Vulnerability Management and Web App Scanning: New Export Filters and Scoring Data (VPRv2, CVSSv4, EPSS)

Tenable has enhanced the Vulnerability Management vulnerabilities export and Web App Scanning findings export APIs with new filters and additional response data. These updates provide greater flexibility for querying and analyzing vulnerabilities, adding new filters and returning expanded scoring metrics in export responses.

New Filters

Use the following new filters to refine your vulnerability and findings exports:

• vpr_v2_score — Filter vulnerabilities by their Vulnerability Priority Rating (VPR) version 2 score, labeled VPR (Beta) in the user interface. To learn about the enhancements introduced in VPR v2, refer to the whitepaper Enhancements to Tenable Vulnerability Priority Rating (VPR). For details about VPR, see Vulnerability Priority Rating in the Tenable Vulnerability Management User Guide.
• cvss4_base_score — Filter vulnerabilities by their CVSS version 4 (CVSSv4) base score. For more details about CVSSv4, see the CVSS v4.0 Specification.
• epss_score — Filter vulnerabilities by their Exploit Prediction Scoring System (EPSS) score, expressed as a percentage from 0 to 100. For more information, see FIRST's Exploit Prediction Scoring System (EPSS). Note that this filter is currently only available for Vulnerability Management exports. It will be added to Web App Scanning findings exports soon.
• initiative_id — Filter vulnerabilities by the unique identifier (UUID) of an Exposure Response initiative, enabling you to scope results to a specific initiative. For more information, see Exposure Response in the Tenable Vulnerability Management User Guide. Note that this filter is only applicable to Vulnerability Management exports.

Example: Using the vpr_v2_score filter:

For example, to export vulnerabilities with VPR scores between 9.0 and 9.9, you could use the following request:

{
  "num_assets": 5000,
  "filters": {
    "vpr_v2_score": {
      "gte": 9,
      "lte": 9.9
    }
  }
}

Example: Using the cvss4_base_score filter:

For example, to export vulnerabilities with a CVSSv4 base score of 8.2, you could use the following request:

{
  "num_assets": 5000,
  "filters": {
    "cvss4_base_score": {
      "eq": [
        8.2
      ]
    }
  }
}

Example: Using the epss_score filter:

For example, to export vulnerabilities with an EPSS score greater than or equal to 90, you could use the following request:

{
  "num_assets": 5000,
  "filters": {
    "epss_score": {
      "gte": 90
    }
  }
}

New Export Response Data

The Vulnerability Management Download vulnerabilities chunk endpoint and the Web App Scanning Download findings export chunk now return expanded scoring data in their responses. This includes VPRv2, CVSSv4, and EPSS metrics, enabling more detailed analysis of each vulnerability.

The new VPRv2 data is returned in the plugin.vpr_v2 object. The following table describes the new VPRv2 properties provided in the response.

The new CVSSv4 data is returned in the plugin.cvss4_vector and plugin.cvss4_threat_vector objects. Additionally, the CVSSv4 base score is returned in the plugin.cvss4_base_score property. The following table describes the new CVSSv4 properties provided in the response.

📘

Note

The cvss4_threat_vector object is currently only available for Vulnerability Management exports. It will be added to Web App Scanning findings exports soon.

The new EPSS data is returned in the plugin object as epss_score.

📘

Note

The epss_score property is currently only available for Vulnerability Management exports. It will be added to Web App Scanning findings exports soon.