{ "openapi": "3.1.1", "info": { "title": "CVE Relationship Graph API", "version": "1.0.0", "summary": "One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://cverelationshipgraph.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.", "description": "Looks up a vulnerability in OSV.dev and maps everything connected to it: alias IDs (CVE, GHSA, distro advisories), affected packages with their vulnerable version ranges and fixed versions, fix commits, references grouped into advisories, fixes, reports and exploits, whether CISA lists it as known-exploited (KEV) and its FIRST EPSS exploitation probability.\n\nMethodology:\n- The advisory is read from OSV.dev (https://api.osv.dev/v1/vulns/{id}); CVE records there often carry no package data, so up to 3 alias records (GHSA first) are fetched and merged.\n- Version ranges are rendered from OSV events (introduced / fixed / last_affected); GIT ranges become fix-commit nodes. Fixed versions are sorted numerically.\n- References are grouped by OSV type, refined with URL patterns: commits and pull requests = fix; NVD, GHSA, vendor PSIRT pages = advisory; issue trackers and mailing lists = report; Exploit-DB, Packet Storm and PoC repositories = exploit.\n- KEV membership is checked against the full CISA Known Exploited Vulnerabilities JSON feed; EPSS (probability of exploitation activity in the next 30 days) comes from api.first.org.\n- Severity is the source database rating when present, otherwise derived from the CVSS v3.x base score computed from the vector (FIRST formulas).", "tags": [ "security" ], "x-mcp-tool": "cve_relationship_graph", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CveRelationshipGraphInput" }, "examples": { "example1": { "summary": "Log4Shell from pasted OSV + KEV + EPSS (offline)", "value": { "osvJson": "{\n \"schema_version\": \"1.9.0\",\n \"id\": \"GHSA-jfh8-c2jp-5v3q\",\n \"modified\": \"2025-10-22T19:37:02.616807Z\",\n \"published\": \"2021-12-10T00:40:56Z\",\n \"aliases\": [\n \"CVE-2021-44228\"\n ],\n \"summary\": \"Remote code injection in Log4j\",\n \"details\": \"# Summary\\n\\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\\n\\u2026(trimmed)\",\n \"severity\": [\n {\n \"type\": \"CVSS_V3\",\n \"score\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H\"\n }\n ],\n \"affected\": [\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.13.0\"\n },\n {\n \"fixed\": \"2.15.0\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.0-beta9\"\n },\n {\n \"fixed\": \"2.3.1\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.4\"\n },\n {\n \"fixed\": \"2.12.2\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.ops4j.pax.logging:pax-logging-log4j2\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"1.8.0\"\n },\n {\n \"fixed\": \"1.9.2\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.ops4j.pax.logging:pax-logging-log4j2\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"1.10.0\"\n },\n {\n \"fixed\": \"1.10.8\"\n }\n ]\n }\n ]\n }\n ],\n \"references\": [\n {\n \"type\": \"ADVISORY\",\n \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-44228\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://github.com/apache/logging-log4j2/pull/608\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.debian.org/security/2021/dsa-5020\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.kb.cert.org/vuls/id/930724\"\n },\n {\n \"type\": \"ADVISORY\",\n \"url\": \"https://github.com/advisories/GHSA-7rjr-3q55-vv33\"\n },\n {\n \"type\": \"PACKAGE\",\n \"url\": \"https://github.com/apache/logging-log4j2\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://github.com/tangxiaofeng7/apache-log4j-poc\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://issues.apache.org/jira/browse/LOG4J2-3198\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://logging.apache.org/log4j/2.x/security.html\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\"\n }\n ],\n \"database_specific\": {\n \"cwe_ids\": [\n \"CWE-20\",\n \"CWE-400\",\n \"CWE-502\",\n \"CWE-917\"\n ],\n \"severity\": \"CRITICAL\",\n \"github_reviewed\": true,\n \"nvd_published_at\": \"2021-12-10T10:15:00Z\"\n }\n}", "kevJson": "{\n \"cveID\": \"CVE-2021-44228\",\n \"vendorProject\": \"Apache\",\n \"product\": \"Log4j2\",\n \"vulnerabilityName\": \"Apache Log4j2 Remote Code Execution Vulnerability\",\n \"dateAdded\": \"2021-12-10\",\n \"shortDescription\": \"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.\",\n \"requiredAction\": \"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.\",\n \"dueDate\": \"2021-12-24\",\n \"knownRansomwareCampaignUse\": \"Known\",\n \"forensicTriage\": \"No\",\n \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-44228\",\n \"cwes\": [\n \"CWE-20\",\n \"CWE-400\",\n \"CWE-502\"\n ]\n}", "epssJson": "{\"status\": \"OK\", \"status-code\": 200, \"version\": \"1.0\", \"access\": \"public\", \"total\": 1, \"offset\": 0, \"limit\": 100, \"data\": [{\"cve\": \"CVE-2021-44228\", \"epss\": \"0.999990000\", \"percentile\": \"1.000000000\", \"date\": \"2026-10-13\"}]}" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CveRelationshipGraphResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "CveRelationshipGraphInput": { "type": "object", "additionalProperties": false, "properties": { "vulnId": { "title": "CVE, GHSA or OSV id", "type": "string", "maxLength": 80 }, "osvJson": { "title": "Or paste an OSV record (JSON)", "description": "Offline mode: an OSV vulnerability JSON, e.g. from api.osv.dev/v1/vulns/.", "type": "string", "maxLength": 2000000 }, "kevJson": { "title": "Optional: CISA KEV entry or catalog (JSON)", "type": "string", "maxLength": 5000000 }, "epssJson": { "title": "Optional: EPSS response (JSON)", "description": "FIRST API response or {\"epss\": 0.97, \"percentile\": 0.99}.", "type": "string", "maxLength": 100000 }, "enrichAliases": { "title": "Fetch alias records for packages", "description": "If the record lists no packages (typical for CVE records), fetch up to 3 alias advisories.", "type": "boolean", "default": true } }, "required": [] }, "CveRelationshipGraphResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "id", "summary", "aliases", "cves", "severity", "cvssVector", "cvssScore", "published", "modified", "withdrawn", "cwes", "packages", "gitFixes", "references", "kev", "epss", "relatedCount" ], "properties": { "id": { "type": "string" }, "summary": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "cves": { "type": "array", "items": { "type": "string" } }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvssVector": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "published": { "type": [ "string", "null" ] }, "modified": { "type": [ "string", "null" ] }, "withdrawn": { "type": [ "string", "null" ] }, "cwes": { "type": "array", "items": { "type": "string" } }, "packages": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "ecosystem", "name", "purl", "ranges", "fixed", "lastAffected", "source" ], "properties": { "ecosystem": { "type": "string" }, "name": { "type": "string" }, "purl": { "type": [ "string", "null" ] }, "ranges": { "type": "array", "items": { "type": "string" } }, "fixed": { "type": "array", "items": { "type": "string" } }, "lastAffected": { "type": "array", "items": { "type": "string" } }, "source": { "type": "string" } } } }, "gitFixes": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "repo", "commit" ], "properties": { "repo": { "type": "string" }, "commit": { "type": "string" } } } }, "references": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, "kev": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "dateAdded", "dueDate", "vendorProject", "product", "vulnerabilityName", "requiredAction", "knownRansomwareCampaignUse" ], "properties": { "dateAdded": { "type": "string" }, "dueDate": { "type": [ "string", "null" ] }, "vendorProject": { "type": "string" }, "product": { "type": "string" }, "vulnerabilityName": { "type": "string" }, "requiredAction": { "type": "string" }, "knownRansomwareCampaignUse": { "type": "string" } } }, "epss": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "cve", "score", "percentile", "date" ], "properties": { "cve": { "type": "string" }, "score": { "type": "number" }, "percentile": { "type": "number" }, "date": { "type": [ "string", "null" ] } } }, "relatedCount": { "type": "integer" } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }