Sushii APIsecurity.sushii.dev ↗
Search and retrieve CVE vulnerability data including CVSS scores, severity ratings, affected vendors/products, CWE weaknesses, and CISA KEV status.
What is the Sushii API?
The security.sushii.dev API provides access to CVE vulnerability intelligence through 2 endpoints, returning up to 12 fields per record including CVSS v3 scores, severity levels, affected vendors and products, CWE identifiers, and CISA Known Exploited Vulnerabilities (KEV) status. The get_cve endpoint retrieves full details for a single CVE by ID, while search_cves lets you filter across the full catalog by keyword, severity, sort order, and KEV membership.
curl -X GET 'https://api.parse.bot/scraper/33379177-74b7-46c8-82d9-af320fc6f767/search_cves?kev=true&page=1&sort=published&query=microsoft&severity=critical' \ -H 'X-API-Key: $PARSE_API_KEY'
Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace security-sushii-dev-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""Walkthrough: CveIntel SDK — bounded, re-runnable; every call capped."""
from parse_apis.security_sushii_dev_api import CveIntel, Severity, Sort, CveNotFound
client = CveIntel()
# Search for recent critical vulnerabilities in the KEV catalog
for cve in client.cve_summaries.search(severity=Severity.CRITICAL, kev=True, limit=3):
print(cve.cve_id, cve.severity, cve.score, cve.published)
# Drill down: take the first Microsoft Edge CVE and get full details
item = client.cve_summaries.search(query="microsoft edge", sort=Sort.PUBLISHED, limit=1).first()
try:
full = item.details()
print(full.cve_id, full.cvss_vector, full.vendors, full.products)
except CveNotFound as e:
print(f"CVE gone: {e.cve_id}")
print("exercised: cve_summaries.search, CveSummary.details")
Search and filter CVE vulnerabilities by keyword, severity, sort order, and KEV status. Results are paginated with 25 items per page, auto-iterated by the SDK. Keyword search matches CVE ID, vendor, product, CWE, or description text.
| Param | Type | Description |
|---|---|---|
| kev | boolean | When true, show only CVEs in the CISA Known Exploited Vulnerabilities catalog. |
| page | integer | Page number (1-based). |
| sort | string | Sort order for results. |
| query | string | Free-text search matching CVE ID, vendor, product, CWE, or description. |
| severity | string | Filter by CVSS severity level. Omitted returns all severities. |
{
"type": "object",
"fields": {
"page": "current page number",
"items": "array of CVE summary objects",
"total": "total number of matching vulnerabilities",
"total_pages": "total number of pages available"
},
"sample": {
"data": {
"page": 1,
"items": [
{
"score": 8.4,
"cve_id": "CVE-2026-0487",
"is_kev": false,
"severity": "HIGH",
"published": "Jul 14, 2026",
"description": "SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location..."
}
],
"total": 81,
"total_pages": 4
},
"status": "success"
}
}About the Sushii API
Endpoints and Parameters
search_cves accepts a free-text query parameter that matches against CVE IDs, vendor names, product names, CWE identifiers, and description text. Results can be narrowed by severity (CRITICAL, HIGH, MEDIUM, LOW) and filtered to CISA KEV entries only using the kev boolean. Results are paginated at 25 items per page; the total and total_pages fields in the response let you iterate programmatically, and the Parse SDK handles auto-iteration. Each item in the items array is a CVE summary object suitable for building dashboards or alert feeds.
Full CVE Detail
get_cve takes a single cve_id string in CVE-YYYY-NNNNN format and returns the complete record: the numeric CVSS v3 score (or null if unscored), the cvss_vector string, severity enum, published and modified timestamps, arrays of vendors and products, cwes array, and a references array of advisory and patch URLs. This gives you everything needed to triage a specific vulnerability or cross-reference it against an internal asset inventory.
Coverage Notes
The API reflects the CVE Intelligence Dashboard at security.sushii.dev, which tracks CVSS v3.1 scoring. CVEs that have not yet been scored will return null for score and UNKNOWN for severity. The CISA KEV filter in search_cves surfaces only those CVEs confirmed to be actively exploited in the wild according to CISA's catalog, making it useful for prioritization workflows.
The Sushii API is a managed, monitored endpoint for security.sushii.dev — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when security.sushii.dev changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official security.sushii.dev API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Alert security teams when new CRITICAL or HIGH severity CVEs affect a specific vendor or product they maintain
- Build a KEV-only feed by filtering
search_cveswithkev: trueto track actively exploited vulnerabilities - Enrich internal asset inventories by cross-referencing
vendorsandproductsfields fromget_cveagainst deployed software - Generate weekly CVE digest reports filtered by severity level using the
severityparameter insearch_cves - Pull full CVSS vector strings and numeric scores from
get_cveto feed into risk-scoring pipelines - Identify all CVEs associated with a specific CWE weakness type via keyword search in
search_cves - Track patch and advisory URLs from the
referencesarray to automate remediation ticket creation
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does security.sushii.dev have an official developer API?+
What does the `search_cves` endpoint return, and how does pagination work?+
page number, total count, total_pages count, and an items array of CVE summary objects. Each page contains up to 25 items. You can pass the page parameter to iterate manually, or use the Parse SDK which auto-iterates across pages.What does the `kev` filter in `search_cves` actually do?+
kev: true restricts results to CVEs that appear in the CISA Known Exploited Vulnerabilities catalog — vulnerabilities with confirmed active exploitation. Omitting the parameter returns all CVEs regardless of KEV status.Does the API expose CVE data for CVSS v2 scores or only v3?+
get_cve endpoint returns a CVSS v3.1 vector string (cvss_vector) and a v3 numeric score. CVSS v2 scores are not currently exposed. You can fork this API on Parse and revise it to add a v2 score field if the source makes that data available.Is CPE (Common Platform Enumeration) data available for affected products?+
vendors and products as plain string arrays, without structured CPE identifiers. You can fork this API on Parse and revise it to add CPE data if it becomes available in the source.