How one API call replaces four fragmented sources, closes the NVD-to-action gap in under 5 minutes, and costs less than one hour of analyst time per month.
Every security team has a CVE problem. Not a shortage of CVE data — a surplus of it, scattered across sources that disagree, update at different rates, and give you no way to prioritize.
NVD publishes 200–400 CVEs per day. CISA adds entries to KEV on its own schedule. GitHub shows PoC exploit code hours before any official feed picks it up. Your SIEM fires on a CVE ID. You need CVSS, the exploit status, whether a patch exists, and a detection rule — immediately, not after two browser tabs and a grep through three CSVs.
The ValtersIT API is the single endpoint that gives you all of that, per CVE, on demand.
What the free sources actually cost you
The common response to "we need CVE enrichment" is to stitch together free sources: NVD API, CISA KEV CSV, OSV.dev, ExploitDB. This works. It also means maintaining four integrations, handling rate limits on all four, reconciling data that contradicts itself (NVD says CVSS 7.5, an advisory says 9.8), and re-running the chain every time you need fresh data.
| Source | What it gives you | What it doesn't give you |
|---|---|---|
| NVD API | CVSS, CWE, CPE | EPSS, real exploit status, patch confirmation, detection rules |
| CISA KEV | Active exploitation flag | CVSS, EPSS, technical detail, detection content |
| OSV.dev | Package-level vuln records | Normalized severity, MITRE tactic, PoC code |
| ExploitDB | PoC code | Machine-readable CVE linkage, CVSS, KEV status |
| GitHub CVEProject | Raw JSON from CNAs | No enrichment, no structured severity, no detection content |
Correlating these manually takes 15–30 minutes per CVE. Automating it takes weeks of engineering time and ongoing maintenance.
A typical security engineer costs €60–100/hr fully loaded. One hour of manual CVE research per week is €3,000–5,000/year. The ValtersIT Standard plan is €19/month.
What one API call returns
curl -s https://api.valtersit.com/api/v1/cve/CVE-2024-3400 \
-H "Authorization: Bearer vit_v1_YOUR_KEY" | jq
{
"cve_id": "CVE-2024-3400",
"vendor": "Palo Alto Networks",
"severity": "critical",
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"epss": 0.9744,
"has_exploit": true,
"has_patch": true,
"cisa_kev": true,
"poc_status": "Public",
"cwe_id": "CWE-77",
"mitre_tactic": "T1190",
"shodan_dorks": ["product:\"GlobalProtect\"", "http.title:\"GlobalProtect\""],
"affected_version": "PAN-OS 10.2, 11.0, 11.1 below specific versions",
"patch_details": "Fixed in PAN-OS 10.2.9-h1, 11.0.4-h1, 11.1.2-h3",
"yara_rule": "rule CVE_2024_3400 { ... }",
"wazuh_rule": "<group name=\"vulnerability,...\"> ... </group>",
"elastic_rule": "process where process.args : \"*/...AAAA*\"",
"pending_fields": [],
"credits_used": 1
}
That is one HTTP request. Everything needed to triage, alert, and respond — no joins, no secondary lookups, no format reconciliation.
The EPSS number changes everything
CVSS scores are assigned once and rarely change. A CVE with CVSS 7.5 from 2023 sits in the same bucket as a CVE with CVSS 7.5 from last week, even if one has active exploits in the wild and the other has never been touched.
EPSS (Exploit Prediction Scoring System) is updated daily and measures the probability of exploitation in the next 30 days based on real-world data. The ValtersIT API returns it as a decimal float (0.0–1.0) on every CVE record, normalized — no string parsing needed.
Practical prioritization:
import requests
resp = requests.get(
"https://api.valtersit.com/api/v1/cve",
headers={"Authorization": f"Bearer {API_KEY}"},
params={"severity": "critical", "has_exploit": "true", "limit": 20}
)
for cve in resp.json()["data"]:
# EPSS >0.5 = 50%+ chance of exploitation in next 30 days
if cve["epss"] and cve["epss"] > 0.5:
print(f"{cve['cve_id']} | CVSS {cve['cvss']} | EPSS {cve['epss']:.1%} | {cve['vendor']}")
This query runs in under 300ms. The same result from NVD + EPSS API requires two separate authenticated calls, rate limit awareness, and field normalization.
Detection content included — not add-on priced
Every CVE that has had detection content generated ships it in the API response with no extra call. YARA rules, Wazuh rules, and Elastic EQL/KQL queries are included on every paid plan. Sigma rules and raw PoC code are Pro only.
Getting detection content from free sources requires a Sigma rule repository (often months behind), manual YARA authoring, or a paid subscription to a different vendor. The ValtersIT API includes it in the same response you're already making.
The data honesty contract
Free CVE feeds hide their gaps behind null values that look identical to "this field genuinely doesn't apply." The ValtersIT API separates the two cases explicitly:
{
"cve_id": "CVE-2026-99999",
"cvss": null,
"pending_fields": ["cvss", "epss", "mitre_tactic"]
}
pending_fields means NVD hasn't assigned these values yet (CVSS typically arrives 2–14 days after publication). When they do, the field moves out of pending_fields. On Pay-As-You-Go, the backfill is free — you're not charged twice because NVD caught up.
Pricing: less than one analyst-hour per month
Founding Member pricing — ends 31 Dec 2026
Standard €19/mo (list €29) and Pro €65/mo (list €99), locked permanently for subscriptions started before 1 Jan 2027.
| Plan | Price | Credits/mo | Sigma + PoC code |
|---|---|---|---|
| Sandbox | Free | — (10 synthetic records) | — |
| Standard | €19/mo | 10,000 | — |
| Pro | €65/mo | 50,000 | ✓ |
| Pay-as-you-go | €5/1,000 credits | — | — |
One credit per CVE record returned. Already-fetched CVEs on Standard/Pro are always free to re-check.
Start in 30 seconds — no credit card
The sandbox key is public. Ten synthetic CVE records, full response shape, immediate testing:
curl -s "https://api.valtersit.com/api/v1/cve" \
-H "Authorization: Bearer vit_sandbox_free_demo_key_2026" \
| jq '.data[0] | {cve_id, vendor, cvss, epss, cisa_kev, has_exploit, pending_fields}'
When ready for real data: api.valtersit.com
The gap the ValtersIT API closes
Between "CVE is published" and "your team acts on it" there are four steps: find it, enrich it with CVSS/EPSS/KEV/exploit status, write or find detection content, distribute to whoever needs it. Free tools require a human to do all four manually. The ValtersIT API collapses steps two and three into a single HTTP call.
That's not a small efficiency gain. It's the difference between a CVE being actionable in 5 minutes and actionable in 5 days.
Top comments (0)