Commercial · CPE → CVE

External API for cvescan.app

Ship the same matching engine that powers cvescan.app into your products, CI, and fleet agents. Map CPE identifiers or product/version inventories to NVD CVEs with CVSS, CISA KEV, and enrichment — at integration scale.

Why teams buy External API

• Scan many users in one request

  Upload up to 10 inventory or nmap files per call (Postman, curl, or your agent). One Bearer key covers fleet jobs and multi-user pipelines — no browser upload bottleneck.

• Wire CPE → CVE into your stack

  Drop matching into SIEMs, asset CMDB, ticketing, or custom dashboards. Send CPE strings or product/version pairs and get structured CVEs with CVSS, KEV, and enrichment sources.

• JSON or CSV report file

  Get per-file JSON with severity summary, or set format=csv to download cvescan-report.csv in the same request — ready for audits and spreadsheets.

• Prioritize what to fix

  Severity, CVSS, CISA KEV flags, and optional Nuclei template links help you decide what to patch first. Upcoming commercial extras: remediation hints and “how to resolve” playbooks per CVE.

• Privacy-first matching

  The External API reads the shared vulnerability catalog only. Your inventory lists are processed for matching and are not stored as customer scan archives.

• Same engine as cvescan.app

  Commercial keys hit the same matching engine that powers https://cvescan.app — consistent results between the public scanner and your integrations.

• Custom build for your stack

  Need something unique? We can design and ship a tailored integration — custom endpoints, report formats, auth models, or workflows wired into your product. Tell us the use case.

Base URL

https://api.cvescan.app/api/external

Public product: https://cvescan.app · API host: https://api.cvescan.app

Authentication

All endpoints except GET /health require a Bearer token:

Authorization: Bearer YOUR_API_KEY

API reference

The two endpoints that matter for most integrations. Samples use api.cvescan.app. Full surface (health, single-CPE GET, CVE lookup) is available after you get a key — ask support if you need those details.

{
  "cpes": [
    "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*"
  ]
}

// — or —

{
  "products": [
    { "name": "OpenSSH", "version": "8.9p1" },
    { "name": "nginx", "version": "1.24.0" }
  ]
}

{
  "count": 1,
  "cves": [
    {
      "cve_id": "CVE-2021-44228",
      "title": "Apache Log4j2 JNDI injection",
      "severity": "CRITICAL",
      "cvss": 10.0,
      "product": "log4j",
      "version": "2.14.1",
      "kev": true,
      "sources": ["nvd", "kev"],
      "matched_cpes": [
        "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*"
      ],
      "nuclei_template_url": "https://…"
    }
  ]
}

curl -sS -X POST 'https://api.cvescan.app/api/external/match' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "products": [
      { "name": "OpenSSH", "version": "8.9p1" },
      { "name": "nginx", "version": "1.24.0" }
    ]
  }'

multipart/form-data

[email protected]   (repeat up to 10; field name "files" or "file")
[email protected]
mode=local          (optional: local | network)
os=macos            (optional)
format=json         (optional: json | csv)

Postman: Body → form-data → several Files named "files" + optional Text fields.

{
  "batchSize": 2,
  "mode": "local",
  "os": "macos",
  "meta": { "stored": false },
  "summary": {
    "filesOk": 2,
    "filesFailed": 0,
    "uniqueCves": 15,
    "bySeverity": { "CRITICAL": 1, "HIGH": 4, "MEDIUM": 6, "LOW": 2, "UNKNOWN": 2 }
  },
  "results": [
    { "filename": "user-a.txt", "ok": true, "count": 8, "cves": [ /* … */ ] },
    { "filename": "user-b.txt", "ok": true, "count": 7, "cves": [ /* … */ ] }
  ]
}

// format=csv → attachment cvescan-report.csv
// columns: source_file,cve_id,severity,cvss,product,version,published,kev,title

# JSON (default)
curl -sS -X POST 'https://api.cvescan.app/api/external/scan-batch' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F '[email protected]' \
  -F '[email protected]' \
  -F 'mode=local' \
  -F 'os=macos'

# CSV report file
curl -sS -X POST 'https://api.cvescan.app/api/external/scan-batch' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F '[email protected]' \
  -F '[email protected]' \
  -F 'format=csv' \
  -o cvescan-report.csv

Errors

Custom development

Beyond the standard External API, we can build a unique solution for your team — private endpoints, custom report layouts, SSO / org keys, fleet agents, or deep embedding into your product. If the public surface is not enough, describe the workflow and we will scope a fit.

Commercial extras (roadmap)

• Scheduled reporting webhooks and signed audit exports
• Remediation / “how to resolve this CVE” guidance in the payload
• Org-level usage dashboards on cvescan.app
• Higher rate limits / org API keys for large fleets

Ready to integrate or need a custom build? Request a key · Custom development · [email protected]