KEVWire

Fetch one record by CVE ID, GHSA ID, or KEVWire record ID, with every source, measurement date, CISA deadline and a permalink. Any published CVE resolves, even outside the tracked set. Returns isError with a hint when nothing matches; then try search_vulnerabilities.

Vulnerabilities with documented exploitation (CISA KEV or explicit reporting) published within the last N days, most urgent first. Use it for briefings such as "what was exploited this week"; to narrow by product or words, use search_vulnerabilities with known_exploited_only. Paged with offset and hasMore.

Every source KEVWire ingests, with scope, limitations, retrieval status, last success and record counts. Use it to describe coverage honestly or to explain why something may be missing.

Technology labels (vendors and products) usable in search_vulnerabilities' technologies filter, with how many records each covers, most covered first. Use it to find the exact label before filtering. Optionally filter by text.

Search the KEVWire corpus (CISA KEV, NVD high/critical CVEs, GitHub advisories, national CERTs, security reporting, editorial records) by words, technology, kind or exploitation. Use it to answer "is X affected" or "what is known about Y"; for a known ID use get_record, and for a plain "what is being exploited lately" list use list_recent_exploited. Default order is "urgent": the last 30 days first, then known exploitation, CVSS 9+, breaches. Results are paged (see hasMore and offset) and include source URLs to cite.