BountyHub Docs
CVE Watcher Search and Filters
CVE Watcher query syntax for CVE id, vendor, product, severity, CVSS, EPSS, KEV dates, exploit tier, ransomware, and free text, with copyable examples.
CVE Watcher search and filters
The CVE Watcher feed and the search field of ListCvesRequest accept a small
query language. Free-text terms are combined with AND; field:value filters
narrow the result set; any token can be negated.
The UI's filter rows build this string for you, but you can type or paste it directly into the search field — and agents can send the same string through the API.
#Quick reference
| Field | Aliases | Accepted values | Default behaviour |
|---|---|---|---|
| Free text | — | Any words or a quoted phrase | Contains, across CVE id, vendor, product, and description |
cve | id, cveid | CVE id or part of one | Contains; = for an exact match |
vendor | — | Vendor name or part of one | Contains; = for an exact match |
product | — | Product name or part of one | Contains; = for an exact match |
severity | sev | critical, high, medium, low, none, unknown | Exact bucket |
tier | signal | confirmed, likely, watch, none | Exact exploit tier |
cvss | score | 0 – 10 | >= the value |
epss | — | 0 – 1 | >= the value |
kev | added | YYYY or YYYY-MM-DD | Year = whole year; date defaults to >= |
due | — | YYYY or YYYY-MM-DD | Year = whole year; date defaults to >= |
exploit | — | true, false | Exact boolean |
ransomware | ransom | true, false | Exact boolean |
#Free text
A bare token matches anywhere in the CVE id, vendor, product, or short description. Multiple terms must all match:
Quote a term to keep its spaces together:
Free text uses case-insensitive substring matching, so a pasted URL or fragment
still works. An unknown field:value token is treated as free text rather than
an error.
#Field filters
Use field:value to filter on one field:
Comma-separate values to OR them within the same field:
A filter that appears twice is AND-ed, so this asks for two different vendors:
#Text matching
cve, vendor, and product match substrings by default. Prefix the value
with = for a case-insensitive exact match:
The first also matches "Apache Software Foundation"; the second matches only the vendor stored as exactly "apache".
#Number comparisons
cvss and epss accept the comparison operators >, >=, <, <=, and
=. The default is >=.
EPSS is a probability between 0.0 and 1.0; 0.5 means a 50% chance of
exploitation in the next 30 days.
#Date filters
kev (KEV added date) and due (CISA remediation deadline) accept two forms:
YYYYselects the whole year. The operator is ignored for a bare year:kev:2026is everything added in 2026.YYYY-MM-DDselects a date and honours the comparison operator. The default is>=, meaning on or after that date.
Use due:>=YYYY-MM-DD to find deadlines still ahead, or
due:<YYYY-MM-DD for deadlines before a date.
#Booleans and tiers
tier:confirmed means the CVE is in CISA KEV. tier:watch means public
exploit code exists but CISA has not confirmed exploitation. See
Exploit tier for how each tier is derived.
#Negation
Prefix any token with - or ! to exclude it:
Negation applies to the whole token, including its operator:
#Combining filters
Every whitespace-separated token is AND-ed. Within a token, comma-separated values are OR-ed.
That returns critical, KEV-confirmed CVEs with known ransomware use. The order of tokens does not matter.
#Examples
| Goal | Query |
|---|---|
| Critical KEV entries with public exploit code | severity:critical tier:confirmed exploit:true |
| Ransomware-linked CVEs added to KEV in 2026 | kev:2026 ransomware:true |
| High or critical Apache or nginx | severity:high,critical vendor:apache,nginx |
| Likely-exploited CVEs with EPSS at least 50% | tier:likely epss:0.5 |
| Public exploit code, but not confirmed by CISA | tier:watch |
| Remote code execution in a product, excluding Windows | "remote code execution" -product:windows |
| CVEs due in 2027 | due:2027 |
| KEV entries that are not ransomware-linked | tier:confirmed -ransomware:true |
#Using the filters in the UI
The feed starts with one Text filter row. Use Add filter to add
property rows, choose an operator, then press Search — filters are not
applied live. The UI sends the composed string as the API search field.
Results are ordered by CVE id descending, 25 per page. Load more fetches the next page with the response's cursor token.
#Using search through the API
Pass the same string in ListCvesRequest.search:
See CVE Watcher API and scopes for the full request and response shape.