{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://cve.now/schemas/entry.json","title":"cve.now entry","type":"object","description":"One entry: a vulnerability, or an early warning (a breach, ransomware attack, malicious package, vulnerability reported before or without a CVE, or security outage)","properties":{"type":{"type":"string","description":"The entity type: cve for a catalog entry, early-warning for an early warning, breach for a breach or ransomware attack","enum":["cve","early-warning","breach"]},"id":{"type":"string","description":"The entry id: a CVE, GHSA or OSV id for a vulnerability, SZB- and 10 hex characters for an early warning","examples":["CVE-2021-44228","GHSA-jfh8-c2jp-5v3q","SZB-0a1b2c3d4e"]},"kind":{"type":"string","description":"What the entry is: vulnerability (every catalog entry, and an early warning about a vulnerability reported before or without a CVE), breach, ransomware, malicious-package or outage. A copy written before kind existed omits it: read that as vulnerability","enum":["breach","vulnerability","malicious-package","ransomware","outage"],"default":"vulnerability"},"confidence":{"type":"string","description":"An early warning's confidence: confirmed, corroborated or unverified. Absent on a vulnerability","enum":["confirmed","corroborated","unverified"]},"title":{"type":"string","description":"Short title"},"summary":{"type":["object","string","null"],"description":"A vulnerability's plain-language summary as { text, model, promptVersion, generatedAt? }, or null when none is written; an early warning's summary is a string","properties":{"text":{"type":"string","description":"The summary text"},"model":{"type":"string","description":"The model that wrote it"},"promptVersion":{"type":"string","description":"The prompt version it was written with"},"generatedAt":{"type":"string","description":"When it was written (ISO 8601)"}},"additionalProperties":true},"originalDescription":{"type":"string","description":"A vulnerability's description as the CVE record or advisory words it"},"feedId":{"type":"string","description":"The first id ever assigned to the entry, which its feed items use as their guid"},"aliases":{"type":"array","description":"Other ids for the same vulnerability (CVE, GHSA, OSV)","items":{"type":"string","description":"A string"}},"status":{"type":"string","description":"A vulnerability's state in the catalog","enum":["provisional","published","superseded","rejected"]},"supersededBy":{"type":"array","description":"Ids of the entries that replace this one when its status is superseded","items":{"type":"string","description":"A string"}},"critical":{"type":"object","description":"Whether the entry is critical under the critical rule, and why","properties":{"value":{"type":"boolean","description":"true when the entry is critical"},"reasons":{"type":"array","description":"Each test it passes, e.g. kev, cvss-in-technology, epss","items":{"type":"string","description":"A string"}}},"additionalProperties":true},"severity":{"type":["object","string","null"],"description":"A vulnerability's score as { cvss, vector, source } (null when unscored); an early warning's severity as critical, high, medium or low","properties":{"cvss":{"type":"number","description":"The CVSS base score, 0 to 10"},"vector":{"type":"string","description":"The CVSS vector string"},"source":{"type":"string","description":"Who scored it: cna, cisa-adp, adp, nvd, ghsa or euvd"}},"additionalProperties":true},"statedSeverity":{"type":["object","null"],"description":"The severity the advisory states in words, { value (low, medium, high or critical), source }","additionalProperties":true},"exploitation":{"type":"object","description":"Exploitation evidence: KEV listing, EPSS threshold, public exploit code","properties":{"kev":{"type":["object","null"],"description":"CISA KEV listing as { dateAdded, dueDate }; null when not listed","additionalProperties":true},"epssReached":{"type":["object","null"],"description":"When EPSS reached 10% as { date, observed? }; null when it has not","additionalProperties":true},"exploitDb":{"type":["object","null"],"description":"Exploit-DB exploits as { ids, publishedAt }","additionalProperties":true},"metasploit":{"type":["object","null"],"description":"Metasploit modules as { modules }","additionalProperties":true},"nuclei":{"type":["object","null"],"description":"Nuclei detection templates as { templates }","additionalProperties":true},"githubPoc":{"type":["object","null"],"description":"GitHub proof-of-concept repositories as { repos, exploits? }","additionalProperties":true}},"additionalProperties":true},"ssvc":{"type":["object","null"],"description":"CISA SSVC decision points: exploitation (none, poc or active), automatable (yes or no), technicalImpact (partial or total), timestamp, version; null when CISA published none","properties":{"exploitation":{"type":["string","null"],"description":"none, poc or active"},"automatable":{"type":["string","null"],"description":"yes or no"},"technicalImpact":{"type":["string","null"],"description":"partial or total"},"timestamp":{"type":["string","null"],"description":"When CISA assessed it (ISO 8601)"},"version":{"type":["string","null"],"description":"The SSVC version"},"source":{"type":"string","description":"Always CISA-ADP"}},"additionalProperties":true},"context":{"type":["object","null"],"description":"Plain-English context read from the vendor advisory: a sentence, attacker conditions, vendor severity, fix, FAQ; null or absent when not read","additionalProperties":true},"cwe":{"type":"array","description":"CWE ids, e.g. CWE-79","items":{"type":"string","description":"A string"}},"affected":{"type":"array","description":"The affected products and packages with their version ranges","items":{"type":"object","description":"One affected product or package","properties":{"ecosystem":{"type":"string","description":"The package ecosystem in OSV's spelling, e.g. npm, PyPI, Go, Maven, crates.io"},"package":{"type":"string","description":"The package name"},"vendor":{"type":"string","description":"The vendor the record names"},"product":{"type":"string","description":"The product the record names"},"ranges":{"type":"array","description":"Affected version ranges","items":{"type":"object","description":"One affected range of versions","properties":{"introduced":{"type":"string","description":"The first affected version"},"fixed":{"type":"string","description":"The first version that is not affected"},"lastAffected":{"type":"string","description":"The last affected version"},"limit":{"type":"string","description":"An exclusive upper bound"}},"additionalProperties":true}},"versions":{"type":"array","description":"Affected versions the source lists one by one","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"related":{"type":"array","description":"Ids of related entries","items":{"type":"string","description":"A string"}},"bundles":{"type":"array","description":"Ids of the bundles the entry belongs to","items":{"type":"string","description":"A string"}},"copy":{"type":["object","null"],"description":"The wording cve.now wrote for the entry; null when a write gave nothing usable","additionalProperties":true},"earlyWarning":{"type":"array","description":"Early warnings cve.now published about this vulnerability","items":{"type":"object","description":"An early warning about this vulnerability","properties":{"id":{"type":"string","description":"The early warning's SZB id"},"firstSeenAt":{"type":"string","description":"When cve.now first saw it (ISO 8601)"}},"additionalProperties":true}},"references":{"type":"array","description":"Links to advisories, fixes, reports and exploits","items":{"type":"object","description":"One reference","properties":{"url":{"type":"string","description":"The reference URL"},"type":{"type":"string","description":"advisory, fix, report, exploit or other"},"role":{"type":"string","description":"What the source establishes, when cve.now has classified it"}},"additionalProperties":true}},"sources":{"type":"array","description":"Where the entry's data comes from","items":{"type":"object","description":"One source cve.now read the entry from","properties":{"name":{"type":"string","description":"The source's name"},"url":{"type":"string","description":"Its URL"},"firstSeenAt":{"type":"string","description":"When cve.now first read it (ISO 8601)"},"license":{"type":"string","description":"The source's license"}},"additionalProperties":true}},"firstSeenAt":{"type":"string","description":"When cve.now first saw the entry (ISO 8601)"},"publishedAt":{"type":["string","null"],"description":"When the vulnerability was published (ISO 8601); null when unknown"},"modifiedAt":{"type":"string","description":"When the entry last changed (ISO 8601)"},"checkedAt":{"type":"string","description":"When cve.now last re-read the entry (ISO 8601)"},"attention":{"type":"object","description":"Whether the entry needs attention now, and why","properties":{"status":{"type":"string","description":"attention or reference","enum":["attention","reference"]},"label":{"type":"string","description":"Needs attention or Reference"},"reason":{"type":"string","description":"Why it needs attention, or why it is a reference record"},"until":{"type":["string","null"],"description":"When it goes back to Reference if nothing new happens; null for a reference record"},"lastChecked":{"type":["string","null"],"description":"The last time cve.now re-read the entry (ISO 8601)"},"rules":{"type":"integer","description":"The version of the attention rules"}},"additionalProperties":true},"vendors":{"type":"array","description":"The vendors the affected products name","items":{"type":"object","description":"A vendor","properties":{"slug":{"type":"string","description":"The vendor's slug; its page is /vendors/<slug> when it has one (25 or more entries, or 3 or more on CISA's Known Exploited Vulnerabilities list)"},"name":{"type":"string","description":"The vendor's name"}},"additionalProperties":true}},"products":{"type":"array","description":"The affected products","items":{"type":"object","description":"A product","properties":{"slug":{"type":"string","description":"The product's slug"},"vendor":{"type":"string","description":"The vendor's slug (empty when the record names none)"},"name":{"type":"string","description":"The product's name"}},"additionalProperties":true}},"packages":{"type":"array","description":"The registry packages the entry affects","items":{"type":"object","description":"A registry package","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem"},"name":{"type":"string","description":"The package's name"}},"additionalProperties":true}},"tech":{"type":"array","description":"The curated technologies the entry belongs to","items":{"type":"object","description":"A curated technology","properties":{"slug":{"type":"string","description":"The technology's slug, as in /feed?tech=<slug>"},"rule":{"type":"string","description":"What the affected product matched on: package, product, vendor-product or vendor"}},"additionalProperties":true}},"exposure":{"type":["string","null"],"description":"How exposed default setups are: Actively exploited, Default setups, Specific setups only or Unclear; null when cve.now has not read the vendor advisory","enum":["Actively exploited","Default setups","Specific setups only","Unclear",null]},"fixedIn":{"type":"array","description":"The fixed versions cve.now leads with: the vendor's own, without distro package builds","items":{"type":"string","description":"A string"}},"fixedInByProduct":{"type":"array","description":"Fixed versions per affected product, the entry's own product first","items":{"type":"object","description":"Fixed versions of one product","properties":{"product":{"type":"string","description":"The product"},"versions":{"type":"array","description":"Its fixed versions","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"agentPrompt":{"type":["string","null"],"description":"A prompt an agent can follow to check and fix its own systems for this vulnerability; null when there is nothing to act on"},"fixStatus":{"type":"object","description":"Whether a fix is released for each registry package; absent without registry data","properties":{"packages":{"type":"array","description":"One per registry package, the advisory's own first","items":{"type":"object","description":"Whether a fix is released for one registry package","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem"},"package":{"type":"string","description":"The package name"},"status":{"type":"string","description":"fixed: a fixed version or a newer unaffected release exists; none: no fix is released","enum":["fixed","none"]},"source":{"type":["string","null"],"description":"Where fixed came from: the advisory's ranges, or the first release after them","enum":["ranges","release",null]},"fixed":{"type":"array","description":"Fixed versions, lowest first; empty when status is none","items":{"type":"object","description":"One release that fixes the advisory","properties":{"version":{"type":"string","description":"The fixed version"},"publishedAt":{"type":["string","null"],"description":"When the registry published it (ISO 8601); null when it lists no date"},"daysFromDisclosure":{"type":["integer","null"],"description":"Whole days from disclosure to this release; negative when the fix shipped first"},"named":{"type":"string","description":"The fixed version the advisory names, when that release was never published and this is the first stable one after it"}},"additionalProperties":true}},"unreleased":{"type":"array","description":"Fixed versions the advisory names that the registry has not published","items":{"type":"string","description":"A string"}},"latest":{"type":["object","null"],"description":"The latest release and whether it is inside an affected range; null when the registry marks none","properties":{"version":{"type":"string","description":"The latest release"},"publishedAt":{"type":["string","null"],"description":"When it was published (ISO 8601)"},"affected":{"type":"boolean","description":"true when it is inside an affected range"}},"additionalProperties":true},"asOf":{"type":"string","description":"When the registry data was read (ISO 8601)"}},"additionalProperties":true}},"noFix":{"type":"boolean","description":"true when some package has no fix released"}},"additionalProperties":true},"downloadExposure":{"type":"array","description":"Per npm or crates.io package: the share of downloads that were affected versions; absent without download data","items":{"type":"object","description":"The share of one package's downloads that were affected versions","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem (npm or crates.io)"},"package":{"type":"string","description":"The package name"},"window":{"type":"string","description":"The download window: last-week on npm, 90d on crates.io"},"affectedShare":{"type":"number","description":"Affected downloads divided by total downloads, 0 to 1"},"affectedDownloads":{"type":"number","description":"Downloads of affected versions in the window"},"totalDownloads":{"type":"number","description":"All downloads in the window"},"asOf":{"type":"string","description":"When the counts were read (ISO 8601)"}},"additionalProperties":true}},"vendor":{"type":"string","description":"An early warning's vendor or organization"},"product":{"type":["object","string","null"],"description":"A vulnerability's product record (names for its product), or an early warning's product name; null when none","additionalProperties":true},"actions":{"type":"array","description":"An early warning's recommended actions","items":{"type":"string","description":"A string"}},"cveIds":{"type":"array","description":"CVE ids an early warning concerns","items":{"type":"string","description":"A string"}},"coveredBy":{"type":["object","null"],"description":"An early warning's first published CVE: { id, publishedAt, leadTimeHours }, leadTimeHours being whole hours from cve.now's first sighting to the CVE's publication (null when the CVE came first); null when none yet","additionalProperties":true},"reports":{"type":"array","description":"The reports behind an early warning","items":{"type":"object","description":"One report behind an early warning","properties":{"url":{"type":"string","description":"The report's URL"},"source":{"type":"string","description":"The publisher"},"tier":{"type":"string","description":"How much the source is trusted"},"title":{"type":"string","description":"The report's title"},"publishedAt":{"type":"string","description":"When it was published (ISO 8601)"}},"additionalProperties":true}},"confirmedAt":{"type":["string","null"],"description":"When an early warning was confirmed (ISO 8601); null until then"},"updatedAt":{"type":"string","description":"When an early warning last changed (ISO 8601)"},"url":{"type":"string","description":"The entry's page on cve.now"}},"required":["id"],"additionalProperties":true}