The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →ZoomEye documents vul.cve as the field for searching by CVE ID. A zero-result search means the query and its active filters matched no records returned by ZoomEye at that time. It does not prove that no vulnerable internet-facing assets exist.
How to search ZoomEye for a CVE
Start with the full CVE identifier in the documented field:
As an Amazon Associate I earn from qualifying purchases.
vul.cve="CVE-2021-44228"
ZoomEye’s team documentation uses that syntax as its example. Replace the identifier with the CVE you want to investigate. See the ZoomEye documentation for the search field and examples.
Recommended Free Tools
What a zero result does—and does not—tell you
A zero count tells you only that ZoomEye returned no records matching that query and its active search scope at that moment. The documentation does not promise exhaustive coverage of all internet-facing assets or define zero as evidence that an asset is unaffected. It also gives no coverage percentage or measured false-negative rate.
#1 Best Overall
Use the result as one search signal, not as a vulnerability census. To assess your environment, compare the affected product and version against your own asset inventory and a current independent vulnerability source. The result should not override evidence that an affected product is present.
Troubleshoot the query in this order
- Run the bare CVE query. Use a complete, correctly quoted identifier, such as
vul.cve="CVE-2021-44228", before adding other conditions. - Remove extra filters. Conditions such as
apporis_newcan narrow the matches; geography, dates, and other filters can do the same. If the combined query returns zero, test the CVE field alone. - Check the subtype. ZoomEye’s API documents
v4,v6, andwebsubtypes, withv4as the default. Choose the scope that corresponds to the asset class you intend to search; a search limited to one subtype is not a search across all three. - Review matching syntax carefully. The API reference says ordinary search is case-insensitive and matches after segmentation. It also documents
==for precise matching with stricter case-sensitive syntax. These are general search rules; the reference does not specify every field-specific edge case for malformed or partialvul.cvevalues. - If using the API, verify the request. The reference describes
POST /v2/search, API-KEY authentication, and a requiredqbase64parameter containing the Base64-encoded query. Check the encoded query, selected fields, subtype, page, and page size when interpreting the response. - Consider cache settings only if eligible. The API reference lists
ignore_cacheas supported for Business plan and above. This is an option to test where available, not evidence that caching caused a particular zero-result response. - Cross-check the finding. Compare ZoomEye’s result with the affected product/version in your inventory and another current vulnerability source before concluding that your environment is clear.
What ZoomEye’s API scope means
The ZoomEye API reference describes search across devices using IPv4 and IPv6, and websites using domain names. It says the search runs globally across content from several protocols. As the reference puts it, “Search scope covers devices (IPv4, IPv6) and websites (domain names).” That describes the documented search scope; it is not an assurance that every asset within those categories is indexed.
The API reference is marked “Update time：2024-12-04.” Since API behavior and account access can change, check the current ZoomEye API documentation before relying on specific parameters or plan eligibility.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Rank #3
Diagnose by changing one variable at a time
- Bare query versus filtered query: If the bare CVE search returns records but a filtered search does not, one or more added conditions narrowed the match set.
- Subtype: Test the intended IPv4, IPv6, or web scope instead of assuming the default IPv4 search covers every asset type.
- Interface versus API: When reproducing a web-interface search through the API, confirm that the encoded query and request parameters preserve the same intended conditions.
- Cache: If your plan supports
ignore_cache, compare with that option enabled; do not assume cache was the cause unless the results demonstrate a difference. - External evidence: Treat disagreement between ZoomEye and your inventory or another source as a reason to investigate the asset and product/version, not as proof that one source is universally complete.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
