# CVE Watcher search and filters

The CVE Watcher feed and the `search` field of `ListCvesRequest` accept a small
query language. Free-text terms are combined with AND; `field:value` filters
narrow the result set; any token can be negated.

The UI's filter rows build this string for you, but you can type or paste it
directly into the search field — and agents can send the same string through
the API.

## Quick reference

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Aliases
    </th>
    
    <th>
      Accepted values
    </th>
    
    <th>
      Default behaviour
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Free text
    </td>
    
    <td>
      —
    </td>
    
    <td>
      Any words or a quoted phrase
    </td>
    
    <td>
      Contains, across CVE id, vendor, product, and description
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        cve
      </code>
    </td>
    
    <td>
      <code>
        id
      </code>
      
      , <code>
        cveid
      </code>
    </td>
    
    <td>
      CVE id or part of one
    </td>
    
    <td>
      Contains; <code>
        =
      </code>
      
       for an exact match
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        vendor
      </code>
    </td>
    
    <td>
      —
    </td>
    
    <td>
      Vendor name or part of one
    </td>
    
    <td>
      Contains; <code>
        =
      </code>
      
       for an exact match
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        product
      </code>
    </td>
    
    <td>
      —
    </td>
    
    <td>
      Product name or part of one
    </td>
    
    <td>
      Contains; <code>
        =
      </code>
      
       for an exact match
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        severity
      </code>
    </td>
    
    <td>
      <code>
        sev
      </code>
    </td>
    
    <td>
      <code>
        critical
      </code>
      
      , <code>
        high
      </code>
      
      , <code>
        medium
      </code>
      
      , <code>
        low
      </code>
      
      , <code>
        none
      </code>
      
      , <code>
        unknown
      </code>
    </td>
    
    <td>
      Exact bucket
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        tier
      </code>
    </td>
    
    <td>
      <code>
        signal
      </code>
    </td>
    
    <td>
      <code>
        confirmed
      </code>
      
      , <code>
        likely
      </code>
      
      , <code>
        watch
      </code>
      
      , <code>
        none
      </code>
    </td>
    
    <td>
      Exact exploit tier
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        cvss
      </code>
    </td>
    
    <td>
      <code>
        score
      </code>
    </td>
    
    <td>
      <code>
        0
      </code>
      
       – <code>
        10
      </code>
    </td>
    
    <td>
      <code>
        >=
      </code>
      
       the value
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        epss
      </code>
    </td>
    
    <td>
      —
    </td>
    
    <td>
      <code>
        0
      </code>
      
       – <code>
        1
      </code>
    </td>
    
    <td>
      <code>
        >=
      </code>
      
       the value
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        kev
      </code>
    </td>
    
    <td>
      <code>
        added
      </code>
    </td>
    
    <td>
      <code>
        YYYY
      </code>
      
       or <code>
        YYYY-MM-DD
      </code>
    </td>
    
    <td>
      Year = whole year; date defaults to <code>
        >=
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        due
      </code>
    </td>
    
    <td>
      —
    </td>
    
    <td>
      <code>
        YYYY
      </code>
      
       or <code>
        YYYY-MM-DD
      </code>
    </td>
    
    <td>
      Year = whole year; date defaults to <code>
        >=
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        exploit
      </code>
    </td>
    
    <td>
      —
    </td>
    
    <td>
      <code>
        true
      </code>
      
      , <code>
        false
      </code>
    </td>
    
    <td>
      Exact boolean
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ransomware
      </code>
    </td>
    
    <td>
      <code>
        ransom
      </code>
    </td>
    
    <td>
      <code>
        true
      </code>
      
      , <code>
        false
      </code>
    </td>
    
    <td>
      Exact boolean
    </td>
  </tr>
</tbody>
</table>

## Free text

A bare token matches anywhere in the CVE id, vendor, product, or short
description. Multiple terms must all match:

```text
apache remote code execution
```

Quote a term to keep its spaces together:

```text
"sql injection" "authentication bypass"
```

Free text uses case-insensitive substring matching, so a pasted URL or fragment
still works. An unknown `field:value` token is treated as free text rather than
an error.

## Field filters

Use `field:value` to filter on one field:

```text
vendor:apache
severity:critical
tier:confirmed
cve:CVE-2024-3400
```

Comma-separate values to OR them within the same field:

```text
vendor:apache,nginx
severity:high,critical
tier:likely,watch
```

A filter that appears twice is AND-ed, so this asks for two different vendors:

```text
vendor:apache vendor:nginx
```

## Text matching

`cve`, `vendor`, and `product` match substrings by default. Prefix the value
with `=` for a case-insensitive exact match:

```text
vendor:apache
vendor:=apache
```

The first also matches "Apache Software Foundation"; the second matches only
the vendor stored as exactly "apache".

## Number comparisons

`cvss` and `epss` accept the comparison operators `>`, `>=`, `<`, `<=`, and
`=`. The default is `>=`.

```text
cvss:9
cvss:>=9
cvss:<4
epss:0.5
epss:>=0.9
```

EPSS is a probability between `0.0` and `1.0`; `0.5` means a 50% chance of
exploitation in the next 30 days.

## Date filters

`kev` (KEV added date) and `due` (CISA remediation deadline) accept two forms:

- `YYYY` selects the whole year. The operator is ignored for a bare year:
`kev:2026` is everything added in 2026.
- `YYYY-MM-DD` selects a date and honours the comparison operator. The default
is `>=`, meaning on or after that date.

```text
kev:2026
kev:>=2026-06-01
due:<2027-01-01
```

Use `due:>=YYYY-MM-DD` to find deadlines still ahead, or
`due:<YYYY-MM-DD` for deadlines before a date.

## Booleans and tiers

```text
exploit:true
ransomware:true
tier:confirmed
tier:watch,none
```

`tier:confirmed` means the CVE is in CISA KEV. `tier:watch` means public
exploit code exists but CISA has not confirmed exploitation. See
[Exploit tier](/cve-watcher/overview#exploit-tier) for how each tier is derived.

## Negation

Prefix any token with `-` or `!` to exclude it:

```text
-apache
!ransomware:true
-product:windows
-severity:low
```

Negation applies to the whole token, including its operator:

```text
-vendor:=apache
```

## Combining filters

Every whitespace-separated token is AND-ed. Within a token, comma-separated
values are OR-ed.

```text
severity:critical tier:confirmed ransomware:true
```

That returns critical, KEV-confirmed CVEs with known ransomware use. The order
of tokens does not matter.

## Examples

<table>
<thead>
  <tr>
    <th>
      Goal
    </th>
    
    <th>
      Query
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Critical KEV entries with public exploit code
    </td>
    
    <td>
      <code>
        severity:critical tier:confirmed exploit:true
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Ransomware-linked CVEs added to KEV in 2026
    </td>
    
    <td>
      <code>
        kev:2026 ransomware:true
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      High or critical Apache or nginx
    </td>
    
    <td>
      <code>
        severity:high,critical vendor:apache,nginx
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Likely-exploited CVEs with EPSS at least 50%
    </td>
    
    <td>
      <code>
        tier:likely epss:0.5
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Public exploit code, but not confirmed by CISA
    </td>
    
    <td>
      <code>
        tier:watch
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Remote code execution in a product, excluding Windows
    </td>
    
    <td>
      <code>
        "remote code execution" -product:windows
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      CVEs due in 2027
    </td>
    
    <td>
      <code>
        due:2027
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      KEV entries that are not ransomware-linked
    </td>
    
    <td>
      <code>
        tier:confirmed -ransomware:true
      </code>
    </td>
  </tr>
</tbody>
</table>

## Using the filters in the UI

The feed starts with one **Text** filter row. Use **Add filter** to add
property rows, choose an operator, then press **Search** — filters are not
applied live. The UI sends the composed string as the API `search` field.

Results are ordered by CVE id descending, 25 per page. **Load more** fetches the
next page with the response's cursor token.

## Using search through the API

Pass the same string in `ListCvesRequest.search`:

```json
{
  "search": "severity:critical tier:confirmed -product:windows",
  "pageSize": 50
}
```

See [CVE Watcher API and scopes](/cve-watcher/api) for the full request and
response shape.