusion", "race condition", "server side request forgery", "hardcoded credentials" and a dozen more. The response says which expansion ran, so the answer is never a guess you cannot see.

Class names typed bare resolve on their own. Anything the cwe: qualifier accepts also works as a plain word when the word itself is not indexed, so heap, uaf, cmdi, dos, idor, lfi, oob and priv-esc all answer as their weakness class rather than as nothing.

Type the prose form anyway and the engine answers with the expansion it ran, or a 400 naming the word and the qualifier to use instead. Words that are specific enough to be useful stay in the index and work normally: log4shell, rce, traversal, deserialization, tplink.

Numeric fragments also match ids. A token containing a run of three or more digits searches ids as well as text, so 44228 finds CVE-2021-44228. Full ids are exact-matched on a fast path.

Identity - what the software is

Matched exactly against indexed identity columns, case-insensitively. Siblings inside one AND group must describe the same affected row.

Scores and counts

Bare value means "at least". > >= < <= and lo..hi ranges all work.

Exploitation state

Trending and EPSS movement

epss: is a level. These are the change, which is the question that answers "what happened this week".

Observed probing

Sensor telemetry: hosts were probed for this CVE. It is exposure to attempts, not confirmed compromise, and the vocabulary keeps that straight. 1,074 CVEs across 164 countries.

Evidence and repositories

What is attached to the record, and what it actually is. 36,821 CVEs carry evidence; 11,053 carry a linked repository.

Advisories, fixes and record shape

Weakness and impact

Time

Attribution and ATT&CK Pro

These read who is using the vulnerability, so they are the tier boundary: below Pro they return 403 naming the qualifier. The gate is on the compiled query, not on the text, so an ordinary search that merely mentions an actor's name is unaffected. Everything else on this page is open to any authenticated caller.

Existence shorthands

has:exploit · has:poc · has:kev · has:ransomware · has:weaponized · has:malicious · has:refs · has:repo · has:fix.

Aliases

Each of these runs as written. The ones marked Pro need the attribution tier.

Triage - what to do on Monday

Early warning - before it is on a list

Estate - scoped to what you run

Threat-led Pro

Composite - the queries worth saving

Silence is the worst answer a search engine can give, so the parser prefers an error over an empty page.

What you will not get is 200 with an empty list because something you typed was quietly discarded. Every accepted qualifier runs.

Every query is normalised before it is parsed, so copy-paste behaves:

• Fullwidth and other compatibility forms fold to their ordinary spelling, so ｋｅｖ：ｔｒｕｅ is kev:true.
• Zero-width characters, bidi overrides and byte-order marks are removed - a zero-width space inside a qualifier name would otherwise turn it into a word that matches nothing.
• An en or em dash inside a word becomes a hyphen, so an id pasted out of a document that typeset it - CVE-2026–59310 - still resolves to the CVE. A dash with space around it is left alone, because - on its own is the negation prefix.
• Newlines, tabs and every Unicode space collapse to a single separator, so a query pasted from a wrapped terminal line or a multi-line list still parses as separate terms.
• Invalid UTF-8 is dropped rather than passed through.
• Terms are bounded at 500 characters, individual values at 256.

Values never reach SQL as text - every one is a bound parameter - so quotes, semicolons and comment markers in a search term are just characters to match on.