P0 CVE Vulnerability Lookup

{
  "type": "json",
  "example": {
    "id": "CVE-2021-44228",
    "cwe": [
      "CWE-20"
    ],
    "kev": {
      "name": "Apache Log4j2 Remote Code Execution Vulnerability",
      "listed": true,
      "vendor": "Apache",
      "product": "Log4j2",
      "due_date": "2021-12-24",
      "date_added": "2021-12-10",
      "required_action": "Apply updates per vendor instructions.",
      "known_ransomware_use": "Known"
    },
    "cvss": {
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "primary": true,
      "version": "3.1",
      "provider": "NVD",
      "severity": "CRITICAL",
      "base_score": 10
    },
    "epss": {
      "date": "2026-10-25",
      "score": 0.99999,
      "change_7d": 0,
      "percentile": 1,
      "series_30d": [
        {
          "date": "2026-10-24",
          "score": 0.99999,
          "percentile": 1
        }
      ],
      "change_7d_from": "2026-10-18"
    },
    "note": "Facts as returned by the sources, read at as_of; not remediation advice and not a risk score for your systems. cvss is the headline score: CVSS v3.x before v4.0 before v2, within a version NVD primary, then the CNA, then other NVD sources, then CISA ADP; every score the sources gave is in cvss_scores with its provider. NVD is optional: when it does not answer, scores come from the CVE.org record. epss is null when FIRST has not scored the CVE yet. KEV is the CISA catalog (kev.listed false means not in the catalog at kev_catalog.released).",
    "as_of": "2026-10-25T09:00:00.000Z",
    "source": "CVE.org + NVD + FIRST EPSS + CISA KEV",
    "severity": "CRITICAL",
    "cve_state": "PUBLISHED",
    "published": "2021-12-10T10:15:09.143Z",
    "nvd_status": "Analyzed",
    "references": [
      {
        "url": "https://logging.apache.org/log4j/2.x/security.html",
        "tags": [
          "Vendor Advisory"
        ]
      }
    ],
    "source_url": "https://www.cve.org/CVERecord?id=CVE-2021-44228",
    "attribution": "CVE® record, Copyright © 1999-2026, The MITRE Corporation. Used under the CVE Program license (perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, sublicense and distribute CVE): https://www.cve.org/Legal/TermsOfUse This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS scores by FIRST / Empirical Security (https://www.first.org/epss/), free of charge. CISA Known Exploited Vulnerabilities Catalog, CC0 1.0; not an endorsement by CISA or DHS.",
    "cvss_scores": [
      {
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "primary": true,
        "version": "3.1",
        "provider": "NVD",
        "severity": "CRITICAL",
        "base_score": 10
      }
    ],
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "kev_catalog": {
      "count": 1756,
      "version": "2026.10.23",
      "released": "2026-10-23T19:30:18.000Z"
    },
    "sources_used": [
      "CVE.org"
    ],
    "last_modified": "2026-08-11T19:33:44.513Z",
    "reference_count": 103
  }
}