--- updatedAt: 2026-05-07T18:14:18.000Z agentTools: projectIndex: https://docs.greynoise.io/llms.txt --- # Bulk CVE Lookup Retrieve information about multiple CVEs in a single request. Supports up to 10,000 CVEs per request. This endpoint requires an Enterprise trial or paid plan with the appropriate entitlement. Response type depends on user entitlements (minimal, basic, or advanced). # OpenAPI definition ```json { "openapi": "3.0.0", "info": { "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.", "version": "3.0.0", "title": "GreyNoise API", "contact": { "email": "hello@greynoise.io" }, "license": { "name": "Proprietary", "url": "https://www.greynoise.io/terms" } }, "tags": [ { "name": "CVE", "description": "Endpoints that are used for retrieving information about Common Vulnerabilities and Exposures (CVEs).\n" } ], "security": [ { "APIKeyHeaderAuth": [] } ], "paths": { "/v3/cves": { "post": { "operationId": "bulkCVELookup", "tags": [ "CVE" ], "summary": "Bulk CVE Lookup", "description": "Retrieve information about multiple CVEs in a single request. Supports up to 10,000 CVEs per request.\n\nThis endpoint requires an Enterprise trial or paid plan with the appropriate entitlement.\nResponse type depends on user entitlements (minimal, basic, or advanced).\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "cves" ], "properties": { "cves": { "type": "array", "items": { "type": "string", "pattern": "^CVE-\\d{4}-\\d+$" }, "description": "Array of CVE IDs to lookup", "example": [ "CVE-2024-12345", "CVE-2023-45678" ], "maxItems": 10000 } } } } } }, "responses": { "200": { "description": "OK - request successful.", "content": { "application/json": { "schema": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/CVEAdvancedResponse" }, { "$ref": "#/components/schemas/CVEBasicResponse" }, { "$ref": "#/components/schemas/CVEMinimalResponse" } ] } } } } }, "400": { "description": "Bad request - invalid CVE format or too many CVEs requested.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": "Maximum number of CVEs per request is 10000" } } } }, "403": { "description": "Forbidden - bulk CVE search requires an Enterprise trial or paid plan.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": "Bulk CVE search requires an Enterprise trial or paid plan. Start a trial or upgrade your plan to continue." } } } }, "429": { "description": "Too many requests. You've hit the rate-limit.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "$ref": "#/components/responses/UnexpectedError" } } } } }, "servers": [ { "url": "https://api.greynoise.io" }, { "url": "http://api.greynoise.io" } ], "components": { "securitySchemes": { "APIKeyHeaderAuth": { "type": "apiKey", "in": "header", "name": "key" } }, "responses": { "UnexpectedError": { "description": "Unexpected error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorMessage" }, "example": { "message": "Encountered error while performing request" } } } } }, "schemas": { "Error": { "type": "object", "properties": { "error": { "type": "string" } }, "required": [ "error" ] }, "ErrorMessage": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ] }, "CVEAdvancedResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "The CVE identifier.", "example": "CVE-2024-12345" }, "details": { "$ref": "#/components/schemas/CVEDetails" }, "timeline": { "$ref": "#/components/schemas/CVETimeline" }, "exploitation_details": { "$ref": "#/components/schemas/CVEExploitationDetails" }, "exploitation_stats": { "$ref": "#/components/schemas/CVEExploitationStats" }, "exploitation_activity": { "$ref": "#/components/schemas/CVEExploitationActivity" } } }, "CVEBasicResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "The CVE identifier.", "example": "CVE-2024-12345" }, "details": { "$ref": "#/components/schemas/CVEDetails" }, "timeline": { "$ref": "#/components/schemas/CVETimeline" }, "exploitation_details": { "$ref": "#/components/schemas/CVEExploitationDetails" } } }, "CVEMinimalResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "The CVE identifier.", "example": "CVE-2024-12345" }, "details": { "$ref": "#/components/schemas/CVEDetails" } } }, "CVEDetails": { "type": "object", "properties": { "vulnerability_name": { "type": "string", "description": "The name of the vulnerability.", "example": "Sample Vulnerability" }, "vulnerability_description": { "type": "string", "description": "Description of the vulnerability.", "example": "This vulnerability allows remote attackers to execute arbitrary code." }, "cve_cvss_score": { "type": "number", "description": "The CVSS score of the CVE.", "example": 7.5 }, "product": { "type": "string", "description": "The product affected by the vulnerability.", "example": "Sample Product" }, "vendor": { "type": "string", "description": "The vendor of the affected product.", "example": "Sample Vendor" }, "published_to_nist_nvd": { "type": "boolean", "description": "Whether the CVE is published to the NIST National Vulnerability Database.", "example": true } } }, "CVETimeline": { "type": "object", "properties": { "cve_published_date": { "type": "string", "format": "date", "description": "The date the CVE was published.", "example": "2024-01-01" }, "cve_last_updated_date": { "type": "string", "format": "date", "description": "The date the CVE was last updated.", "example": "2024-01-02" }, "first_known_published_date": { "type": "string", "format": "date", "description": "The first known published date of the CVE.", "example": "2024-01-01" }, "cisa_kev_date_added": { "type": "string", "format": "date", "description": "The date the CVE was added to the CISA KEV list.", "example": "2024-01-03" } } }, "CVEExploitationDetails": { "type": "object", "properties": { "attack_vector": { "type": "string", "description": "The attack vector for the CVE.", "example": "Network" }, "exploit_found": { "type": "boolean", "description": "Whether an exploit has been found for this CVE.", "example": true }, "exploitation_registered_in_kev": { "type": "boolean", "description": "Whether the exploitation is registered in KEV.", "example": true }, "epss_score": { "type": "number", "description": "The EPSS score for the CVE.", "example": 0.8 } } }, "CVEExploitationStats": { "type": "object", "properties": { "number_of_available_exploits": { "type": "integer", "description": "The number of available exploits for the CVE.", "example": 5 }, "number_of_threat_actors_exploiting_vulnerability": { "type": "integer", "description": "The number of threat actors exploiting the vulnerability.", "example": 3 }, "number_of_botnets_exploiting_vulnerability": { "type": "integer", "description": "The number of botnets exploiting the vulnerability.", "example": 2 } } }, "CVEExploitationActivity": { "type": "object", "properties": { "activity_seen": { "type": "boolean", "description": "Whether exploitation activity has been observed.", "example": true }, "benign_ip_count_1d": { "type": "integer", "description": "The count of benign IPs seen exploiting the CVE in the last 24 hours (rolling).", "example": 100 }, "benign_ip_count_10d": { "type": "integer", "description": "The count of benign IPs seen exploiting the CVE since 00:00 UTC 10 days ago.", "example": 500 }, "benign_ip_count_30d": { "type": "integer", "description": "The count of benign IPs seen exploiting the CVE since 00:00 UTC 30 days ago.", "example": 1000 }, "threat_ip_count_1d": { "type": "integer", "description": "The count of IPs with any classification other than benign seen exploiting the CVE in the last 24 hours (rolling).", "example": 10 }, "threat_ip_count_10d": { "type": "integer", "description": "The count of IPs with any classification other than benign seen exploiting the CVE since 00:00 UTC 10 days ago.", "example": 50 }, "threat_ip_count_30d": { "type": "integer", "description": "The count of IPs with any classification other than benign seen exploiting the CVE since 00:00 UTC 30 days ago.", "example": 100 } } } } } } ```