What this endpoint does

Retrieves detailed intelligence for a specific vulnerability identified by its CVE ID (e.g., CVE-2021-44228). It is the core vulnerability enrichment endpoint — use it when you have a CVE and need to understand its severity, exploitation status, and threat context. For efficient triage, request entity,risk,aiInsights,links,intelCard,cvss,commonNames,lifecycleStage (~35KB); add linkedMalware when malware family context is needed. Avoid the cpe field for LLM consumption as it can exceed 60KB for widely-affected vulnerabilities. Use the Vulnerability: Search endpoint to find CVE IDs, or use the Vulnerability: Lookup Extension endpoint for EPSS exploit probability scoring. Consult the Enrichment: Field Attributes reference for the complete list of available fields.

Response data

Returns a comprehensive intelligence profile for one CVE — everything you need to decide whether to patch now, schedule for later, or deprioritize. The risk assessment tells you not just the score but why it's that score, with evidence chains linking the CVE to specific threat actors, malware families, ransomware campaigns, and exploit kits observed in the wild. AI-generated triage narratives summarize the key findings in analyst-ready language. Validated threat linkages connect the CVE to MITRE ATT&CK techniques and known threat actors from Insikt Group research. The lifecycle stage field tells you where the CVE sits in the exploitation timeline (e.g., "Exploited" means active exploitation confirmed). Response size varies dramatically based on requested fields — a triage-focused request returns ~35KB while requesting all fields on a high-profile CVE can exceed 100KB.