openapi: 3.2.0 info: title: Nucleus Security Vulnerability Intelligence Vulnerabilities API version: v1 summary: Public, unauthenticated read API behind the Nucleus Security vulnerability intelligence dataset. description: 'A live, public, unauthenticated JSON API served from Nucleus Security''s own domain at `https://nucleussec.com/wp-json/nucleussec/v1/`. It exposes the vulnerability intelligence dataset that backs the Nucleus Security public research pages - CVE records enriched with EPSS, CVSS v3/v4, CISA notes, GreyNoise tags, Shadowserver 30-day averages, VulnCheck XDB entries, and Nucleus Insights'' own exploitation flags (`nucleus_exploited_by_malware`, `nucleus_public_exploit_available`, `nucleus_impacts_ot`). THIS IS NOT THE NUCLEUS PLATFORM API. The Nucleus platform REST API is a separate, authenticated, per-tenant surface at `https://[instance-name].nucleussec.com/nucleus/api` whose Swagger definition is published only inside a logged-in customer console. See `apis.yml` and `conventions/nucleus-security-conventions.yml` for that distinction. PROVENANCE: this document was GENERATED by API Evangelist, not published by Nucleus Security. Paths, methods, parameter names and parameter defaults are transcribed verbatim from the provider''s own machine-readable WordPress REST route descriptor at https://nucleussec.com/wp-json/nucleussec/v1 (saved in `openapi/_original/`). The response schema is transcribed field-for-field from live 200 responses observed on 2026-08-26. Nothing here is inferred beyond the observed types. Nucleus Security does not publish an OpenAPI for this surface. ' contact: name: Nucleus Security url: https://nucleussec.com/contact/ x-provenance: method: generated generated_by: API Evangelist enrichment pipeline generated: '2026-08-26' route_descriptor: https://nucleussec.com/wp-json/nucleussec/v1 observed_response: https://nucleussec.com/wp-json/nucleussec/v1/vulnerabilities/list?per_page=3&page=1 observed_http_status: 200 observed_total_records: 1638 ownership_check: Served from nucleussec.com, the company's own primary domain, under a vendor-namespaced route (nucleussec/v1), returning records whose fields are Nucleus-branded (nucleus_exploited_by_malware, nucleus_public_exploit_available, nucleus_impacts_ot) and sourced from Nucleus Insights. Ownership is unambiguous. servers: - url: https://nucleussec.com/wp-json/nucleussec/v1 description: Public vulnerability intelligence API on the Nucleus Security corporate host. tags: - name: Vulnerabilities description: Enriched CVE records from the Nucleus Security public vulnerability intelligence dataset. paths: /vulnerabilities/list: get: operationId: listVulnerabilities summary: List enriched vulnerability records description: Returns a paginated page of enriched CVE records. Unauthenticated. Parameter names and defaults are taken verbatim from the provider's route descriptor. tags: - Vulnerabilities security: [] parameters: - name: page in: query required: false description: 1-based page number. schema: type: integer minimum: 1 default: 1 - name: per_page in: query required: false description: Records per page. schema: type: integer minimum: 1 default: 25 - name: search in: query required: false description: Free-text search across the record set. schema: type: string default: '' - name: sort_by in: query required: false description: Field to sort by. schema: type: string default: date_added - name: sort_dir in: query required: false description: Sort direction. schema: type: string default: DESC enum: - ASC - DESC responses: '200': description: A page of enriched vulnerability records. content: application/json: schema: $ref: '#/components/schemas/VulnerabilityListResponse' '404': description: No matching route. WordPress REST envelope, NOT RFC 9457 problem+json. content: application/json: schema: $ref: '#/components/schemas/WPRestError' /vulnerabilities: post: operationId: queryVulnerabilities summary: Query the vulnerability dataset description: POST-only route declared by the provider's route descriptor. The descriptor publishes an empty `args` array, so the request body shape is NOT declared by the provider and is NOT documented here. API Evangelist did not send a speculative body to this endpoint. Request body shape requires provider documentation. tags: - Vulnerabilities security: [] responses: '200': description: Query result. Response shape not declared by the provider descriptor. '404': description: No matching route. content: application/json: schema: $ref: '#/components/schemas/WPRestError' components: schemas: VulnerabilityListResponse: type: object description: Envelope returned by GET /vulnerabilities/list. required: - success - data - total - page - per_page - total_pages properties: success: type: boolean data: type: array items: $ref: '#/components/schemas/Vulnerability' total: type: integer description: Total records in the dataset matching the query. Observed 1638 on 2026-08-26. page: type: integer per_page: type: integer total_pages: type: integer WPRestError: type: object description: WordPress REST API error envelope. Not RFC 9457. properties: code: type: string examples: - rest_no_route message: type: string data: type: object properties: status: type: integer Vulnerability: type: object description: One enriched CVE record. All scalar values are serialised as JSON strings by the provider, including numeric scores; nullable fields are emitted as JSON null. properties: id: type: string description: Provider-internal record identifier. cve_id: type: string description: CVE identifier (MITRE CVE scheme). examples: - CVE-2025-67038 cve_link: type: string format: uri description: Canonical NVD detail URL for the CVE. vendor: type: string product: type: string date_added: type: string format: date description: Date the record entered the dataset (YYYY-MM-DD). epss_score: type: - string - 'null' description: FIRST EPSS probability score, serialised as a decimal string. cvssv3_base: type: - string - 'null' description: CVSS v3.x base score, serialised as a decimal string. cvssv4_base: type: - string - 'null' description: CVSS v4.0 base score, serialised as a decimal string. cisa_notes: type: - string - 'null' description: CISA-published note or advisory URL for the vulnerability. greynoise_tags: type: - string - 'null' description: GreyNoise tag(s) associated with observed exploitation traffic. shadowserver_30d_avg: type: - string - 'null' description: Shadowserver 30-day average observation count. vulncheck_xdb_entries: type: - string - 'null' description: VulnCheck XDB exploit database entries. nucleus_exploited_by_malware: type: - string - 'null' description: Nucleus Insights flag - known malware exploitation. "TRUE" or "FALSE". nucleus_public_exploit_available: type: - string - 'null' description: Nucleus Insights flag - public exploit available. "TRUE" or "FALSE". nucleus_impacts_ot: type: - string - 'null' description: Nucleus Insights flag - impacts operational technology. "TRUE" or "FALSE". created_at: type: - string - 'null' description: Record creation timestamp (YYYY-MM-DD HH:MM:SS). updated_at: type: - string - 'null' description: Record last-update timestamp (YYYY-MM-DD HH:MM:SS).