CVEQL — Query Language

CVEQL (CVE Query Language) is CVEFeed.io’s structured query language for searching vulnerabilities with precision. Write queries that combine severity, CVSS score, affected products, CISA KEV status, EPSS scores, and more — using dot notation to traverse related data and logical operators to combine conditions.

CVEQL is available to all users, including unauthenticated guests (with lower rate limits and query timeouts).

Writing Queries

Queries follow the pattern field operator value, combined with the and and or logical operators and grouped with parentheses. There is no standalone not — negate a condition with !=, !~, or one of the not in / not startswith / not endswith operators.

Queryable Fields

Field	Type	Description
id	string	CVE ID (e.g., "CVE-2024-3400")
description	string	Full vulnerability description text
published	date	Publication date
last_modified	date	Last modification date
status	string	CVE status value
cvss_score	number	CVSS score (0.0–10.0)
severity	string	Severity level — "CRITICAL", "HIGH", "MEDIUM", "LOW", plus "NA" and "NONE" for CVEs with no CVSS score
is_remote	boolean	Whether the vulnerability is remotely exploitable
is_cisa_kev	boolean	Whether it appears in the CISA KEV catalog
has_epss	boolean	Whether EPSS scores are available
has_category	string	Vulnerability category id (e.g., "injection", "memory-corruption")

Category Values

has_category matches a closed taxonomy of 15 ids. Ids are hyphenated, and a value outside this list matches nothing rather than raising an error:

injection, memory-corruption, race-condition, xee, xss, csrf, ssrf, path-traversal, authentication, authorization, cryptography, information-disclosure, misconfiguration, supply-chain, denial-of-service

Each CVE is classified into at most one of these categories from its description, and many CVEs carry no category at all.

Related Data (Dot Notation)

You can query related data using dot notation:

Field	Description
products.name	Name of an affected product
products.vendor.name	Vendor name of an affected product
products.vendor.part	CPE part of the vendor ("application", "operating system", "hardware")
cwes.id	CWE identifier
cwes.name	CWE name
cisa_kevs.vulnerability_name	CISA KEV vulnerability name
cisa_kevs.date_added	Date added to CISA KEV
cisa_kevs.due_date	CISA remediation due date
cisa_kevs.known_ransomware_campaign_use	Known ransomware campaign usage — stored lowercase ("known", "unknown")
epss_scores.score	EPSS probability score
epss_scores.percentile	EPSS percentile
epss_scores.release_date	Date the EPSS score was published

Operators

Operator	Meaning
=	Equals
!=	Not equals
>, >=, <, <=	Numeric/date comparison
~	Contains (partial text match)
!~	Does not contain
in	Value is in a list
not in	Value is not in a list
startswith	String starts with
not startswith	String does not start with
endswith	String ends with
not endswith	String does not end with
and	Both conditions must match
or	Either condition must match

String comparison with =, !=, in, and not in is case-sensitive; ~, !~, startswith, and endswith are not. products.name is the exception — =, !=, ~, !~, in, and not in on it run through PostgreSQL full-text search and ignore case, while startswith and endswith are not supported on that field and silently match nothing.

Example Queries

Critical vulnerabilities with a CVSS score of 9.0 or higher:

cvss_score >= 9.0 and severity = "CRITICAL"

CISA KEV critical CVEs:

severity = "CRITICAL" and is_cisa_kev = True

Apache product vulnerabilities:

products.vendor.name ~ "apache"

Recent high-severity CVEs from 2025:

published >= "2025-01-01" and cvss_score >= 7.0

Vulnerabilities with known ransomware campaigns:

cisa_kevs.known_ransomware_campaign_use = "known"

Buffer overflow vulnerabilities that contain specific text:

description ~ "buffer overflow"

Query Validation

Click the Validate button to check your query syntax without executing it. This helps you catch typos or unsupported field names before running the search.

Rate Limits

CVEQL queries are rate-limited per tier:

Tier	Queries per Minute
Anonymous	5 (with 5-second query timeout)
Free	10
Starter	20
Pro	30
Enterprise	40

Authenticated queries get a 10-second query timeout; anonymous queries get 5 seconds.

Every CVEQL search — authenticated or not — is restricted to CVEs published in the last 90 days unless the query itself references published or last_modified. Mention either field anywhere in the query (for example severity = "CRITICAL" and published >= "2000-01-01") to search the full catalog. Each search response includes a default_date_filter boolean: true means the 90-day window was applied, false means your query supplied its own date range.