Skip to content

API for developers

Pull the community verdict for any CVE (real vs false positive, exploitability, real-world severity, and where it diverges from the CVSS score) as JSON. Free, public, read-only. No API key, CORS-open, edge-cached.

Verdict endpoint

Returns the community verdicts for a single CVE.

GET https://www.truepositive.app/api/cve/{cveId}/verdict

Example

curl https://www.truepositive.app/api/cve/CVE-2021-44228/verdict

Response

{
  "cveId": "CVE-2021-44228",
  "url": "https://www.truepositive.app/cve/CVE-2021-44228",
  "badge": "https://www.truepositive.app/cve/CVE-2021-44228/badge.svg",
  "cvss": 10,
  "cvssSeverity": "critical",
  "kev": true,
  "kevAddedAt": "2021-12-10T00:00:00.000Z",
  "vulncheckKev": {
    "listed": true,
    "dateAdded": "2021-12-10T00:00:00.000Z",
    "source": "VulnCheck KEV",
    "url": "https://vulncheck.com/kev"
  },
  "epss": 0.99999,
  "publishedAt": "2021-12-10T10:15:09.143Z",
  "ssvc": {
    "source": "CISA Vulnrichment (CISA Coordinator decision model v2.0.3)",
    "assessedAt": "2025-02-04T14:25:34.416Z",
    "exploitation": "active",
    "automatable": "yes",
    "technicalImpact": "total",
    "kevOverride": null,
    "decisionByMission": { "low": "Attend", "medium": "Act", "high": "Act" }
  },
  "packages": [
    {
      "ghsaId": "GHSA-jfh8-c2jp-5v3q",
      "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
      "ecosystem": "Maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "vulnerable": "≥ 2.13.0, < 2.15.0; ≥ 2.0-beta9, < 2.3.1; ≥ 2.4, < 2.12.2",
      "patched": ["2.15.0", "2.3.1", "2.12.2"],
      "severity": "critical"
    }
  ],
  "packagesSource": "GitHub Advisory Database (CC-BY 4.0) via OSV.dev",
  "community": {
    "sampleSize": 4,
    "topVerdict": "real_exploitable",
    "topVerdictLabel": "Real & exploitable",
    "tally": { "real_exploitable": 3, "real_conditional": 1 },
    "practicalSeverity": { "top": "critical", "distribution": { "critical": 3, "high": 1 } }
  },
  "divergesFromCvss": false,
  "generatedAt": "2026-06-22T12:00:00.000Z"
}

Fields

cveIdThe CVE identifier.
cvss / cvssSeverityNVD CVSS base score and its severity band.
kevListed in the CISA Known Exploited Vulnerabilities catalog.
kevAddedAtDate CISA added it to KEV (null when not in KEV or not yet recorded).
vulncheckKevWhether VulnCheck's own known-exploited catalog lists it, and since when. A separate, larger catalog than CISA KEV; credit it as VulnCheck KEV if you republish it.
epssFIRST EPSS exploitation-probability (0–1).
ssvcCISA's SSVC assessment from CISA Vulnrichment, or null if CISA hasn't assessed it.
ssvc.exploitation / automatable / technicalImpactCISA's decision points, verbatim: none | poc | active · no | yes · partial | total.
ssvc.kevOverrideNon-null when the CVE is in KEV but CISA's SSVC Exploitation isn't active: decisions then use active. newer = KEV listing postdates the assessment; conflict = the order can't be shown.
ssvc.decisionByMissionCISA outcome (Track | Track* | Attend | Act) for low / medium / high Mission & Well-being impact. CISA doesn't publish that point; pick the level that matches your system.
packagesAffected packages from the GitHub Advisory Database (CC-BY 4.0, credit GitHub if you republish): ecosystem, package name, vulnerable ranges and the first patched version of each branch. Empty when GitHub hasn't advised the CVE.
community.sampleSizeNumber of practitioner verdicts (0 if none yet, honest, never fabricated).
community.topVerdictMost common verdict: real_exploitable | real_conditional | real_theoretical | not_applicable | mitigated | false_positive | cannot_reproduce.
community.tallyCount of each verdict value.
community.practicalSeverityReal-world severity distribution from the field.
editorialTruePositive's own curated baseline verdict, reported separately and never counted as a community verdict. Null when there is none.
divergesFromCvssTrue when CVSS is high (≥7) but the field considers it not actually exploitable: the signal NVD can't give you.

Embeddable badge

A live SVG verdict badge for READMEs, advisories, dashboards:

[![TruePositive](https://www.truepositive.app/cve/CVE-2021-44228/badge.svg)](https://www.truepositive.app/cve/CVE-2021-44228)

Notes

← Browse CVEs