Exploitation data in audit results on every plan, plus Windows audit v4

Released August 31, 2026

Audit results can carry exploitation status, CVSS, EPSS and CISA SSVC on every plan, including free. The Windows KB audit moved to v4, with one finding per missing update.

Enrichment in audit results

Smart Audit and the software, host, Linux, library, SBOM and Windows KB audits accept fields (or cvelistMetrics: true) and, depending on the endpoint, add:

• metrics, the highest CVSS and EPSS across an advisory’s CVEs;
• cvelistMetrics, one entry per CVE with its CVSS, EPSS, AI score, exploitation status with sources and first-seen dates, and CISA’s SSVC decision on exploitation, automatability and technical impact.

Software, host and Smart Audit can also return exploitation status on its own, and they include the fixed version for each match. The docs list the values each endpoint accepts.

curl -XPOST https://vulners.com/api/v4/audit/library \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"packages": ["pkg:npm/[email protected]"], "fields": ["metrics", "cvelistMetrics"]}'

Docs: Enrichment

Windows KB audit v4

Given the updates installed on a Windows host, POST /api/v4/audit/kb returns the ones that are missing. Each comes back as a single finding with the KB to install, the CVEs it closes and the older updates it supersedes. One cumulative update can close more than a thousand CVEs, and here that is one finding instead of a thousand rows. A request takes up to 2,500 installed KBs, and KB5041160, kb5041160 and 5041160 count as the same update.

curl -sS -X POST "https://vulners.com/api/v4/audit/kb" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"osName": "Windows Server 2022", "osVersion": "10.0.20348", "kbList": ["KB5041160"]}'

Docs: Windows KB audit

CPE matching API

POST /api/v4/search/cpe takes raw software strings and returns, for each one, the version-agnostic CPE and the ranked runners-up. It runs on the same matcher as Smart Audit and helps when you need to normalize an inventory rather than audit it.

Docs: API reference

New sources and the Sources page

Three sources were added: vulnerability entries from the Rapid7 database at rapid7.com/db, Acronis security advisories, and the Z.ai coordinated vulnerability disclosure ledger, machine-translated from Chinese where the ledger has no English version. The Sources page at vulners.com/sources lists every source Vulners collects, grouped by category, with platform-wide numbers at the top.

Smaller changes

• The list of CNAs whose CVE records get CPE configurations from their own data grew by 22, among them Siemens, Fortinet, F5, VMware, Atlassian and JetBrains.
• The SBOM AI summary can be streamed from GET /api/v4/audit/sbom-ai-summary using the summaryId returned by the SBOM audit.
• The app follows your system’s light or dark setting.
• The collections endpoint returns each collection’s family and display name.
• Virtuozzo advisories include version ranges for affected libraries.