CVE disclosures
Read public vulnerability disclosures, trace their sources, and investigate affected software in Cyber.
Y2 connects public vulnerability disclosures to the CVE, vendor, and software entities in the Cyber ontology. Open Cyber → CVEs to browse the catalog, filter it, inspect source assessments, or investigate related entities.
Public pages and sharing
Each collected CVE has a public URL such as /cve/CVE-2021-27460. It renders the disclosure and social preview metadata without requiring JavaScript or sign-in. The disclosure includes source-specific CVSS assessments, affected versions, fixes and workarounds, CISA KEV, dated EPSS and SSVC assessments, references, and collection provenance when those fields are available.
The share preview uses the same disclosure revision as the page. Copy the public link from a Cyber disclosure, share it through the native share sheet when available, or save its PNG card. Card URLs include a disclosure revision and template version. An unknown revision returns a missing-record response.
An unscored vulnerability remains visible. An absent patch or exploit indicator means that the collected sources do not report it. It does not establish that no patch or exploitation exists. Rejected CVEs display their assigning authority's rejection and retain historical revisions.
Machine-readable disclosures
Public disclosure representations do not require an API key:
| URL | Representation |
|---|---|
/cve/CVE-2021-27460.json | Current normalized disclosure |
/cve/CVE-2021-27460.md | Markdown disclosure |
/cve/index.json?cursor=… | Bounded, paginated public index |
/cve/feed.xml | Recent updates as an Atom feed |
/cve/status.json | Collection progress and source freshness |
https://api.y2.dev/public/cves/CVE-2021-27460?revision=… | An immutable disclosure revision |
The HTML route also supports Accept: text/markdown. The public index returns
items and nextCursor; a null cursor marks the end. The backend collection at
https://api.y2.dev/public/cves accepts limit from 1 to 100.
These representations contain attributed public source data. Private workspace notes, investigations, watch subscriptions, and internal entity identifiers are excluded.
The existing Cyber API also serves these disclosures. Search
GET /api/v2/cyber/cves for compact summaries linked to stable ontology entity
IDs, then read GET /api/v2/cyber/cves/{cveId} for the full record. Add
revision=<SHA-256> for a retained revision. Both endpoints use the intel:cyber
scope or the documented x402 flow. See the Intel API guide
and detail reference.
Watches and package checks
Save a CVE watch to receive an in-app alert when its disclosure changes. Product watches can narrow the vendor, product, and installed version. Source-specific version rules and conditional NVD configuration statements are preserved; uncertain matches are labeled for review.
The package checker accepts exact package versions and supported npm or Bun text lockfiles. Lockfiles are parsed locally. Only the package names, ecosystems, and versions submitted for checking are sent to OSV. The checker shows advisory identifiers, CVE/GHSA aliases, affected ranges, and fixes returned by that source. Your submitted inventory is not stored by Y2.
An empty result is limited to the submitted packages and the provider's response. Unsupported entries, omitted records, response limits, and incomplete advisory details are shown explicitly. A package match does not establish that vulnerable code is reachable in your deployment.
Collection and ontology
Primary CVE List records supply CNA and ADP disclosures. NVD contributes secondary assessments and CPE configurations; CISA KEV supplies exploitation-based priority; FIRST EPSS supplies dated exploitation probabilities. The primary authority's assessment leads the disclosure, while other source assessments remain visible. KEV membership does not overwrite technical CVSS severity.
GitHub advisory references from the primary record can add OSV package ranges and fix events after their CVE aliases are verified. An advisory missing from OSV leaves that enrichment partial; it does not invalidate the original disclosure.
Meaningful source changes produce immutable revisions. Re-fetching unchanged data does not rebuild the ontology graph. Existing CVE identities are reused, affected vendor/software links retain source evidence, and rejected or corrected assertions retire the links owned by those disclosures.
The collection status distinguishes incremental synchronization, historical baseline progress, legacy projection, and EPSS refresh. A successful delta fetch does not imply complete historical coverage. Historical imports use a pinned official snapshot, bounded batches, and a resumable checkpoint.
The source status describes collection attempts and their recorded progress. Check the baseline's processed and expected counts separately before relying on historical coverage.