GET /v1/vulns/{id} looks up a CVE or GitHub advisory in cve.org, CISA KEV, FIRST EPSS, GitHub advisories and NVD: state, CVSS, CWE, affected products and versions, KEV dates, EPSS score, aliases and references. An unknown id answers exists: false; it is never guessed.
GET /v1/orgs/{org}/vulns/{id}/exposure compares it with every proxied site you can see, passively: the site's stack setting and a fingerprint of its homepage taken once a day. Each site gets affected, posible or no_detectado, a confidence, the evidence and the state of the edge's mitigation, for example shield 1009 for CVE-2026-111497. Any role can use both.
From the terminal, openwaf-cloud ctl vulns show and ctl vulns exposure; in MCP, the new read tools vuln_lookup and vuln_exposure.
See Does this CVE affect me? and the API reference.