https://cull.sh/api/v1/search
Search one product, package coordinate or vulnerability identifier.
curl -G 'https://cull.sh/api/v1/search' --data-urlencode 'q=joomla 1.5.4' --data-urlencode 'filter=cvss:>=9'
| Parameter | Use |
|---|---|
q | Required target expression. |
filter | Repeatable; values are combined with AND. |
sort | priority (default), cvss, epss, published or id. priority ranks by known exploitation, then any public exploit, then EPSS, and only then severity. |
limit | Default 50; responses are capped at 500 results. |
include | ruled_out and/or unchecked. |
view | ids returns affected IDs and aliases only, ordered by ID. It cannot be combined with filters or diagnostic collections. |
*_cursor | Opaque continuation cursor from the previous response. |
For a version that maps to a known upstream release line, lifecycle reports whether that line is supported, security-fixes-only, in extended support or end of life, with source and release-policy links. A strictly numeric version older than the source's oldest tracked, already-EOL numeric line is also reported as EOL without an invented end date. It is support context and never changes CVE applicability. Distribution package queries omit it because vendor support can outlive upstream support.
CVSS metric keys follow the base-vector vocabulary: AV, AC, AT, Au, PR, UI, S, C, I, A, VC, VI, VA, SC, SI and SA. Values use the canonical one-letter CVSS codes. A metric filter matches only findings whose selected base vector contains that exact metric and value; findings without a vector do not match.
/bulk
Search up to 100 targets in one request. Add ?findings=1 for compact finding summaries.
curl -X POST 'https://cull.sh/api/v1/bulk?findings=1' -H 'Content-Type: application/json' -d '{"queries":["joomla 1.5.4","openssl 1.0.1"]}'
| Input | Limit |
|---|---|
application/json | {"queries":["…"]} |
text/plain | One target per line. |
| Request | 100 queries · 64 KiB · 20 seconds. |
/trending
Return the ordered list of the 100 CVEs most often discussed during the last seven days. The ranking is refreshed daily; exact mention counts and collector diagnostics are intentionally not exposed.
curl 'https://cull.sh/api/v1/trending'
| Field | Meaning |
|---|---|
items | Up to 100 CVEs in rank order, each with a short product or advisory summary when available. |
updated_at | When the current daily ranking was produced. |
stale | True when the most recent daily snapshot is older than 48 hours. |
Mention frequency is a discovery signal, not evidence that a product is affected or that exploitation has occurred.
/wordpress
Return recent WordPress plugin, theme and core vulnerabilities from the Wordfence corpus, ordered by publication date with the newest disclosure first. Vector and severity parameters explicitly narrow that chronological stream.
curl 'https://cull.sh/api/v1/wordpress?window=7&limit=25'
The default filter is the one the homepage panel starts from: reachable over the network, requiring no privileges, scoring high or critical. Pass a parameter empty to clear that half of it: vector= drops the metric filter, and severity=any drops the band.
| Parameter | Meaning |
|---|---|
window | Days back to consider, 1 to 180. Default 30. |
limit | Records to return, 1 to 100. Default 100. |
vector | Comma-separated CVSS base metrics that must all be present, such as AV:N,PR:N. Default AV:N,PR:N. A record carrying no vector matches no metric filter. |
severity | any, low, medium, high or critical, meaning that band and above. Default high. Anything but any excludes records with no score. |
| Field | Meaning |
|---|---|
access | What the attacker needs: unauthenticated, low-privilege (subscriber or customer), granted-role (contributor, author, editor, shop manager), administrator, or unstated when the record does not say. |
impact | The weakness in the same vocabulary the primitive: filter searches, derived from cwe. |
unpatched | Wordfence names no fixed version for the affected range, so updating cannot bring an installation out of it. |
uncatalogued | No CVE was ever assigned. Roughly one record in fourteen, carried by Wordfence and by nobody else. |
rank | Position in this filtered, newest-first response. |
cvss_vector | The base vector the score came from, as the source stated it. This is what vector is matched against. |
filter | The filter that produced the response, so a caller relying on the defaults can read what they were. |
Rank one is the newest disclosure matching the requested filters. It does not say that any particular site is affected; resolve a version with /search for that.
Finding filters
Research directives can be written directly in q or supplied as repeatable filter parameters. Separate directives use logical AND and are applied before totals, sorting and cursor pagination. Every query inside a bulk request accepts the same syntax.
curl -G 'https://cull.sh/api/v1/search' \ --data-urlencode 'q=openssl 1.0.1' \ --data-urlencode 'filter=is:kev' \ --data-urlencode 'filter=cvss:>=7' \ --data-urlencode 'filter=vector:AV:N' \ --data-urlencode 'filter=vector:PR:N'
| Filter | Directives |
|---|---|
| Signals | is:kev, is:exploit, is:needs-review |
| Exploit type | tool:metasploit, tool:nuclei, tool:exploit-db, tool:unverified-poc, tool:unreviewed-exploit. A comma-separated list matches any named type. |
| Scores and dates | cvss:>=7, epss:>=10%, published:>=2025-01-01 |
| Fix and certainty | fixed:true, fixed:false, certainty:certain, certainty:uncertain |
| CVSS base vector | vector:AV:N, vector:AC:L, vector:PR:N, and the other CVSS v2, v3 and v4 base metrics. Repeat to combine metrics. |
| Attack primitive | has:primitive, primitive:CWE-22, primitive:"path traversal" |
Result status
AFFECTEDConfirmed applicable findings.NOT_AFFECTEDTarget resolved; no applicable finding remains.UNKNOWN_OR_UNCHECKEDRelevant evidence could not be decided safely.UNRESOLVEDNo product was resolved.Rate limits
No captcha and no key. Limits are per IPv4 address or IPv6 /64, and a bulk request counts as one request per query it carries. Every 429 and 503 carries a Retry-After header. Treat that header as part of the API contract: wait at least the stated number of seconds before sending the next request.
A wider set of dynamic rate limits and abuse-detection systems is active. Clients that ignore the limits and continue abusive traffic receive an IP ban. So don't do stupid shit.
| Limit | Value | On breach |
|---|---|---|
| Per-IP request rate | 100 requests / second | 429, immediate |
| In flight per client | 8 concurrent requests | 429, immediate |
| Shared work pool | queues a burst briefly | 503 if still full |
HTTP
200 success400 invalid request403 rejected request413 request too large429 rate limited500 internal error503 temporarily unavailable504 timeoutComplete schemas: OpenAPI 3.1 JSON.