OnlyPatch supports a structured query language on the search page that lets you filter CVEs by severity, CVSS score, month, researcher, weakness class, exploitation status, and patch-diff availability — and combine operators freely.
Search operators
| Operator | Example | Description |
|---|---|---|
severity: |
severity:critical |
Microsoft severity rating. Values: critical, important, moderate, low |
cvss: |
cvss:7+ |
CVSS base score filter. See syntax below. |
month: |
month:2026-07 |
Patch Tuesday month in YYYY-MM format |
cwe_id: |
cwe_id:CWE-416 |
CWE weakness class (e.g. Use After Free, Out-of-Bounds Write) |
author: |
author:"Genwei Jiang" |
Researcher credited in the MSRC acknowledgment. Quotes required. |
kev: |
kev:true |
CISA Known Exploited Vulnerabilities (KEV) status. Use kev:true or kev:false |
disclosed: |
disclosed:true |
Publicly disclosed before patch. Use disclosed:true or disclosed:false |
diffed: |
diffed:true |
Has a published binary patch-diff analysis. Use diffed:true or diffed:false |
has_poc: |
has_poc:true |
Has a public exploit / PoC repository (also has_exploits:, poc:). Use has_poc:true or has_poc:false |
has_detection: |
has_detection:true |
Has a public Sigma or Nuclei detection rule. Use has_detection:true or has_detection:false |
itw |
itw |
Exploited in the wild at time of disclosure |
The boolean facets — disclosed:, diffed:, has_poc:, has_detection:, and kev: —
take an explicit true or false value so you can search for either presence or
absence (e.g. diffed:false finds CVEs without a published patch-diff). itw remains a
bare keyword shorthand for exploited-in-the-wild.
Exploitation vs. availability — these mean different things:
itw— Microsoft flagged it exploited in the wild at disclosure.kev:true— it’s on the CISA Known Exploited Vulnerabilities catalog (added over time as exploitation is confirmed).has_poc:true— a public PoC/exploit exists on GitHub. This is not the same as “exploited”: many CVEs have a PoC but were never used in attacks, and some exploited CVEs have no public PoC.has_detection:true— a public Sigma/Nuclei rule exists to detect it.
CVSS score syntax
The cvss: operator accepts three forms:
| Syntax | Meaning | Example |
|---|---|---|
cvss:N+ |
Score ≥ N | cvss:7+ |
cvss:N-M |
Score between N and M (inclusive) | cvss:7-9 |
cvss:N.N |
Exact score (±0.05) | cvss:9.8 |
Combining operators
Just separate operators with a space — that space is the AND. Every operator you
add narrows the results further (all conditions must match). There is no AND keyword:
do not type AND — it isn’t an operator and would be treated as a free-text search word.
There is also no OR.
So severity:critical cvss:9+ means critical and CVSS ≥ 9 — the space between them
is what combines them.
severity:critical cvss:9+
severity:critical month:2026-07
cvss:7+ cwe_id:CWE-416
author:"Genwei Jiang" severity:critical
itw month:2026-07
has_detection:true severity:critical
diffed:true severity:important
You can also mix operators with free-text keywords:
severity:critical sharepoint
month:2025-10 exchange
Author search
The author: operator matches against MSRC acknowledgment credits. The value must always be quoted, even for single words:
author:"genwei"
author:"Genwei Jiang"
author:"mandiant"
The match is case-insensitive and substring-based, so author:"genwei" matches any researcher whose name contains “genwei”. Unquoted author:name is treated as free-text search, not an author filter.
Common queries
| Query | What it finds |
|---|---|
itw |
All CVEs exploited in the wild |
kev:true |
All CISA KEV-listed CVEs |
diffed:true |
CVEs with a published binary patch-diff |
has_poc:true |
CVEs with a public exploit / PoC on GitHub |
has_poc:true has_detection:false |
Has a public PoC but no detection rule yet |
has_detection:true |
CVEs with a Sigma/Nuclei detection rule |
has_detection:false |
CVEs with no public detection rule yet |
severity:critical cvss:9+ |
Critical CVEs with CVSS ≥ 9 |
severity:critical month:2026-07 |
Critical CVEs from July 2026 |
cwe_id:CWE-416 |
Use-After-Free vulnerabilities |
cwe_id:CWE-122 |
Heap-based buffer overflow |
cwe_id:CWE-190 |
Integer overflow |
disclosed:true diffed:true |
Publicly disclosed AND with a patch-diff |
has_detection:true severity:critical |
Critical CVEs that have a detection rule |
author:"Genwei Jiang" |
CVEs credited to Genwei Jiang |
author:"mandiant" severity:critical |
Critical CVEs credited to Mandiant researchers |
cvss:7-9 month:2025-10 |
CVSS 7–9 CVEs from October 2025 |
Data fields
Each CVE page shows:
- Overview — severity, CVSS score, exploitation and disclosure status, affected product family, CWE, EPSS probability
- CVSS Vector — full CVSS 3.1 base and temporal metrics with a link to the FIRST.org calculator
- Affected Software — product, KB article, severity, impact, fixed build
- Acknowledgments — researcher credits as published by MSRC
Coverage
CVE data runs from January 2019 to the current Patch Tuesday. Only CVEs issued by Microsoft (CNA = Microsoft) are included — third-party CVEs ingested into Edge bulletins (Chromium, V8, etc.) are excluded. CVSS scores are sourced from NVD where available and fall back to the MSRC-provided score.