API Resources

GET
/v3/search/cpe

Request vulnerabilities related to specific CPE attributes

Based on the specified CPE (Common Platform Enumeration) schema, this endpoint will allow searches on the attributes part, vendor, product, and/or version and return a list of associated vulnerabilities.

All search fields are optional. Attributes must conform to the specifications in the NIST CPE Specification.

Results are paginated: by default the endpoint returns the first 100 matching CPEs. Use page and limit to retrieve the rest, and read _meta.total_documents to see how many matches exist in total. See below.

Path Parameters

part

string

If specified, must be one of application, operating system, or hardware. If not specified, all parts will be searched.

vendor

string

Values for this attribute should describe or identify the person or organization that manufactured or created the product. Any character string meeting the requirements for Well-formed Names (WFNs) may be specified as the value of the attribute.

product

string

The name of the system/package/component. Product and vendor are sometimes identical. It can not contain spaces, slashes, or most special characters. An underscore should be used in place of whitespace characters.

version

string

The version of the system/package/component. This is typically a semantic version string, but may very by vendor. This attribute supports trailing wildcards *. e.g.
version=8 will only return CPEs with the exact version string 8.
version=8.0.6* will return any CPE starting with 8.0.6.

isVulnerable

boolean

Returns only CVEs associated with a CPE where the CPE is considered vulnerable.
By default the API will return all CVEs in which the CPE is mentioned, whether the CPE is the source of the vulnerability or not. For example, cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:* is listed in many CVEs as part of a vulnerable configuration, but only one where the the device itself is inherently vulnerable.
isVulnerable=true - Return only the CVEs where the CPE is vulnerable.

Pagination Parameters

page

integer

The 1-indexed page of results to return. Defaults to 1.page multiplied by limit must not exceed 10000 — see .

limit

integer

The number of CPEs to return per page. Defaults to 100, which is also the maximum.

sort

string

The field to sort results by. Defaults to _id, the only field on this index that is sortable.

order

string

The sort direction, either asc or desc. Defaults to asc.

Pagination

Every response carries a _meta object describing the current page:

Field	Description
`timestamp`	When the query was executed, in UTC.
`limit`	The page size applied to this request.
`total_documents`	The total number of CPEs matching the query, across all pages.
`sort`	The field results were sorted by.
`order`	The sort direction, `asc` or `desc`.
`page`	The 1-indexed page returned.
`total_pages`	`total_documents` divided by `limit`, rounded up.
`max_pages`	A hint for pagination UIs on how many page links to render. It does not limit how many pages you can request.
`first_item`	The 1-indexed position of the first CPE on this page.
`last_item`	The 1-indexed position of the last CPE on this page.

Results are sorted by _id ascending unless you pass sort and order. This default is stable, so a CPE will not shift between pages while you are walking them.

total_documents reports every match, but only the first 10,000 are reachable by paging. Requests where page multiplied by limit exceeds 10000 are rejected with a 400:

{
  "error": true,
  "errors": [
    "failed to compose query: invalid pagination parameters: pagination window exceeds cluster maximum: page * limit must not exceed 10000 (got page=200, limit=100)"
  ]
}

If a search matches more CPEs than that, narrow it with part, version, or isVulnerable rather than paging deeper.

Example Requests

Request vulnerable CVEs for a vendor, product, and version

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cpe?vendor=mediatek&product=mt6890&version=*&isVulnerable=true" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

{
  "_benchmark": 0.038296,
  "_meta": {
    "timestamp": "2026-08-24T18:51:12.343892243Z",
    "limit": 100,
    "total_documents": 1,
    "sort": "_id",
    "order": "asc",
    "page": 1,
    "total_pages": 1,
    "max_pages": 6,
    "first_item": 1,
    "last_item": 1
  },
  "data": [
    {
      "cpe": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
      "cpe_struct": {
        "part": "h",
        "vendor": "mediatek",
        "product": "mt6890",
        "version": "-",
        "update": "*",
        "edition": "*",
        "language": "*",
        "sw_edition": "*",
        "target_sw": "*",
        "target_hw": "*",
        "other": "*"
      },
      "cves": [
        "CVE-2025-20654"
      ]
    }
  ]
}

Request all CVEs for a vendor, product, and version

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cpe?vendor=mediatek&product=mt6890&version=*" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

{
  "_benchmark": 0.038201,
  "_meta": {
    "timestamp": "2026-08-24T18:52:00.252053347Z",
    "limit": 100,
    "total_documents": 1,
    "sort": "_id",
    "order": "asc",
    "page": 1,
    "total_pages": 1,
    "max_pages": 6,
    "first_item": 1,
    "last_item": 1
  },
  "data": [
    {
      "cpe": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
      "cpe_struct": {
        "part": "h",
        "vendor": "mediatek",
        "product": "mt6890",
        "version": "-",
        "update": "*",
        "edition": "*",
        "language": "*",
        "sw_edition": "*",
        "target_sw": "*",
        "target_hw": "*",
        "other": "*"
      },
      "cves": [
        "CVE-2021-40148",
        "CVE-2022-20035",
        "CVE-2022-20036",
        "CVE-2022-20037",
        "CVE-2022-20040",
        "CVE-2022-20051",
        "CVE-2022-20052",
        "CVE-2022-20053",
        "CVE-2022-20068",
        "CVE-2022-20070",
        "CVE-2022-20072",
        "CVE-2022-20074",
        "CVE-2022-20083",
        "CVE-2022-21744",
        "CVE-2022-21749",
        "CVE-2022-21755",
        "CVE-2022-21756",
        "CVE-2022-21758",
        "CVE-2022-21763",
        "CVE-2022-21764",
        "CVE-2022-21773",
        "CVE-2022-26446",
        "CVE-2023-20694",
        "CVE-2023-20695",
        "CVE-2023-20696",
        "CVE-2023-20725",
        "CVE-2023-20726",
        "CVE-2023-20775",
        "CVE-2023-20790",
        "CVE-2023-20796",
        "CVE-2023-20820",
        "CVE-2023-20821",
        "CVE-2023-20828",
        "CVE-2023-20829",
        "CVE-2023-20830",
        "CVE-2023-20831",
        "CVE-2023-20832",
        "CVE-2023-20838",
        "CVE-2023-32810",
        "CVE-2023-32812",
        "CVE-2023-32813",
        "CVE-2023-32814",
        "CVE-2023-32815",
        "CVE-2023-32831",
        "CVE-2023-32840",
        "CVE-2023-32841",
        "CVE-2023-32842",
        "CVE-2023-32843",
        "CVE-2023-32844",
        "CVE-2023-32845",
        "CVE-2023-32846",
        "CVE-2023-32855",
        "CVE-2023-32871",
        "CVE-2023-32874",
        "CVE-2023-32886",
        "CVE-2023-32887",
        "CVE-2023-32888",
        "CVE-2023-32890",
        "CVE-2023-32891",
        "CVE-2024-20003",
        "CVE-2024-20004",
        "CVE-2024-20006",
        "CVE-2024-20017",
        "CVE-2024-20022",
        "CVE-2024-20023",
        "CVE-2024-20039",
        "CVE-2024-20040",
        "CVE-2024-20049",
        "CVE-2024-20050",
        "CVE-2024-20051",
        "CVE-2024-20052",
        "CVE-2024-20053",
        "CVE-2024-20054",
        "CVE-2024-20056",
        "CVE-2024-20071",
        "CVE-2024-20072",
        "CVE-2024-20073",
        "CVE-2024-20080",
        "CVE-2024-20081",
        "CVE-2024-20082",
        "CVE-2024-20084",
        "CVE-2024-20085",
        "CVE-2024-20094",
        "CVE-2024-20104",
        "CVE-2024-20107",
        "CVE-2024-20136",
        "CVE-2024-20143",
        "CVE-2024-20144",
        "CVE-2024-20145",
        "CVE-2024-20150",
        "CVE-2025-20635",
        "CVE-2025-20644",
        "CVE-2025-20646",
        "CVE-2025-20649",
        "CVE-2025-20650",
        "CVE-2025-20651",
        "CVE-2025-20654",
        "CVE-2025-20659",
        "CVE-2025-20666",
        "CVE-2025-20667",
        "CVE-2025-20674",
        "CVE-2025-20678",
        "CVE-2025-20681",
        "CVE-2025-20682",
        "CVE-2025-20683",
        "CVE-2025-20685",
        "CVE-2025-20686",
        "CVE-2025-20688",
        "CVE-2025-20689",
        "CVE-2025-20690",
        "CVE-2025-20691",
        "CVE-2025-20692"
      ]
    }
  ]
}

Page through a large result set

google/chrome matches thousands of CPEs, so request a page at a time. _meta.total_pages tells you how many pages are available at the limit you chose.

curl --request GET \
    --url "https://api.vulncheck.com/v3/search/cpe?vendor=google&product=chrome&limit=2&page=3" \
    --header "Accept: application/json" \
    --header "Authorization: Bearer insert_token_here"

Response

{
  "_benchmark": 0.072972,
  "_meta": {
    "timestamp": "2026-08-24T18:52:53.085504367Z",
    "limit": 2,
    "total_documents": 9741,
    "sort": "_id",
    "order": "asc",
    "page": 3,
    "total_pages": 4871,
    "max_pages": 6,
    "first_item": 5,
    "last_item": 6
  },
  "data": [
    {
      "cpe": "cpe:2.3:a:google:chrome:78.0.3904.48:*:*:*:*:*:*:*",
      "cpe_struct": {
        "part": "a",
        "vendor": "google",
        "product": "chrome",
        "version": "78\\.0\\.3904\\.48",
        "update": "*",
        "edition": "*",
        "language": "*",
        "sw_edition": "*",
        "target_sw": "*",
        "target_hw": "*",
        "other": "*"
      },
      "cves": [
        "CVE-2012-2647",
        "CVE-2012-4929",
        "CVE-2012-4930",
        "CVE-2019-13699",
        "..."
      ]
    },
    {
      "cpe": "cpe:2.3:a:google:chrome:76.0.3809.91:*:*:*:*:*:*:*",
      "cpe_struct": {
        "part": "a",
        "vendor": "google",
        "product": "chrome",
        "version": "76\\.0\\.3809\\.91",
        "update": "*",
        "edition": "*",
        "language": "*",
        "sw_edition": "*",
        "target_sw": "*",
        "target_hw": "*",
        "other": "*"
      },
      "cves": [
        "CVE-2012-2647",
        "CVE-2012-4929",
        "CVE-2012-4930",
        "CVE-2019-13659",
        "..."
      ]
    }
  ]
}

/v3/openapi

/v3/identify

GET/v3/search/cpe

GET
/v3/search/cpe